Traffic between two USG firewalls in the same building

ETSTECH

Hello everyone,

I have a customer of mine that got two USG firewalls connected via WAN with the same internet service provider, using two different private static IP's on the same subnet.

The first one manage the company network and the servers, the second one manage the security systems network and the machinery network.

Now for some reason, the two networks must be physically separated and managed by these two different USGs.

The tricky question now is that the customer wants that the two networks can communicate together but keeping the physical separation.

Now, frankly, I don't know if it's possible to do something using the secondary WAN ports of the two USGs and make some sort of static routing between them….

Will someone be so gentle to illuminate me? Thanks in advance.

PeterUK

you say

"Now for some reason, the two networks must be physically separated and managed by these two different USGs." so how it setup now? one USG?

mMontana

IPSec VPN between the two private addresses of WAN?

Zyxel_Judy

Hi @ETSTECH ,

To provide you with the right guide, could you confirm: with the two USGs physically separated, are they still using two different private static IPs on the same subnet from the same ISP?

Also, which USG model is it?

ETSTECH

Hi @Zyxel_Judy, the firewalls are one USG40 and one USG200. They are phisically separated, but they share the same internet access, but with two different static public IP adderess.

The customer don't want to use the IPSec solution passing through the internet, but needs that the traffic between the two USGs must be done inside the premises.

Thank you.

PeterUK

so the two USG are next to each other?

If LAN2 is not used have a switch between the two USG with a PC to access both.

Or VLAN to access both by a PC on the same VLAN

Zyxel_Judy

Hi @ETSTECH ,

Since the two networks need to communicate without going through the internet, please refer to this approach: use one spare port on each USG (e.g. configure it as a DMZ/OPT zone, type as internal) and run a direct cable between the USG40 and USG200 (or through a dedicated switch not shared with any other VLAN).

Using your current addressing as an example:

• USG40 (company network): LAN = 192.168.10.0/24
  
• USG200 (security/machinery network): LAN = 192.168.20.0/24

Give the new direct link its own small transit subnet:

• USG40, DMZ port: 10.10.10.1/30
  
• USG200, DMZ port: 10.10.10.2/30

Then add a Static Route on each side pointing to the other's LAN subnet via that link:

• On USG40: Destination 192.168.20.0/24 (USG200's LAN) → Gateway 10.10.10.2, Interface DMZ
  
• On USG200: Destination 192.168.10.0/24 (USG40's LAN) → Gateway 10.10.10.1, Interface DMZ

And restrict Security Policy between the two LAN zones to only the specific services the customer actually needs — for example, if they only need HTTPS between the networks:

• USG40: From LAN (192.168.10.0/24) To DMZ (192.168.20.0/24), Service: HTTPS → Allow
  
• USG200: the matching rule in the other direction

Please be aware that the USG40 and USG200 model has reached its EOL status. For optimal performance and support, we recommend exploring our current firewall offerings here: https://www.zyxel.com/us/en-us/products/next-gen-firewall