USG FLEX 500 and Two SUBNET Interface

Smartmob
Smartmob Posts: 10  Freshman Member
First Comment Friend Collector
in Security

I have a zyxel USG FLEX 500 firewall with lan1 interface (192.168.0.230 - DHCP managed by Active Directory) lan2 interface (192.168.33.230 - DHCP Disabled).
Any machine I set in the second subnet can only communicate with the firewall and has no internet.
What configuration did I forget?

All Replies

  • PeterUK
    PeterUK Posts: 3,610  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited January 14

    If your setting up a device with static IP on LAN2 for it to get to the internet you need to set the gateway and DNS both can be to the LAN2 interface gateway.

    If ping to 1.1.1.1 works but not DNS you need to have a firewall rule from LAN2 to zywall or if DNS works but timeout to 1.1.1.1 you need from LAN2 to WAN

  • Smartmob
    Smartmob Posts: 10  Freshman Member
    First Comment Friend Collector
    image.png
    image.png

    If I set the network card like this:

    image.png

    I have no network or internet, I do not understand what it is that can block.

    I also tried setting a routing but no luck

  • PeterUK
    PeterUK Posts: 3,610  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited January 15

    Is "Enable IP/MAC Binding and DHCP Enforcement" checked for LAN2?

  • Smartmob
    Smartmob Posts: 10  Freshman Member
    First Comment Friend Collector
    https://community.zyxel.com/en/discussion/comment/73806#Comment_73806

    Nope

  • PeterUK
    PeterUK Posts: 3,610  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited January 15

    make routeing rule

    incoming LAN2

    next hop WAN

    check your on the right port and zone is set to LAN2

  • Smartmob
    Smartmob Posts: 10  Freshman Member
    First Comment Friend Collector

    I managed to configure everything but from lan2 I can ping lan1 but not vice versa

    there is no layer 2 isolation

  • Smartmob
    Smartmob Posts: 10  Freshman Member
    First Comment Friend Collector

    sovled

    image.png
  • PeterUK
    PeterUK Posts: 3,610  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited January 23

    A static route? Should not be needed…

    is "Use IPv4 Policy Route to Overwrite Direct Route" checked?

  • Smartmob
    Smartmob Posts: 10  Freshman Member
    First Comment Friend Collector

    no is not selected

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）