[Last Call] Learn how to a build a cloud-first strategyRegister Now


IPSec routing between 3 sites

Posted on 2011-10-17
Medium Priority
Last Modified: 2012-08-13
Hi, I'm trying to setup routing and dnat/snat through a couple of IPSec vpn sites.
The setup today is as follows:

Site A  <- IPSec VPN -> Site B <- IPSec VPN -> Site C
Site A
Site B
Site C

Site A = Zyxel Zywall USG-1000 latest fw
Site B = Zyxel Zywall USG-200 latest fw
Site C = Juniper SRX100 unknown fw

Local policy for the IPSec tunnls are:

A <-> B <->
B <-> C <->

There is unfortunately no possibility to establish a VPN-link between site A and C.

All vpn-links works fine as of today, no problems to access resources both ways from Site A <-> B and Site B <-> C.

What I want to do is to be able to access Site A from C and site C from A.
This is where the tricky part comes in, Site A's IP-range is already in use at Site C and cannot easily be changed, I know this would be the best solution but as of today it cannot be done.
Also a VPN-link between Site A and C cannot be established as of today.So I have to use some kind of NAT policy for SIte A's subnet when it tries to access Site C and let the traffic pass through Site B.

I was thinking to do SNAT/DNAT per host, for example:

Traffic flow:
Host at Site A <- IPSec VPN with DNAT/SNAT/NAT to -> Site B <- IPSec VPN -> Site C

I have got the traffic coming through from Site A host to Site B, I used DNAT and SNAT for this and at Site B it shows up as so I got it working so far. But here it ends, I cannot get the traffic from to pass on to Site C.

I have tried using policy routes at Site B to route traffic from to Site C and the other way around but without success. I have already spent many hours trying all different sorts of routes, policies, NAT, SNAT, DNAT but now I have run out of ideas.

I haven't been able to find any examples for this type of setup, yes Google is normally my best friend, but not this time...
Has anyone done this kind of setup before and maybe have some good information or pointers about how to set this up?
What is the best practice or recomended setup for this kind of infrastructure?

I hope what I wrote will make sense, I have done many point to point VPN-connections before with routing etc, but never a setup like this one.

Thanks in advice,
Tired System administrator

Question by:Kallekanon
LVL 71

Accepted Solution

Qlemo earned 2000 total points
ID: 36982741
The required feature on Site B is called "Hub and Spoke", and it seems your USG 200 does not support that. Hub and Spoke is special in the way traffic passes the device and the same interface more than once, applying all necessary NAT and filtering stuff. USG 1000 is said to allow for that.

Author Comment

ID: 36982916
Oh crap, I see what you mean now.. I talked to Zyxel support earlier today and they assured me that this should be possible with the USG-200, I guess the support didn't read up on their products argh..

Thanks for your quick reply!

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question