Create policy rules VPN Access for different Geolocations

nielsscheldeman

A client has 2 IPSEC VPN USers: 1 works from Belgium, other 1 from USA

He wants the useraccounts only to work from their own region.

So I create 2 policy rules

WAN → ZyWALL, IPv4 source GEO_BELGIUM, Service IKE and User: belgium ext-group-user(AD User!)

WAN → ZyWALL, IPv4 Source, GEO_USA, Service IKE and User: USA ext-group-User(als AD User)

As soon as I specify the rules on user level, VPN doesn't work anymore. How can I make this split happen? Reason is, we have 10 Belgium VPN users and 1 USA, but we don't want all the accounts to be able to log in from USA to minimize the chanse on account compromising.

PeterUK

Before the VPN connects from WAN to Zywall the user must be any it is only after the VPN connects that Zywall knows the user to control traffic

nielsscheldeman

https://community.zyxel.com/en/discussion/comment/74536#Comment_74536

So there is no other option to geofence users?

PeterUK

No if you want to limit access more you can have the remote ends use DDNS so you can have:

WAN → ZyWALL, IPv4 source DDNS FQDN, Service VPN