How to prevent traffic to directly connected subnets being sent through IPSec VPN tunnel ?

Options
dsi_blois_fr
dsi_blois_fr Posts: 3 image  Freshman Member
First Comment Friend Collector
in USG FLEX H Series

Hi !

I'm using a Zywall 50H

I set 3 local networks like this:
Name Zone IP/Netmask Type Members
ge3 LAN3 192.168.105.1/24 (Static) Ethernet p3
ge4 LAN4 192.168.107.1/24 (Static) Ethernet p4
ge5 LAN5 192.168.109.1/24 (Static) Ethernet p5

I have "Computer #1" on ge3 with IP address 192.168.105.34
I have "Computer #2" on ge4 with IP address 192.168.107.34
ge5 is not used here.

On computer #1 I ping computer #2. It answers.

So IP address, routing, policy control, all is fine.

Now I set up an IPSec VPN tunnel between ge3 and a remote network:

Local subnet is 192.168.105.0/24, Remote subnet is set to 0.0.0.0/0

What I want to do is that all traffic from ge3, INCLUDING INTERNET, goes through this tunnel, except the traffic to the other local, directly connected networks.

It works ... but the traffic to the other local networks seems to be also sent through the tunnel.

If the tunnel is up, I cannot ping computer 2 from computer 1, if I bring it down, I can ping again.

I tried many things.

I tried adding static routes, policy routes to force local traffic to be sent to the directly connected interfaces, but it changes nothing.

If I change the remote subnet of the IPSec VPN tunnel for a more specific one, I can ping with the tunnel up, but logically only traffic to that specific subnet is sent through the tunnel, nothing else, not the internet traffic. I tried, with this setting, to add static or policy routes to force all traffic though the tunnel, but again, it changes nothing.

How can I do what I want to do ?

50H_ipv4_routes.txt

All Replies

  • PeterUK
    PeterUK Posts: 4,506 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited June 11

    What firmware are you on

    Might have to do some testing just checking

    This routing rule was at the top of the list
    incoming ge3
    source IP 192.168.105.0/24
    destination IP 192.168.107.0/24
    next hop ge4
    SNAT none

    If the above don't work save your config and find and edit

    / vrf "main" routing policy-route "override-direct-route" "false"

    to

    / vrf "main" routing policy-route "override-direct-route" "true"

    can be done by SSH

    How to override-direct-route — Zyxel Community

    and upload to FLEX H and apply

  • PeterUK
    PeterUK Posts: 4,506 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited June 11

    Ok update I can now confirm this is a problem neither what I said will work (unless a reboot was needed)

    It seems with the routing rule as you ping to a subnet on the same FLEX H the count for that rule goes up but is still going down the tunnel.

    update2

    also tested on the ZLD (UDP60W) and is fine so is a problem with the uOS

  • Zyxel_Tina
    Zyxel_Tina Posts: 857 image  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments
    edited June 11

    Hi @dsi_blois_fr,

    To ensure a proper VPN connection on your USG FLEX 50H, we recommend adjusting the IPSec VPN settings and using policy routes.

    Setting the Remote Subnet to 0.0.0.0/0 in the IPSec VPN may override local routing. Instead, please specify the actual remote subnet and use policy routes to direct other traffic (including Internet traffic) through the tunnel.

    Please first modify the remote subnet in the IPSec VPN settings, then follow the steps below:

    Create an Address Group for your Local Subnets

    1. Go to Object > Address > Address Group.
    2. Click Add to create an Address Group (for example, named Local_Exclusion_Subnets).
    3. Add the subnets you want to bypass the VPN (e.g., 192.168.107.0/24 for LAN4 and 192.168.109.0/24 for LAN5).

    Create the Bypass Policy Route (Rule 1)

    1. Navigate to Network > Routing > Policy Route.
    2. Click Add to create a new rule at the top of your policy routing table:
      • Source Address: 192.168.105.0/24 (LAN3)
      • Destination Address: Local_Exclusion_Subnets (the group you created in Step 1)
      • Next Hop > Type: ge4/ge5 (The interface of your destination address)

    Configure/Verify the VPN Policy Route (Rule 2)

    Make sure your VPN policy route is positioned below the bypass rule you created in Step 2.

