Devices in mgmt VLAN reachable by VPN and local Clients

Hi @Sergi330,

You're encountering a common scenario when configuring management VLANs, where devices in other VLANs or connected via VPN can still access the management interface of your switch. This is often due to the default behavior of how management VLAN control operates, especially in Nebula, and how inter-VLAN routing is handled by your firewall.

Here's a breakdown of the issue and the recommended steps to enhance the isolation of your management VLAN:

• Understanding Management VLAN Control: In Zyxel Nebula switches, "Management VLAN Control" determines where management VLAN traffic can exit. By default, the management VLAN is often enabled on all ports to ensure devices remain accessible during initial setup or configuration changes. It operates independently of the "Allowed VLANs" list on trunk ports.

• Inter-VLAN Routing: Your USG LITE 60AX, as a router, facilitates communication between different VLANs. If there are no specific firewall rules to block traffic between your client VLAN (VLAN 10), VPN subnet, and the management VLAN (VLAN 168), then devices in these subnets will be able to reach each other.

Here are the steps to address this:

1. Configure Management VLAN Control on Switch Ports:

   • Navigate to your switch settings in Nebula.
   • For switch ports connected to client devices or APs that should not have access to the management VLAN, ensure that "Management VLAN Control" is disabled. This prevents the switch from assigning these ports as members of the management VLAN.
   • For trunk ports connecting to your USG LITE 60AX and APs that do need to carry management VLAN traffic, "Management VLAN Control" should remain enabled.

2. Implement Firewall Rules on USG LITE 60AX:

   • Since your USG LITE 60AX handles inter-VLAN routing, you need to create explicit firewall rules to restrict access to the management VLAN (VLAN 168) from your client VLAN (VLAN 10) and your VPN subnet.
   • These rules should be configured to deny traffic from the source (VLAN 10 subnet and VPN subnet) to the destination (VLAN 168 subnet) on the relevant ports and protocols (e.g., HTTP, HTTPS for GUI access).
   • Nebula's automatic firewall rules might not include these specific isolation policies, so manual configuration will likely be necessary.

To help us investigate further and provide more specific guidance, please provide the following information:

• Network Topology Map: A simple diagram showing how your USG LITE 60AX, GS1920-24HP, NWA1123, and client devices are physically connected, including which ports are used.
• Screenshots of Firewall Rules: Please provide screenshots of the current firewall rules configured on your USG LITE 60AX in Nebula.
• Enable Zyxel Support Access: Go to Help > Support Request in your Nebula console and enable Zyxel Support Access. Please provide the Organization Name and Site Name. This will allow our support team to view your cloud configuration directly for more efficient troubleshooting.