Vpn site to site with Usg 40

User
User Posts: 4  Freshman Member
First Comment
edited April 2021 in Security 
Hi, I have a configuration with two locations correctly connected site to site with two zyxell usg 40. 
Everything works, both the subnet A sees the subnet B and vice versa. 
The only problem arises if I do not want to use the usg 40 as a navigation, if a machine does not have 
a gateway as the usg 40 is no longer reachable from the remote site. Can this be remedied?

Accepted Solution

  • Ian31
    Ian31 Posts: 174  Master Member
    5 Answers First Comment Friend Collector Sixth Anniversary
    edited September 2018 Answer ✓
    Hi @User

    Two solution,
    1. The most easy solution (if you cannot change the configuration of Telecom router)
    On PC Y, add static route to LAN A via Gateway B.
    For example, if PC Y is Windows OS.
    (1) Open MS-DOS windows (need to Run as Administrator)
    (2) c:\> route add <LAN B network> mask <network mask> <gateway B IP> metric 1 -p

    2. Both Gateway A & Gateway B need to configure route
    (1) On Gateway A, add static route to LAN B via Gateway B.
    And Gateway A need to allow triangle route.

    (2) On Gateway B,
    on GUI, go to Security policy > Policy Control page. Enable "Allow Asymmetrical Route" setting.

All Replies

  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,377  Zyxel Employee
    100 Answers 1000 Comments Friend Collector Seventh Anniversary

    Hi @User

    If you removed one of USG40 from your scenario, you still can access to server behind NAT router by Port forwarding/ L2TP tunnel/ SSL VPN(SecuExtender)/IPSec VPN tunnel(IPSec VPN Client).


  • User
    User Posts: 4  Freshman Member
    First Comment
    I not removed one of usg 40 (scuse me for bad English). The right answer is: it's possible (with a route or other method) used 2 gateway in one of Lan...? If usg 40 are in Lan, but if it's not a preferred gateway. In "xxx" pc is not a gateway; this pc is not "contactable from the remote network. 
  • User
    User Posts: 4  Freshman Member
    First Comment
    edited September 2018
    This is my VPN site to site. It's ok for all pc/server in LAN A, but in LAN B is ok only with a pc have with gateway B (usg 40). I ask if exist a metod for contact from LAN A a pc in LAN B with have gateway A (Telecom Router with firewall and mpls). In picture ALL LAN A ping PC-X, but no ping PC-Y.)
  • Zyxel_Stanley
    Zyxel_Stanley Posts: 1,377  Zyxel Employee
    100 Answers 1000 Comments Friend Collector Seventh Anniversary
    Hi @User
    In your environment, PC X and PC Y should connecting with a switch, and PC X IP address is coming from GatewayB.
    What's the IP address of PC Y? Does PC Y IP subnet has overlap to GatewayB? 
    Does switch is support for layer 3 routing?
  • Ian31
    Ian31 Posts: 174  Master Member
    5 Answers First Comment Friend Collector Sixth Anniversary
    edited September 2018 Answer ✓
    Hi @User

    Two solution,
    1. The most easy solution (if you cannot change the configuration of Telecom router)
    On PC Y, add static route to LAN A via Gateway B.
    For example, if PC Y is Windows OS.
    (1) Open MS-DOS windows (need to Run as Administrator)
    (2) c:\> route add <LAN B network> mask <network mask> <gateway B IP> metric 1 -p

    2. Both Gateway A & Gateway B need to configure route
    (1) On Gateway A, add static route to LAN B via Gateway B.
    And Gateway A need to allow triangle route.

    (2) On Gateway B,
    on GUI, go to Security policy > Policy Control page. Enable "Allow Asymmetrical Route" setting.

  • User
    User Posts: 4  Freshman Member
    First Comment
    edited September 2018
    Tanks guys, the 1) solution of lan31, works. 
    Stanley LAN A (remote) is configured with 192.168.xx.0/24 , lan B (local) is configured with 10.200.xx.0/24. Only one subnet for LAN (REMOTE and LOCAL).

    With routing most pc works. Only one server not work, but must to check in this server policy and rules for read a permission (server domain with service). 
    RESOLVED...

    In this server are 3 ethernet interface, i add route for all interface now. IT WORKS.
    Tanks LAN31! Very very thanks

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）