    • Source Address: 192.168.105.0/24 (LAN3)
    • Destination Address: Any (0.0.0.0/0)
    • Next Hop > Type: IPSec VPN Tunnel
    • IPSec VPN Tunnel: [Select your VPN Tunnel]

    With this configuration, any packet originating from LAN3 heading to LAN4 or LAN5 will hit the first rule and bypass the tunnel. All other traffic (including Internet traffic) will miss the first rule, hit the second rule, and successfully route through your IPSec VPN tunnel.

    Hope this helps!

    Zyxel Tina

  • PeterUK
    PeterUK Posts: 4,506 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited June 11

    Unfortunately this will not work for this case Tina

    the Local_Exclusion_Subnets need to happen by the VPN Policy remote 0.0.0.0/0

    What should happen which I think is happening on ZLD is the USG sees 0.0.0.0/0 and auto excludes subnets thats on the USG unless there is a routing rule saying other wise

  • zyman2008
    zyman2008 Posts: 245 image  Master Member
    50 Answers First Comment Friend Collector Eighth Anniversary

    I think USG FLEX H not support this case with policy-based IPSec VPN tunnel.

    It not support add bypass rules on the first VPN routing table.

    So only both peers use route-based IPSec VPN tunnel can works on USG FLEX H.

  • dsi_blois_fr
    dsi_blois_fr Posts: 3 image  Freshman Member
    First Comment Friend Collector

    Hi,

    Thank you very much for those quick and detailed answers.

    The OS Version is V1.38(ACLO.0)

    @PeterUK :

    I tried override-direct-route true. I rebooted the Zywall to be sure.

    Sorry, no change.

    I put it back to false.

    @Zyxel_Tina :

    I did as you explained, except in the Policy Route (Rule 1) I put directly LAN4_SUBNET (192.168.107.0/24) for the Destination Address (and ge4 interface for Next Hop)

    I'm afraid this Zywall doesn't seem to work like that.

    Computer 1 gets answers from computer 2 whether Rule 1 is active or not.

    If Rule 2 is inactive I have internet (from local internet connection according to whatsmyip - which is logical)

    If Rule 2 is active ... I don't have internet access anymore.

    Note: If I put back 0.0.0.0/0 as the remote subnet for the IPSec VPN, I have internet, and whatsmyip gives the ip address of the remote site - which is what I want.

    @zyman2008

    I'll try what you suggest and keep you informed.

  • PeterUK
    PeterUK Posts: 4,506 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited June 12

    So there is a way round this but not pretty by doing this

    exclude 10.0.0.0/8 and 192.168.0.0/16

    Screenshot 2026-06-11 205931.png

    problem is both ends need to support many subnet Policy

    So you don't have to have the other end do all these policies but the FLEX 200H has a limit of 10 where as the FLEX700H can do many more as shown.

    / vrf "main" ike vpn "testvpn" security-policy "7_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "7_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "7_255_255_255" remote-ts "subnet" "0.0.0.0/5"
    
/ vrf "main" ike vpn "testvpn" security-policy "7_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "7_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "7_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "7_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "7_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "9_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "9_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "9_255_255_255" remote-ts "subnet" "8.0.0.0/7"
    
/ vrf "main" ike vpn "testvpn" security-policy "9_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "9_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "9_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "9_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "9_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "63_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "63_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "63_255_255_255" remote-ts "subnet" "32.0.0.0/3"
    
/ vrf "main" ike vpn "testvpn" security-policy "63_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "63_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "63_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "63_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "63_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "31_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "31_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "31_255_255_255" remote-ts "subnet" "16.0.0.0/4"
    
/ vrf "main" ike vpn "testvpn" security-policy "31_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "31_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "31_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "31_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "31_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "15_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "15_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "15_255_255_255" remote-ts "subnet" "12.0.0.0/6"
    
