IPSec VTI VPN access device in overlapping subnet

baba

@Zyxel_Joshua thank you! Same config as mine so i have to enable the the "Policy Route overwrite Direct Route" option. Whats about Rule #1 in my screenshot? It must forward all traffic from wan1 Site B to USG Flex from Site A? Is it sage with the "Policy Route overwrite Direct Route" option?

Thanks!

Best,
baba

baba

Shouldn‘t be in Rule #3 next hop 10.70.70.2 instead of 10.70.70.20?

Zyxel_Joshua

https://community.zyxel.com/en/discussion/comment/56382#Comment_56382

If the destination is directly connect to 10.70.70.20.

Why you need to route to 10.70.70.2 for another hop cost ?

Zyxel_Joshua

https://community.zyxel.com/en/discussion/comment/56381#Comment_56381

Cloud you explain more for the requirement and use case of rule #1 wan1 to …

baba

@Zyxel_Joshua rule #1 routes all incoming wan traffic from right USG to left USG. With this rule i want to ensure that left USG is also reachable from the public IP of right USG

baba

Allowing asymmetrical routes may let traffic from the WAN go directly to the LAN withoutpassing through the ZyWALL. A better solution is to use IP alias to put the ZyWALL and the backup gateway on separate subnets.

Found this in documentation. This means all WAN traffic now goes to LAN without NAT and Security Policy Routes? Whats about the IP alias solution, would it work?

Thanks!

baba

https://community.zyxel.com/en/discussion/comment/56384#Comment_56384

10.70.70.20 has 10.70.70.2 as default gateway. If 10.70.70.2 hop will be skipped when coming from 10.50.0.0/16 then 10.70.70.20 can not answer, or I am wrong?

Zyxel_Joshua

https://community.zyxel.com/en/discussion/comment/56416#Comment_56416

"Allowing asymmetrical routes may let traffic from the WAN go directly to the LAN without passing through the ZyWALL."

This is wrong statement.

The security policy still check and block not allowed traffic. If there a policy not allow WAN to LAN.

Zyxel_Joshua

https://community.zyxel.com/en/discussion/comment/56417#Comment_56417

If the next-hop of rule #3(of my comments) is 10.70.70.2, you get 4 steps of a roundtrip.

If the next-hop of rule #3(of my comments) is 10.70.70.20, you get 3 steps of a roundtrip.

So that, next-hop set to 10.70.70.20 is one lease hop cost (network latency) than to 10.70.70.2

baba

@Zyxel_Joshua thank you for the detailed explanation! If you have any idea about the wan route then you have made me happy!

https://community.zyxel.com/en/discussion/comment/56407#Comment_56407

Thanks!