Full VPN tunnel from FlexH 1.32 FW to Nebula Org firewall

Options
GiuseppeR
GiuseppeR Posts: 427  Master Member
Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector
edited June 24 in USG FLEX H Series

Hello everyone,

I have a FlexH configured on prem since months ago but where it is installed I have limited connection, blocked ports and useless filters.

I need to create a full tunnel VPN with another Org that I have configured on Nebula so all the traffic from the FlexH goes to that Org in Nebula where I have NO filters outbound applied and then the FlexH could go on internet free and happy.

Is it possible to do that?

«13

All Replies

  • PeterUK
    PeterUK Posts: 3,884  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary

    Are outbound ports UDP 500 and 4500 (if direct WAN to WAN protocol 50) allowed where you are? and this Org allows inbound ports UDP 500 and 4500 (if direct WAN to WAN protocol 50)?

  • GiuseppeR
    GiuseppeR Posts: 427  Master Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector
    edited June 24

    FlexH is ORG1.

    Nebula receiver is ORG2.

    The ORG2 can use all the open ports needed, it has also static Public IPs with 2 FTTHs.

    I manage it on Nebula and it works fine since 3 years.

    If you can link me a guide to setup ORG1 to full VPN tunnel via ORG2 I can check other ports outbound on ORG1.

    Thanks in advance

  • PeterUK
    PeterUK Posts: 3,884  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited June 24

    So do both ends have FLEX H?

    A VTI (Route-based) would do what you want if ORG1 can connect out to ORG2 for out going traffic for ORG1.

  • GiuseppeR
    GiuseppeR Posts: 427  Master Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector

    No, ORG2 has a standard Flex 200 managed in Nebula.

    ORG2 has 2 WANs with FTTH free and full open.

    Is it possible to set a full tunnel VPN on ORG2 via WAN2 created on Nebula and started from Flex 100H on ORG1?

    I never used VTI on FlexH: is it a sort of rule to route all the traffic as Next-Hop via VPN?

  • Zyxel_Melen
    Zyxel_Melen Posts: 3,514  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    edited June 25

    Hi @GiuseppeR,

    If another firewall is USG FLEX/ATP, please reference this FAQ to set auto-link VPN to connect USG FLEX H.

    How to configure Auto-Link VPN on Nebula? — Zyxel Community

    In addition, for your scenario, you will need to use custom preset which allows you to set VTI interface.

    image.png

    Once the VPN is connected, you will need to add policy route rule for LAN interfaces and ZyWall (if needed).

    image.png
    Zyxel Melen


  • GiuseppeR
    GiuseppeR Posts: 427  Master Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector
    edited June 27

    Hello @Zyxel_Melen

    I setup Nebula:

    immagine.png

    with infos from ORG1 (so IP and subnet from FlexH).

    Then, considering the ORG1 private network as 192.168.200.1/24, I setup also VTI with different subnet using 192.168.201.1/24:

    immagine.png

    And I created also a specific LAN for ORG2 where I linked the VPN using 192.168.202.1/24.

    I have the VPN from ORG1 to ORG2 connected:

    immagine.png

    Nebula on ORG2 confirms it:

    immagine.png

    But I cannot create a VTI on ORG1 to route all the traffic:

    immagine.png

    So I cannot use the policy you told me to set from FlexH:

    immagine.png

    Have I missed something?

  • GiuseppeR
    GiuseppeR Posts: 427  Master Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector
  • PeterUK
    PeterUK Posts: 3,884  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited June 27

    I do not use Nebula so you will have to work out how to VTI setup but here is how I did it.

    I have Zywall 110 so that would be ORG2
    VPN gateway
    IKEv1 or 2
    Gateway Settings
    My address your WAN

    Static Address your DDNS of ORG1

    Set Pre-Shared Key and Phase 1 to what you like if IKEv1 use negotiation mode main

    VPN connection
    VPN Gateway
    VPN Tunnel Interface your VPN gateway

    Phase 2 to what you like

    interface VTI
    vti0
    zone IPSec_VPN
    VTI rule
    IP 10.168.138.13
    255.255.255.240

    set a static route of the LAN of ORG1
    in my case
    192.168.255.32
    255.255.255.240
    interface vti0

    routing rule
    incoming VTI
    next hop WAN

    On ORG2 I have FLEX200H
    setup VTI add
    IKEv1 or 2 from ORG2
    custom select Route-Based
    MY address you WAN interface
    Peer Gateway Address DDNS of ORG2
    Zone IPSec_VPN
    Set Pre-Shared Key and Phase 1 and 2 to what you like that match ORG2
    Phase 2 Initiation Nailed-up
    VTI Setting
    IP 10.168.138.12
    255.255.255.240
    You have to set a Route Setting for Remote Subnet but this will not be needed but you must set one so
    127.255.0.1/30
    ^ you can delete this in static route after

    Then add a routing rule
    incoming your LAN
    next hop interface and select the vti_custom
    SNAT none

  • Zyxel_Melen
    Zyxel_Melen Posts: 3,514  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    edited June 30
    https://community.zyxel.com/en/discussion/comment/78514#Comment_78514

    Hi @GiuseppeR,

    This is more likely you configure the site-to-site VPN is policy-based VPN.

    Please help to create a route-based VPN which has the configure option for the VTI interface. The VTI interface can't be created on Network > Interface tab.

    Here is a reference:

    How to configure site to site VPN with multiple subnets between ZLD and uOS using route-based? — Zyxel Community

    In addition, you may also reference @PeterUK configuration and create your own routing rules.

    Zyxel Melen


  • GiuseppeR
    GiuseppeR Posts: 427  Master Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Engineer Level 1 - Nebula First Comment Friend Collector

    Hello @Zyxel_Melen

    I rewrote the VPN rule and now it is route-based, I have the VTI and I set the policy route:

    immagine.png

    but it did not ping, for this reason the Status icon is black.

    Am I missing something else on FlexH config?

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）