/ vrf "main" ike vpn "testvpn" security-policy "15_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "15_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "15_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "15_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "15_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "11_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "11_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "11_255_255_255" remote-ts "subnet" "11.0.0.0/8"
    
/ vrf "main" ike vpn "testvpn" security-policy "11_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "11_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "11_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "11_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "11_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_159_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_159_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_159_255_255" remote-ts "subnet" "192.128.0.0/11"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_159_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_159_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_159_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_159_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_159_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_127_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_127_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_127_255_255" remote-ts "subnet" "192.0.0.0/9"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_127_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_127_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_127_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_127_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_127_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "191_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "191_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "191_255_255_255" remote-ts "subnet" "128.0.0.0/2"
    
/ vrf "main" ike vpn "testvpn" security-policy "191_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "191_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "191_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "191_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "191_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "127_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "127_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "127_255_255_255" remote-ts "subnet" "64.0.0.0/2"
    
/ vrf "main" ike vpn "testvpn" security-policy "127_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "127_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "127_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "127_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "127_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_171_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_171_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_171_255_255" remote-ts "subnet" "192.170.0.0/15"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_171_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_171_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_171_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_171_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_171_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_169_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_169_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_169_255_255" remote-ts "subnet" "192.169.0.0/16"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_169_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_169_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_169_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_169_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_169_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_167_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_167_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_167_255_255" remote-ts "subnet" "192.160.0.0/13"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_167_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_167_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_167_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_167_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_167_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_255_255_255" remote-ts "subnet" "192.192.0.0/10"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_191_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_191_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_191_255_255" remote-ts "subnet" "192.176.0.0/12"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_191_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_191_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_191_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_191_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_191_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_175_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_175_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_175_255_255" remote-ts "subnet" "192.172.0.0/14"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_175_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_175_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_175_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_175_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "192_175_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "199_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "199_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "199_255_255_255" remote-ts "subnet" "196.0.0.0/6"
    
/ vrf "main" ike vpn "testvpn" security-policy "199_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "199_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "199_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "199_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "199_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "195_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "195_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "195_255_255_255" remote-ts "subnet" "194.0.0.0/7"
    
/ vrf "main" ike vpn "testvpn" security-policy "195_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "195_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "195_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "195_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "195_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "193_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "193_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "193_255_255_255" remote-ts "subnet" "193.0.0.0/8"
    
/ vrf "main" ike vpn "testvpn" security-policy "193_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "193_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "193_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "193_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "193_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "255_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "255_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "255_255_255_255" remote-ts "subnet" "224.0.0.0/3"
    
/ vrf "main" ike vpn "testvpn" security-policy "255_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "255_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "255_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "255_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "255_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "223_255_255_255"
    
/ vrf "main" ike vpn "testvpn" security-policy "223_255_255_255" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "223_255_255_255" remote-ts "subnet" "208.0.0.0/4"
    
/ vrf "main" ike vpn "testvpn" security-policy "223_255_255_255" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "223_255_255_255" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "223_255_255_255" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "223_255_255_255" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "223_255_255_255" "vti-mark-out" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "200_0_0_0"
    
/ vrf "main" ike vpn "testvpn" security-policy "200_0_0_0" local-ts "subnet" "192.168.255.32/28"
    
/ vrf "main" ike vpn "testvpn" security-policy "200_0_0_0" remote-ts "subnet" "200.0.0.0/5"
    
/ vrf "main" ike vpn "testvpn" security-policy "200_0_0_0" "action" "esp"
    
/ vrf "main" ike vpn "testvpn" security-policy "200_0_0_0" "mode" "tunnel"
    
/ vrf "main" ike vpn "testvpn" security-policy "200_0_0_0" "priority" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "200_0_0_0" "vti-mark-in" "0"
    
/ vrf "main" ike vpn "testvpn" security-policy "200_0_0_0" "vti-mark-out" "0"

    I really do think zyxel can support this again in the uOS it should be a simple case of auto excludes subnets thats on the USG

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）