Traffic between tunnels (and NAT)






Let's say we have three sites: A, B, C.
Between A and B: policy-based site-to-site tunnel
Between B and C: policy-based site-to-site tunnel
Then we need that an host (a single host) from site A reaches an host or a couple of site C. Only
So the config would be
On A:
-policy route with source host, destination host, next hop=A-B-tunnel
(do I need a "return" rule or is it implicit since destination of return traffic is in Site A LAN and so included in default vpn policy route?)
On B:
-policy route with source host (A), destination host (C), next hop=B-C-tunnel
-policy route with source host (C), destination host (A), next hop=A-B-tunnel
On C: like A but inverted.
Is it ok?
And another question: let's say that I want to NAT A host, when it goes to C site, with an address of B LAN. As it would come from that network: this would make simpler things on C site, that should simply relate with B one.
In which routing policy should I set "SNAT-to"? In the first step (policy route from A to B)?
All Replies
-
looks correct do a test here HQ1, HQ2 and HQ3
VLAN66 192.168.66.3 > HQ1 > Tunnel >HQ2 > route to tunnel > HQ3 VLAN47 192.168.255.40
HQ1 route incoming VLAN66 destination 192.168.255.32/28 next hop to tunnel
HQ2 route incoming tunnel destination 192.168.255.32/28 to next hop to tunnel
HQ2 route incoming tunnel destination 192.168.66.0/24 to next hop to tunnel
HQ3 route incoming VLAN47 destination 192.168.66.0/24 next hop to tunnel
0
Categories
- All Categories
- 417 Beta Program
- 2.5K Nebula
- 161 Nebula Ideas
- 108 Nebula Status and Incidents
- 5.9K Security
- 331 USG FLEX H Series
- 286 Security Ideas
- 1.5K Switch
- 78 Switch Ideas
- 1.2K Wireless
- 42 Wireless Ideas
- 6.6K Consumer Product
- 259 Service & License
- 402 News and Release
- 86 Security Advisories
- 31 Education Center
- 10 [Campaign] Zyxel Network Detective
- 3.8K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 85 About Community
- 80 Security Highlight