Site-to-Site VPN between ATP without Pro license

Options
TAPTech
TAPTech Posts: 165  Master Member
First Anniversary 10 Comments Nebula Gratitude Friend Collector
in Nebula
I've tried this a few times and cannot figure it out.  The VPN connection does not establish if I use the "non nebula" option.

I cannot turn "Nebula VPN enable" on as I get an error stating that there is no area leader.  I can't manage any area leaders as the option is for Pro Pack only...

How can I create a site to site VPN in this case?

Accepted Solution

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,066  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Answer ✓
    Options

    Hi @TAPTech

    The reason for the error message “There were errors in saving this configuration 。It must have a Area Leader” is you enable Area communication on the VPN Orchestrator, you could disable Area communication to avoid this situation. 

    I set up a lab test with three sites(site1:USGFlex200, site2:USGFlex100_AAA,site3:USGFlex100_BBB) as below Organization-wide > Configure > VPN Orchestrator showed:



    STEP1.  change site1's VPN Area to a customized area profile called "Zyxel_Area".


    STEP2. Go to site2's site-to-site VPN settings and disable "Nebula VPN enable" then save it.


    STEP3. Pop out the error message “There were errors in saving this configuration。It must have a Area Leader”



    STEP4. Go to Organization-wide > Configure > VPN Orchestrator and disable Area communication



    STEP5. Go to site2's site-to-site VPN settings and disable "Nebula VPN enable" and then can save it successfully. 


All Replies

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,066  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    edited December 2022
    Options
    Hello @TAPTech

    Could you enable Zyxel support for us(as below) and then tell us your org and site name via private message?






    I cannot turn "Nebula VPN enable" on as I get an error stating that there is no area leader.  I can't manage any area leaders as the option is for Pro Pack only...
    Could you share the screenshot of the error message with us? 


    How can I create a site to site VPN in this case?

    May I know whether the peer site in Nebula mode or in op-premise mode?  Please share the VPN topology with us as well. Thanks.  


  • TAPTech
    TAPTech Posts: 165  Master Member
    First Anniversary 10 Comments Nebula Gratitude Friend Collector
    Options
    As I went to take screenshots for you, I figured out the problem!
    When the VPN Topology feature was in Beta, I had created a VPN area.  I have a third site which does not need VPN connectivity, and so I had forgotten about it.  When I went into the VPN settings of that third site, even though it was disabled, it had the VPN area that I had created selected, instead of "default".  Once I changed that back to "default", things started working properly.

    I think this might be a bug.
  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,066  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    Could you enable Zyxel support and then tell us your org and site name via private message? We would like to check that situation. I will send a private message to you. Thanks.
  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,066  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    "When the VPN Topology feature was in Beta, I had created a VPN area.  I have a third site which does not need VPN connectivity, and so I had forgotten about it.  When I went into the VPN settings of that third site, even though it was disabled, it had the VPN area that I had created selected, instead of "default".  Once I changed that back to "default", things started working properly."

    I quoted your previous message, could you share screenshots about how you reproduce this symptom and how you resolve it?  We wonder whether it is a bug or not. Many thanks.
  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,066  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    Thanks for providing the screenshots to us via private message. The reason why you cannot remove the VPN area profile is the Smart VPN is Nebula Pro pack's license service, so you could add/modify/remove the VPN area profile during  Nebula Pro pack service. If you downgrade to Nebula Plus pack and then you don't have the capability to delete the VPN area profile, it's our current behavior, once you upgrade the Pro pack and you can edit it again.   


    Besides, I tried to set up a lab test on Zyxel HQ but I cannot reproduce it. So, could you record your PC screenshot video for us to show how you reproduce this symptom(pop out the error message "There were errors in saving this configuration. It must have an Area Leader ") on the Nebula Control Center?   Thanks for your help in advance.

  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,066  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer
    Answer ✓
    Options

    Hi @TAPTech

    The reason for the error message “There were errors in saving this configuration 。It must have a Area Leader” is you enable Area communication on the VPN Orchestrator, you could disable Area communication to avoid this situation. 

    I set up a lab test with three sites(site1:USGFlex200, site2:USGFlex100_AAA,site3:USGFlex100_BBB) as below Organization-wide > Configure > VPN Orchestrator showed:



    STEP1.  change site1's VPN Area to a customized area profile called "Zyxel_Area".


    STEP2. Go to site2's site-to-site VPN settings and disable "Nebula VPN enable" then save it.


    STEP3. Pop out the error message “There were errors in saving this configuration。It must have a Area Leader”



    STEP4. Go to Organization-wide > Configure > VPN Orchestrator and disable Area communication



    STEP5. Go to site2's site-to-site VPN settings and disable "Nebula VPN enable" and then can save it successfully. 


Categories

Nebula Tips & Tricks


    Read more

    Nebula Help Center

    EnglishTiếng ViệtРусскийไทย中文（台灣）