Can't route traffic into VPN tunnel
Hello, we successfully created a IPSec tunnel on our ZYWALL USG 200, the connection is up, but when we try to reach the remote site LAN on the other point of the tunnel, the ZYWALL tries to reach it by the standard route on internet. Already created a policy route for this but it seems to be ignored.
0
All Replies
-
Does each site have a different LAN subnet?
1 -
Yes: our local subnet is 10.11.244.232/29 while remote subnet is 192.168.0.0/160
-
This should work without a routing rule uncheck “Use IPv4 Policy Route to Override Direct Route”.
Post the packet flow explore for sitetosite VPN in maintenance from both sites.
1 -
0 -
and the other site setup?0
-
We can't see it, it is property of PA, but I'm confident they did the right configuration because they realize several VPN site to site with different enterprise
0 -
Have you set for VPN_LOGICA_P2_C in vpn connection under related settings a zone?
With a policy control rule from LAN1 to zone above make as log and try pinging a PC/device to 192.168.xxx.xxx and see if it shows in the logs.0 -
I left the default value "IPSec_VPN" for related zone and this is not present in the dropdown list of destinations for a policy route. Anyway, I just realized that all this is not working on a server (Windows 2012) while the traffic is correctly routed in the tunnel from a client Windows 10 in the LAN. Even turning off the Windows Firewall on the server, the things don't work. The server is part of the LAN just as the client, same subnet, just it is a DC of the domain
0 -
Hi @MicheleP,There is no need add policy route for peer subnet if you establish site to site VPN.There is one thing need to take note, the peer subnet is 192.168.X.X/16.By default, we have 192.168.2.x/24 on interface lan 2.T○ avoid subnet overlap, please remove any subnet within range 192.168.X.X/16 on USG200 network interface.
Don't miss this great chance to upgrade your Nebula org. for free!
0 -
Thanks Cooldia, in our case the subnet configured on interface lan1 and 2 were respectively 10.0.0.2/255.255.255.0 and 10.0.0.1/255.255.255.0 so there is no overlapping0
Categories
- All Categories
- 414 Beta Program
- 2.3K Nebula
- 132 Nebula Ideas
- 92 Nebula Status and Incidents
- 5.4K Security
- 181 USG FLEX H Series
- 258 Security Ideas
- 1.4K Switch
- 71 Switch Ideas
- 1K Wireless
- 37 Wireless Ideas
- 6.2K Consumer Product
- 236 Service & License
- 372 News and Release
- 79 Security Advisories
- 24 Education Center
- 5 [Campaign] Zyxel Network Detective
- 2.9K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 80 About Community
- 69 Security Highlight