L2TP Over IPSEC VPN - Split Tunneling

2»

All Replies

  • Anthoshell
    Anthoshell Posts: 13  Freshman Member
    First Comment Friend Collector Second Anniversary
    Thanks  :) It worked  ! 


  • ckelley
    ckelley Posts: 2  Freshman Member
    First Comment Sixth Anniversary
    I am having the same issue; I have a server behind a USG 1000, I need to allow an outside user to RDP to the server, but he also needs to be able to access printers and other things that are behind a USG 50. To allow this, I created a site to site IPSec VPN between the USG 1000 and the USG 50. I then created a L2TP VPN on the USG 50, and have him logging in via Win 7's native L2TP.

    He can log in successfully, and he can access all of the items behind the USG 50 as well as the server behind the USG 1000. However, while he's on this VPN, he can't access the internet at large, which means he can't check his email, which is essential to his work. Below is a diagram:



    I have unchecked 'Use default gateway on remote network' on the Win 7 side, and he can then access the internet and his email, but he then loses connectivity to the server in Office B behind the USG 1000. I read this thread, and attempted to add the route to the Win 7 computer, but it didn't help anything.

    I also tried to create the IKEv2 VPN for the user to log in using the certificate, but the server never responds when I attempt to connect this way, so the connection always fails.

    I am at a major loss, and I'm hoping someone will take pity on my newbie self and offer some assistance.

    Thank you in advance!
  • ChrisGer
    ChrisGer Posts: 205  Ally Member
    Zyxel Certified Network Administrator - WLAN Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    ckelley said:
    He can log in successfully, and he can access all of the items behind the USG 50 as well as the server behind the USG 1000. However, while he's on this VPN, he can't access the internet at large, which means he can't check his email, which is essential to his work. Below is a diagram:

    Hello Ckelly,
    is your VPN Network Segment a own segment ? or is this bridged ?
    it this is a won IP Segement, remember, it's a virtuell Segment, that's not in the default routeing table of your USG. So you had to configure a routieng fpr your VPN Segment to the internet, f the user want to check mails in the extranet. It this allready configured on your USG ?


    I have unchecked 'Use default gateway on remote network' on the Win 7 side, and he can then access the internet and his email, but he then loses connectivity to the server in Office B behind the USG 1000. I read this thread, and attempted to add the route to the Win 7 computer, but it didn't help anything.

    Check the routeing from VPAN Segment to the Internet and configure this in the routeing section on your USG.

    I am at a major loss, and I'm hoping someone will take pity on my newbie self and offer some assistance.

    You are nit lost :) it's a bit more than attaching a vLAN to fullfil route the VPN 100 percent.

    Thank you in advance!
    Good luck
    Christian


Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）