Issues regarding policy routes

Options
Dano89
Dano89 Posts: 3
First Comment
edited April 2021 in Security
Hey everyone,

I do not know if it is a configuration issue but my policy routes do not seem to work correctly.

Basically, I am trying to route 3 VLANs to a router (it is a router connected to a MAN so everything is private ip addressed, our ISP's MPLS network route our subnets to our different DCs and to Internet):

Vlan 11 10.0.0.0/24 Gateway 10.0.0.2/24 (interface vlan 11)

Vlan 12 10.0.1.0/24 Gateway 10.0.1.1/24 (interface vlan 12)

Vlan 13 10.0.2.0/24 Gateway 10.0.2.1/24 (interface vlan 13)


Router's IP is 10.0.0.1/24
Our DC has a 10.0.3.0/24 network that has to be allowed to reach these 3 VLans

Uplinks are tagged correctly. The FW - Router uplink goes through a L2 switch, untagged on Vlan 11

Policy routes:

1) Incoming: Interface vlan12 Source Address 10.0.1.0/24 Dest: Any Service: Any Next Hop: Gateway 10.0.0.1

1) Incoming: Interface vlan13 Source Address 10.0.2.0/24 Dest: Any Service: Any Next Hop: Gateway 10.0.0.1

Policy rules:

Anything that comes from this 3 subnets can go everywhere. 
FROM (Vlan11, Vlan12, Vlan13) TO ANY IPv4 Src Vlan11's subnet, Vlan12's subnet, Vlan13's subnet IPv4 Dst Any Action allow

Subnet 10.0.3.0/24 should reach the 3 Vlans.
FROM any TO (Vlan11, Vlan12, Vlan13)  IPv4 Src 10.0.3.0/24 IPv4 Dst Vlan11's subnet, Vlan12's subnet, Vlan13's subnet Action  allow



From my MAN, I can ping the 3 Gateways 10.0.0.2, 10.0.1.1, 10.0.2.1 and the router 10.0.0.1.
However, I am not able to ping any clients connected to these 3 Vlans.
From my LAN, I cannot reach my DC's network 10.0.0.3/24. Inter vlan routing is working

I hope it is clear :)

Any ideas?

Thanks in advance.

Comments

  • PeterUK
    PeterUK Posts: 2,762  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited March 2021
    Options

    What USG are you using?

    So LAN1 on the untagged interface is not used by the looks of it (give it some other adders not to conflict with VLAN 11 so its gateway can be 10.0.0.1) and your WAN IP is in 10.0.3.0/24 ?

    You might not be doing the tags/untag correctly and Policy routes to a gateway thats not in use looks wrong.

    I'm having a hard time working out what you have done maybe a draw up would help me get a idea of the WAN and LAN with VLAN's in which zone.

    I take it PC's on like VLAN 12 don't have internet or do they?

    On 10.0.3.0/24 network what is the IP and gateway on what interface is getting?


  • Dano89
    Dano89 Posts: 3
    First Comment
    Options
    It is USG 310 v 4.38.

    Here is the diagram:




    The goal is to direct traffic from VLANs 11, 12 & 13 to 10.0.3.0/24 using Policy Routes because we cannot use static routes (there are other LANs' traffic routed to another ISP router).
    10.0.30/24 hosts should be able to access LAN 10.0.0.0/24, 10.0.1.0/24, 10.0.3.0/24

    Here are the Policy Routes: (ISP = 10.0.0.1)

    index: 2

      active: yes

      auto-disable: no

      description: VLAN13

      user: any

      schedule: none

      interface: vlan13

      tunnel: none

      sslvpn: none

      source: SUBNET_VLAN13

      destination: any

      DSCP code: any

      service: any

      srcport: any

      nexthop type: Gateway

      nexthop: ISP

      nexthop state: Not support

      auto destination: no

      SNAT: none

      DSCP marking: preserve

      connectivity-check: no

    index: 3

      active: yes

      auto-disable: no

      description: VLAN12

      user: any

      schedule: none

      interface: VLAN12

      tunnel: none

      sslvpn: none

      source: SUBNET_VLAN12

      destination: any

      DSCP code: any

      service: any

      srcport: any

      nexthop type: Gateway

      nexthop: ISP

      nexthop state: Not support

      auto destination: no

      SNAT: none

      DSCP marking: preserve

      connectivity-check: no


    One remark: The option Use IPv4 Policy Route to Override Direct Route is disabled. This might be the problem since I want to direct VLAN 12 & 13 to 10.0.0.1 and they should not use the directly connected routes. 

    Thanks.


  • PeterUK
    PeterUK Posts: 2,762  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    I think the problem is you trying to get more subnets by VLAN 11 if you remove VLAN 11 the tagged network so that you have the USG 10.0.0.2 to 10.0.0.1 router with Use IPv4 Policy Route to Override Direct Route it might all work?

    Sorry I can't be more help I think someone else can help you more with your setup.


  • Dano89
    Dano89 Posts: 3
    First Comment
    Options
    Well, thanks very much for your help. The VLAN 11 is in fact used as a "transit network" if you know what I mean.
    I've run a simulation unsing GNS3 and it is correctly working but with a Cisco L3 switch instead of the USG 310.
    My assumption is perhaps that I am not configuring these policy routes correctly. And I am not really familiar with Zyxel products to be honnest.

    Do you know the impacts of this feature "Use IPv4 Policy Route to Override Direct Route" in a production environment?
  • PeterUK
    PeterUK Posts: 2,762  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    I used the feature "Use IPv4 Policy Route to Override Direct Route" here in this setup.

    https://community.zyxel.com/en/discussion/9773/local-static-routes-not-working#latest

    Instead of sending traffic out the interface it knows directly it instead sends it to the set gateway next hop.


Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）