Give two ranges to a VPN connection

steve15f
steve15f Posts: 16  Freshman Member
First Comment Friend Collector
edited April 2021 in Security

Hi dear,

i've created a new VPN IPSec connection. This connection allow to reach the range 192.168.110.0/24, but i want also allow to reach the range 192.168.100.0/24 with the same VPN connection. Is it possible ? how ?

i've also an another question : SSL VPN connection is working with the Active Directory accounts but with the IPSec VPN connection it is not working with the Active Directory accounts.

Thanks

All Replies

  • jasailafan
    jasailafan Posts: 193  Master Member
    5 Answers First Comment Friend Collector Sixth Anniversary
    Hi steve15f,

    If site-to-site VPN is created between two Zywalls, you can use policy route to reach the range 192.168.100.0/24 with the same VPN connection.

    Here is the example.
    The traffic can be transmitted between the subnet of site A 192.168.1.0/24 and site B 192.168.110.0/24.
    We want to enable communication between the subnet of site A 192.168.1.0/24 and site B 192.168.100.0/24.
    So two policy routes we are created:
    Site A -> source address : 192.168.1.0/24, destination address : 192.168.100.0/24, next-hop : vpn tunnel
    Site B -> source address : 192.168.100.0/24, destination address : 192.168.1.0/24, next-hop : vpn tunnel

    In site-to-site VPN with dynamic peer, the option "Policy Enforcement" is enabled by default, so we can't use policy route to control it.
  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 1,511  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 100 Answers 1000 Comments
    @jasailafan, thanks for the instruction.
    As for IP sec VPN connection is not working with AD, what is the device error log when you connect IPSec VPN client?
  • steve15f
    steve15f Posts: 16  Freshman Member
    First Comment Friend Collector
    HI @jasailafan thanks for your reply. It's not for a site to site VPN but ZyWALL IPSec VPN (Windows) client .

  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 1,511  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 100 Answers 1000 Comments

    Hi @steve15f,

    You can modify the VPN local policy address mask to /20, mask /20 range is 192.168.96.1 to 192.168.111.254.

    In this way, you can add another subnet in one VPN tunnel.

    Modify the local policy subnet at “CONFIGURAITON > VPN > IPSec VPN > VPN connection”


     Windows IPSec VPN client setting




Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）