Next Hop: VPN Tunnel Flex 100H

amateur_netops
amateur_netops Posts: 12  Freshman Member
First Comment
edited October 21 in Security

I am looking to upgrade my home VPNs from Zywall USG 110s to Flex XXXH(P) - I had upgraded one of them this summer - and realized that I could not define a VPN tunnel as a next hop. Zyxel Customer Service then replied to a message that would be a feature supported in the October firmware - it does not seem to exist in the 1.3 release however either. What I am trying to support is this: I have SSIDs (VLANS) in each home that represent a specific country - so SSID.NET would be US, SSID.AT for Austria, SSID.ID for Indonesia and SSID.IN for India. So if you were for example on SSID.AT in a home in the US, the traffic would be routed to a home in Austria and go on the public internet there. Truthfully mainly used for streaming content - but it's sometimes useful for specific country content.

Questions:

1, Did I miss anything in 1.3 (running on a Flex 100H) where that feature has been added.

2, If it has been dropped from 1.3 - when is it coming now?

3, Is there another way to accomplish what I am trying to do

Best Answers

All Replies

  • Zyxel_Judy
    Zyxel_Judy Posts: 1,631  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula

    Hi @amateur_netops

    Due to changes in the product roadmap, there was no feature enabling VPN tunnels as next-hop with firmware version 1.30 for H series firewalls.

    We are still evaluating this feature. When it becomes available, we will make an official announcement in the Firewall News & Releases section. Please follow this section to stay updated on new features and enhancements.

    For your scenario, we can suggest following the guide to configure Site-to-Site VPN between ZLD (USG, USG FLEX) and uOS (USG FLEX H) using Route-based VPN.

    https://community.zyxel.com/en/discussion/26423/how-to-configure-site-to-site-vpn-between-zld-and-uos-using-route-based

    Please let us know if we can be of any help.

    Judy

    Untitled Image

    See how you've made an impact in Zyxel Community this year! https://bit.ly/Your2024Moments_Community

  • amateur_netops
    amateur_netops Posts: 12  Freshman Member
    First Comment

    Hmm - disappointing that the feature has not been added as previously stated by Zyxel support - it is the only reason I bought another Flex H for another home.

    I don't see how the guide helps me since traffic to the internet will not go through the tunnel.

    Here is a simplified scenario:

    Site A has two networks - 192.168.100.X and 192.168.101.X

    Site B has two networks - 192.168.110.X and 192.168.111.X

    Devices on 192.168.100.X and 192.168.110.X need to communicate together - OK - Site to Site deals with that just fine

    Devices on 192.168.101.X should use the public internet on Site B

    Devices on 192.168.111.X should use the public internet on Site A

    A site to site doesn't do much here - in my old configuration - all traffic from 192.168.101.X would be sent to 192.168.110.X - where all traffic from 101.X would go to WAN - and all traffic for 101.X would be forced back into the VPN from 110.X-101.X

    How does a site to site without an ability to force traffic there help me?

  • Zyxel_Judy
    Zyxel_Judy Posts: 1,631  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula

    Hi @amateur_netops ,

    As of now, you can establish a Route-based VPN (VTI) by following the instructions in the article above. Once configured, follow these steps to add policy routes to adapt your requirement.

    Site A： LAN = 192.168.101.X/24

    Need to create one policy route to force redirect traffic to site B from site A.

    src = 192.168.101.X

    dst = any

    next hop = VPN => Choose Tunnel name

    Site B: LAN = 192.168.111.x/24

    Need to create two policy routes:

    Policy route 1: is for SNAT to Internet when the source is site A subnet 101.X

    src=192.168.101.X

    dst = any

    next hop = WAN1 or WAN2

    SNAT = outgoing interface

    Policy route 2: is for routing back the subnet 101.x traffic from Internet.

    src = any

    dst = 192.168.101.X

    next hop= VPN => Choose Tunnel name

    SNAT => None

    Judy

    Untitled Image

    See how you've made an impact in Zyxel Community this year! https://bit.ly/Your2024Moments_Community

  • amateur_netops
    amateur_netops Posts: 12  Freshman Member
    First Comment

    But there is no next hop=VPN - that was what I as whining about and was initially told we would get in October.

    The options on the Flex are: Auto, Interface, gateway,, gateway-ip and trunk - VPN is not an option

    image.png

  • Zyxel_Judy
    Zyxel_Judy Posts: 1,631  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    Answer ✓

    Hi @amateur_netops ,

    As we mentioned above, you can establish a Route-based VPN (VTI) by following the instructions in this article, and then you can see the VPN option in Interface next-hop type.

    https://community.zyxel.com/en/discussion/26423/how-to-configure-site-to-site-vpn-between-zld-and-uos-using-route-based

    Here is the screenshot of the H series:

    image.png

    Judy

    Untitled Image

    See how you've made an impact in Zyxel Community this year! https://bit.ly/Your2024Moments_Community

  • amateur_netops
    amateur_netops Posts: 12  Freshman Member
    First Comment

    OK - got this to work - thank you. I had to delete the other connections between other subnets on those sites and also manually route them. Then I had to change MTU to 1300 on the WAN port since tracert would work but http or https did not - somewhat odd - and a little slower than I would have expected. But got it working now

  • amateur_netops
    amateur_netops Posts: 12  Freshman Member
    First Comment

    Oh - is there a way to rename those vti-wizzard something things to something more meaningful. Will be a pain to keep track if I have several

  • Zyxel_Judy
    Zyxel_Judy Posts: 1,631  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    Answer ✓

    Hi @amateur_netops ,

    Under the current uOS design, VTI interface names cannot be modified. However, we have implemented a description field in both the interface and static route configurations that allows users to add custom identifiers for easier reference.

    image.png

    Judy

    Untitled Image

    See how you've made an impact in Zyxel Community this year! https://bit.ly/Your2024Moments_Community

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）