Give two ranges to a VPN connection

steve15f

Hi dear,

i've created a new VPN IPSec connection. This connection allow to reach the range 192.168.110.0/24, but i want also allow to reach the range 192.168.100.0/24 with the same VPN connection. Is it possible ? how ?

i've also an another question : SSL VPN connection is working with the Active Directory accounts but with the IPSec VPN connection it is not working with the Active Directory accounts.

Thanks

jasailafan

Hi steve15f,

If site-to-site VPN is created between two Zywalls, you can use policy route to reach the range 192.168.100.0/24 with the same VPN connection.

Here is the example.

The traffic can be transmitted between the subnet of site A 192.168.1.0/24 and site B 192.168.110.0/24.

We want to enable communication between the subnet of site A 192.168.1.0/24 and site B 192.168.100.0/24.

So two policy routes we are created:

Site A -> source address : 192.168.1.0/24, destination address : 192.168.100.0/24, next-hop : vpn tunnel

Site B -> source address : 192.168.100.0/24, destination address : 192.168.1.0/24, next-hop : vpn tunnel

In site-to-site VPN with dynamic peer, the option "Policy Enforcement" is enabled by default, so we can't use policy route to control it.

Zyxel_Cooldia

@jasailafan, thanks for the instruction.

Hi @steve15f,

As for IP sec VPN connection is not working with AD, what is the device error log when you connect IPSec VPN client?

steve15f

HI @jasailafan thanks for your reply. It's not for a site to site VPN but ZyWALL IPSec VPN (Windows) client .

Zyxel_Cooldia

Hi @steve15f,

You can modify the VPN local policy address mask to /20, mask /20 range is 192.168.96.1 to 192.168.111.254.

In this way, you can add another subnet in one VPN tunnel.

Modify the local policy subnet at “CONFIGURAITON > VPN > IPSec VPN > VPN connection”

 Windows IPSec VPN client setting