How to build a multi-subnet IPSec tunnel between Flex H and Flex devices?

mMontana

Among ZLD 4.x and ZLD 5.x it was quite like that.

On both sites, create a VPN gateway for the other endpoint.
On both sites, then create multiple VPN connections for every association between subnets.
For instance
from 192.168.98.0/24 (A1) 192.168.95.0/24 (A2)
to 192.168.198.0/24 (B1) 192.168.95.0/24 (B2)
on site A, from A1 to B1, A1 to B2, A2 to B1, A2 to B2.
on site B, from B1 to A1, B1 to A2, B2 to A1, B2 to A2.
(in this instance every subnet is on a different hardware interface)

However, I cannot achieve the same result this between a ZLD 5.x device and a uOS 1.38 one.

Where I need to look for that? uOS documentation or there's a specific public Howto that I missed?

PeterUK

hi mMontana

There is a issue Zyxel know of made them know about it and I made a post about (

IKEv1 and IKEv2 many tunnels issues — Zyxel Community

) where IKEv1 Responder Only on the FLEX H can 't have many tunnels support even if you do different Phase 1 encryption or Local ID/Remote ID however IKEv2 works fine

Zyxel_Tina

Hi @mMontana,

For your requirement, we recommend using a route-based IPSec VPN (VTI) instead of policy-based VPN. With route-based VPN, only one tunnel is needed between the two sites. You then add static routes for each subnet that should go through the tunnel, and use security policies to control which source, destination, and services are allowed.

How to configure site to site VPN between ZLD and uOS using route-based? — Zyxel Community