multiple site to site vpn accessing the same resources.

mike4682

This is not the typical vpn access that i usually setup and it has me a bit stumped.

I have a site to site vpn that was setup to access a set of devices on the network. I'll try and explain this best I can. ips are just examples and there are 4 devices that need to be accessed.

VPN-1 Site A (devices vlan 100-10.10.100.1/29) vpn connection to site B (10.10.200.1/24). this is working and in use.

we have added a new vpn: VPN-2 site A (10.20.20.100.1/29) vpn to site C (10.20.20.200.1/24)

I also added individual NAT for the ip's from the 2nd vpn to send to existing device vlan ip's.

10.20.20.100.2 NAT to 10.10.100.2

10.20.20.100.3 NAT to 10.10.100.3

and so on for the 4 devices.

I can ping the 1st device but no http or https. and the rest are totally unreachable.

I'm thinking it may need a snat or maybe because the existing device ip's are on a vlan tied to the phase 2 of VPN-1.

Any insight would be greatly appreciated. feeling a little defeated over this one.

Thanks!

mike4682

I have an ATP500 deployed at this site.

mike4682

I have an ATP500 deployed at this site.

PeterUK

So the devices are on vlan 100-10.10.100.1/29
with site to site at site A
Local 10.10.100.1/29
Remote 10.10.200.1/24

So at site C site to site should be
Local 10.20.20.200.1/24
Remote 10.10.100.1/29

and a new site to site at A
Local 10.10.100.1/29
Remote 10.20.20.200.1/24

Zyxel_James

I'm not quite sure about your scenario. Do you want to access SiteA 10.10.100.1/29 from SiteC 10.20.200.1/24?
but the local/remote policy is 10.20.100.1/29 - 10.20.200.1/24 between them? 

If so, you can achieve it by policy routing.
SiteA 
src: 10.10.100.1/29
dst: 10.20.200.1/24
Next-Hop: site-to-site VPN

SiteB
src: 10.20.200.1/24
dst: 10.10.100.1/29
Next-Hop: site-to-site VPN

 

Or you can using route-based VTI VPN instead of policy-based VPN.

Please refer to

https://community.zyxel.com/en/discussion/26483/how-to-configure-site-to-site-vpn-with-multiple-subnets-between-zld-and-uos-using-route-based