Routing L2TP for access other tunnels

Options
alexpe
alexpe Posts: 42  Freshman Member
First Anniversary 10 Comments Friend Collector
in Security

Hello,
I have a USG 110. I have configured a L2TP tunnel over IPSEC. The connection works perfectly for me. I am trying to configure a routing to be able to access the subnets of other tunnels that I have from site to site. But I am not able to reach them. Could someone help me configure the routing to be able to access the rest of the tunnels that I have configured from L2TP?

routing.png

«13

All Replies

  • mMontana
    mMontana Posts: 1,320  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    Options

    Concentrator…

  • PeterUK
    PeterUK Posts: 2,801  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited April 2023
    Options

    Do you have any overlapping subnets that are enabled per given site and the other sites with the same subnet?

  • alexpe
    alexpe Posts: 42  Freshman Member
    First Anniversary 10 Comments Friend Collector
    Options

    I do not understand what you mean. I have three subnets within the same lan. I need the L2TP tunnel over IPsec to be able to reach these three subnets.

  • PeterUK
    PeterUK Posts: 2,801  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited April 2023
    Options

    Is your setup like this

    https://support.zyxel.eu/hc/en-us/articles/360010904260-VPN-Routing-traffic-from-VPN-tunnel-to-a-another-VPN-site-VPN-Routing-

    https://support.zyxel.eu/hc/en-us/articles/360000709460-VPN-Configure-Failover-with-Dual-WAN-Trunk-Failover-VPN-Concentrator-#h_01GM2Z78N7WGXGP5W6XB5AFGHP

  • Blabababa
    Blabababa Posts: 151  Master Member
    First Anniversary Friend Collector First Answer First Comment
    Options

    Found a faq looks can map to your case

    https://community.zyxel.com/en/discussion/2764/how-to-forward-traffic-to-branch-site-server-after-client-established-vpn-tunnel

  • alexpe
    alexpe Posts: 42  Freshman Member
    First Anniversary 10 Comments Friend Collector
    Options

    Thank you very much for your comments. I think I have not explained myself well with my problem.
    I have created an access to my office through L2TP tunnel

    image.png

    I can access my office subnet without problem.
    In my office there are another 3 site-to-site tunnels configured with three different subnets. In those 3 subnets I have routing rules to be able to access from my office.
    What I need is to create a routing rule to be able to access from my L2TP access to the other three subnets.

    image.png

    Routing rule 1. is the one that I have configured to be able to access the other three subnets, but it doesn't work for me. Could you tell me why?

  • alexpe
    alexpe Posts: 42  Freshman Member
    First Anniversary 10 Comments Friend Collector
    Options
    https://community.zyxel.com/en/discussion/comment/50574#Comment_50574

    I have tried what you mentioned but it still doesn't work for me. I think the problem is in local policy

    image.png

    What would be the correct one?

  • PeterUK
    PeterUK Posts: 2,801  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited April 2023
    Options

    So you want those connected to remote access server role to connect to the site to site tunnels?

    What are the subnets? From what I see in routeing rule you use the same source LAN1_subnet

  • alexpe
    alexpe Posts: 42  Freshman Member
    First Anniversary 10 Comments Friend Collector
    Options
    https://community.zyxel.com/en/discussion/comment/50614#Comment_50614

    Exactly, I want those who connect to the remote access function to be able to access the site-to-site tunnels.

    The subnets are from the other tunnels I have site-to-site from my office's lan1_subnet. Two of them make a next-hop for having SNAT configuration.

  • PeterUK
    PeterUK Posts: 2,801  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer
    edited April 2023
    Options

    So shouldn't those who connect to the remote access have routing rules from source 192.168.50.1-192.168.50.250 with Destination to next hop site to site tunnels?

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）