Remote vpn ipsec, access Lan behind site to site Firewall

Options
ITB_Tony
ITB_Tony Posts: 12 image  Freshman Member
First Comment Seventh Anniversary
in Security

I have a remote IKEv2 ipsec dynamic access to firewall 1 and want to access lan behind firewall 2 that is setup for site to site between Firewall 1 Firewall 2.

How should i set up routing and security policy to get it to work?

Firewall 1, USG Flex 100 Lan1 ip 192.168.101.1

Firewall 2, USG Flex 200 Lan1 ip 192.168.100.1

Tony

All Replies

  • PeterUK
    PeterUK Posts: 4,451 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary

    Might help to get a layout you can use my site to draw out the network you have.

    Network Testing Tools | Port Scanner, VPN Tests & DNS Lookup

    but from what I can tell you have a site to site between Firewall 1 Firewall 2 with the given local and remote policy so you will need.

    on firewall 1

    incoming Tunnel and the remote IKEv2

    Destination address 192.168.100.0/24

    next hop VPN Tunnel and the Tunnel to firewall 2

    on firewall 2

    incoming LAN of 192.168.100.0/24

    Destination address the remote IKEv2 IP pool

    next hop VPN Tunnel and the Tunnel to firewall 1

    then

    security policy to allow the traffic

  • Zyxel_Tina
    Zyxel_Tina Posts: 729 image  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments

    Hi @ITB_Tony,

    To allow your remote IKEv2 VPN clients on Firewall 1 to access the LAN behind Firewall 2, you can treat Firewall 1 as a hub and route the traffic from the remote VPN clients into the existing Site-to-Site VPN tunnel.

    Please check the following settings:

    1. VPN Phase 2
      1. If you are using a policy-based VPN, both firewalls need to include the Remote VPN Client IP pool in the Phase 2 settings.
        1. On Firewall 1, add the VPN client IP pool to the Local Policy in addition to 192.168.101.0/24.
        2. On Firewall 2, add the VPN client IP pool to the Remote Policy.
    2. Policy Routes
      1. To define how traffic is forwarded between the two VPN tunnels, please configure
        1. On Firewall 1
          • Incoming: Remote Access VPN tunnel
          • Source: VPN Client IP Pool
          • Destination: 192.168.100.0/24
          • Next-Hop: Site-to-Site VPN tunnel (to Firewall 2)
        2. On Firewall 2
          • Incoming: LAN
          • Source: 192.168.100.0/24
          • Destination: VPN Client IP Pool
          • Next-Hop: Site-to-Site VPN tunnel (to Firewall 1)
    3. Security Policies
      1. Make sure the firewall rules allow this traffic.
        1. On Firewall 1 - Allow traffic from IPSec_VPN (Remote VPN clients) to IPSec_VPN (Site-to-Site), with destination 192.168.100.0/24.
        2. On Firewall 2 - Allow traffic from IPSec_VPN (VPN client pool) to LAN (192.168.100.0/24).

    Zyxel Tina

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）