Chapter 4 Create Secure Connections Across the Internet
ZyWALL USG 20-2000 User’s Guide
71
If you have the
Configuration > VPN > IPSec VPN > VPN Connection
screen’s
Use Policy
Route to control dynamic IPSec rules option
enabled and the VPN connection is up but VPN
traffic cannot be transmitted through the VPN tunnel, check the routing policies to see if they are
sending traffic elsewhere instead of through the VPN tunnels.
4.2 VPN Concentrator Example
A VPN concentrator uses hub-and-spoke VPN topology to combine multiple IPSec VPN connections
into one secure network. The hub routes VPN traffic between the spoke routers and itself. This
reduces the number of VPN connections to set up and maintain. Here a VPN concentrator connects
ZLD-based ZyWALLs at headquarters (HQ) and branch offices A and B in one secure network.
• Branch A’s ZyWALL uses one VPN rule to access both the headquarters (HQ) network and branch
B’s network.
• Branch B’s ZyWALL uses one VPN rule to access branch A’s network only. Branch B is not
permitted to access the headquarters network.
Figure 29
IPSec VPN Concentrator Example
This IPSec VPN concentrator example uses the following settings.
Branch Office A
VPN Gateway (VPN Tunnel 1):
• My Address: 10.0.0.2
• Peer Gateway Address: 10.0.0.1
VPN Connection (VPN Tunnel 1):
• Local Policy: 192.168.11.0/255.255.255.0
• Remote Policy: 192.168.1.0/255.255.255.0
• Disable Policy Enforcement
Policy Route
• Source: 192.168.11.0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
