uOS - Policy Based VPN with Policy Routes

Zyxel_Claudia

Policy Based VPN with Dynamic Peers

This update enables Policy Routes to work with Dynamic Peer VPN tunnels. 

Routing Logic and Limitations

When a policy route uses a dynamic VPN tunnel as the next hop, a unique rule applies: the destination address in the policy route is ignored. Instead, the firewall automatically uses the remote site's subnets as the destination.

Benefits for Tunnel Conservation

This feature is highly effective for conserving IPSec tunnels. Instead of creating individual Phase 2 SAs for every possible subnet combination between a hub and multiple spokes, administrators can create a single broad tunnel and use policy routes to direct specific traffic. This reduces the total number of active SAs, saving system resources on the hub firewall.