Dual networks - where WAN2 is simply the LAN of the other network - cant talk

JPElectron

Two companies in the same office both have their own networks, and their own (different) ISPs. Neither company is paying for static IPs from the ISPs, so they each only get only 1 dynamic IP. Thus, to have a backup Internet connection, I connected WAN2 of each company's firewall to the LAN of the other. These companies also agree to share printers on each-others networks.

ISP fail-over works great…
Side A can access the printers in Side B's network without issue…
However Side B cannot access anything in Side A's network (the only connection is WAN2 of the USG is connected to the LAN of the opposite company)

I have made no special rules for this, side A to B just works.

However side B to A does not work in the same way, as I would have expected.

How can I solve this?

PeterUK

I found a problem with LAN2 on my FLEX200 not sure if that could cause a problem maybe try reserved and not LAN2

maybe you added a routing rule or miss a Policy Control?

I think their is another way to do this I have a think….

PeterUK

here is the other way

On side A

Make zone WAN2 move WAN2 to zone WAN2

WAN2 IP 10.255.255.1/24 gateway 10.255.255.2

routing rule

incoming LAN of 192.168.22.0/24

destination 10.0.0.0/24

next hop gateway 10.255.255.2

SNAT none

Policy Control

LAN zone of 192.168.22.0/24 to WAN2

WAN2 to LAN zone of 192.168.22.0/24

On side B

Make zone WAN2 move WAN2 to zone WAN2

WAN2 IP 10.255.255.2/24 gateway 10.255.255.1

routing rule

incoming LAN of 10.0.0.0/24

destination 192.168.22.0/24

next hop gateway 10.255.255.1

SNAT none

Policy Control

LAN zone of 10.0.0.0/24 to WAN2

WAN2 to LAN zone of 10.0.0.0/24

connect side A WAN2 and side B WAN2

JPElectron

I appreciate the help - in troubleshooting this I determined the switch port that goes over to the other office WAN2 port was tagged the wrong VLAN, meaning effectively that WAN2 on the B side was not connected, hence the real reason for this problem. Everything works correctly now.

PeterUK

Good that your way works but you might find that if you go from 192.168.22.22 to 10.0.0.11 that what 10.0.0.11 see is from 10.0.0.2

JPElectron

Yes, you are correct, the traffic from the other LAN all appears as from the single IP assigned to the WAN2 interface - in my case I'm OK with that.

PeterUK

You might be able to do a routing rule to stop that along with a static route but if you happen with what you got go with it.