USG 50 - NAT Configuration Issue - Layer 3 Switch behind Zywall.

RCorbin Posts: 1
edited April 2021 in Security
I have a USG 50 Firewall with DMZ port configured with Subnet
Connected to the DMZ port, I have a Cisco 3560 Layer3 Switch connected. 
Zywall DMZ ( --> Cisco 3560 (
Cisco 3560 has IP routing Enabled, and a VLAN 100 setup ( (VLAN100 SVI 
GW (ip route) of last resort on the Cisco 3560 is

A PC host ( is connected to the Cisco. PC Host can ping it's SVI without issue. Cannot ping anything else, not LAN1, LAN2 or external sites. Zywall packet capture shows the DMZ interface receiving a packet from PC host -->, but with no response found. 

On the Cisco Switch, I can ping everything, DMZ interface, LAN1, and LAN2 hosts and interfaces and any external site.

On the Zywall I have a static route to the subnet via the DMZ interface. I can ping into the LAN attached to the CISCO ( from hosts in the LAN1, LAN2. 

I'm fairly certain the issue is related to NAT. I'm having issues translating a subnet behind the DMZ interface and I am not sure of the configuration on the Zywall USG 50. 

To test this, I set up another router with a layer 2 switch and a Cisco 1841 in a router on a stick configuration and setup NAT on the 1841 to translate from the subnet to the outgoing interface that's connected to the Zywall DMZ port. Traffic flows fine in this scenario. 

If you need additional info, I am happy to provide it. 

Security Highlight