Inter Subnet Communication as VPN Client

Hi Agron simply use a Policy Routes : here's what you might consider to try with these prerequisites:

• Your L2TP pool 192.168.120.0/24 - has object name: L2TP_192-168-120-0_POOL
• the name of your IPSEC Connection is "your_L2TP_Connection"
• your local LAN (assume LAN1) is 192.168.100.0/24 : LAN1_SUBNET
• additional Security Policy Rules are needed.

Here's three (3) simple Policy routes that provide:

1. LAN1_SUBNET access to --> L2TP_SUBNET (L2TP_192-168-120-0_POOL)
   1. allows ANY LAN1 host on 192.168.100.0/24 to address any L2TP connect client on 192.168.120.0/24
2. L2TP_SUBNET (L2TP_192-168-120-0_POOL) --> to LAN1_SUBNET
   1. allows any L2TP connect client on 192.168.120.0/24 to access any host on LAN1 192.168.100.0/24
3. and lastly L2TP_SUBNET ((L2TP_192-168-120-0_POOL) ) to another VPN client L2TP_SUBNET ((L2TP_192-168-120-0_POOL) .. if you want that
   1. allows routes any L2TP client to another L2TP client host.

Use the USG110 WEB UI at Configuration / Network /Policy Routes and add 1 & 2 and optionally 3.

The there Policy Routes can look like this: take the relevant values for your use.

1) LAN1_SUBNET access to --> L2TP_SUBNET (L2TP_192-168-120-0_POOL)

Router> show policy-route 8
index: 8
 
active: yes
 auto-disable: no
 description: LAN1_SUBNET_to_L2TP_SUBNET
 user: any
 schedule: none
 interface: lan1
 tunnel: none
 sslvpn: none
 source: LAN1_SUBNET
 destination: L2TP_192-168-120-0_POOL
 DSCP code: any
 service: any
 srcport: any
 nexthop type: Tunnel
 nexthop: your_L2TP_Connection
 nexthop state: Not support
 auto destination: no
 SNAT: none
 DSCP marking: preserve
 connectivity-check: no

2) L2TP_SUBNET (L2TP_192-168-120-0_POOL) --> to LAN1_SUBNET 

Router> show policy-route 10
index: 10

active: yes
 auto-disable: no
 description: L2TP_SUBNET_to_LAN1_SUBNET
 user: any
 schedule: none
 interface: none
 tunnel: your_L2TP_Connection
 sslvpn: none
 source: L2TP_192-168-120-0_POOL
 destination: LAN1_SUBNET
 DSCP code: any
 service: any
 srcport: any
 nexthop type: Auto
 nexthop: auto
 nexthop state: Not support
 auto destination: no
 SNAT: none
 DSCP marking: preserve
 connectivity-check: no

and lastly and optionally....

3) L2TP_SUBNET ((L2TP_192-168-120-0_POOL) ) to another VPN client L2TP_SUBNET ((L2TP_192-168-120-0_POOL)

index: 10
 active: yes
 auto-disable: no
 description: L2TP_SUBNET_to_L2TP_SUBNET
 user: any
 schedule: none
 interface: none
 tunnel: your_L2TP_Connection
 sslvpn: none
 source: L2TP_192-168-120-0_POOL
 destination: L2TP_192-168-120-0_POOL
 DSCP code: any
 service: any
 srcport: any
 nexthop type: Tunnel
 nexthop: your_L2TP_Connection
 nexthop state: Not support
 auto destination: no
 SNAT: none
 DSCP marking: preserve
 connectivity-check: no

Summary, using this technique you may route very specific traffic not only between local subnets (LAN1, LAN1, L2P_VPN) but also VTI site -to-site IPSEC tunnels and their associated VPN_L2TP subnets.

It's most flexible.

Policy Routes: The key here is NOT to be generic. Use specific sources and destinations. The ZYxel ZYOS in these appliances is nice for creating Objects.

Security Policy: Make sure you add a (or more) Security Policy to allow from your local LAN1_SUBNET to your IPSEC Tunnel (and one for the reverse) .

Here's an example. Do one also for vice versa:

Router> show secure-policy 11
secure-policy rule: 11


 name: LAN1_SUBPOOL_to_L2TP_SUBPOOL
 description: LAN1_SUBPOOL_to_L2TP_SUBPOOL
 user: any, schedule: none
 from: LAN1, to: TUNNEL
 source IP: LAN1_SUBNET, source port: any
 destination IP: any, service: any
 log: no, action: allow, status: yes
 connection match: no
 content-filter profile: none
         enable: no, log: by-profile
 anti-spam   profile: none
         enable: no, log: by-profile
 anti-virus  profile: none
         enable: no, log: by-profile
 idp      profile: none
         enable: no, log: by-profile
 app-patrol  profile: none
         enable: no, log: by-profile

HTH

Warwick

Hong Kong