IPSec routing between 3 sites

Posted on 2011-10-17
Last Modified: 2012-08-13
Hi, I'm trying to setup routing and dnat/snat through a couple of IPSec vpn sites.
The setup today is as follows:

Site A  <- IPSec VPN -> Site B <- IPSec VPN -> Site C
Site A
Site B
Site C

Site A = Zyxel Zywall USG-1000 latest fw
Site B = Zyxel Zywall USG-200 latest fw
Site C = Juniper SRX100 unknown fw

Local policy for the IPSec tunnls are:

A <-> B <->
B <-> C <->

There is unfortunately no possibility to establish a VPN-link between site A and C.

All vpn-links works fine as of today, no problems to access resources both ways from Site A <-> B and Site B <-> C.

What I want to do is to be able to access Site A from C and site C from A.
This is where the tricky part comes in, Site A's IP-range is already in use at Site C and cannot easily be changed, I know this would be the best solution but as of today it cannot be done.
Also a VPN-link between Site A and C cannot be established as of today.So I have to use some kind of NAT policy for SIte A's subnet when it tries to access Site C and let the traffic pass through Site B.

I was thinking to do SNAT/DNAT per host, for example:

Traffic flow:
Host at Site A <- IPSec VPN with DNAT/SNAT/NAT to -> Site B <- IPSec VPN -> Site C

I have got the traffic coming through from Site A host to Site B, I used DNAT and SNAT for this and at Site B it shows up as so I got it working so far. But here it ends, I cannot get the traffic from to pass on to Site C.

I have tried using policy routes at Site B to route traffic from to Site C and the other way around but without success. I have already spent many hours trying all different sorts of routes, policies, NAT, SNAT, DNAT but now I have run out of ideas.

I haven't been able to find any examples for this type of setup, yes Google is normally my best friend, but not this time...
Has anyone done this kind of setup before and maybe have some good information or pointers about how to set this up?
What is the best practice or recomended setup for this kind of infrastructure?

I hope what I wrote will make sense, I have done many point to point VPN-connections before with routing etc, but never a setup like this one.

Thanks in advice,
Tired System administrator

Question by:Kallekanon
    LVL 67

    Accepted Solution

    The required feature on Site B is called "Hub and Spoke", and it seems your USG 200 does not support that. Hub and Spoke is special in the way traffic passes the device and the same interface more than once, applying all necessary NAT and filtering stuff. USG 1000 is said to allow for that.

    Author Comment

    Oh crap, I see what you mean now.. I talked to Zyxel support earlier today and they assured me that this should be possible with the USG-200, I guess the support didn't read up on their products argh..

    Thanks for your quick reply!

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Join & Write a Comment

    Suggested Solutions

    In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
    Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now