Blocking an IPSec Subnet letting a few hosts through.
Hi,
I have an IPSec tunnel with another company. We have our subnets both set to /24. Now I want to block all of the other side, letting a few through, not the entire subnet.
I have a group with hosts I like to allow, but want to block the ones not in that group. (Mainly the rest that is)
How would I need to proceed?
Jeroen
Accepted Solution
-
Hi @JeroenSoree,
You can create the following two security policy rules.
The priority of Rule 1 must be higher than Rule 2.
Rule 1
From: IPSec-VPN
To: LAN
Source: the group with hosts from the remote VPN site you'd like to allow
Destination: the address of the local servers in ATP
Action: allow
Rule 2
From: IPSec-VPN
To: LAN
Source: any
Destination: any
Action: deny
In the following example, site to site VPN is established between ATP and another ZyWALL.
(192.168.1.0/24)ATP-----VPN------ZyWALL(192.168.10.0/24)
Only the IP addresses 192.168.10.33 and 192.168.10.34 from the remote site are able to access the local server in ATP.
Other IPs from the remote ZyWALL is not able to access the local server in ATP.
5
All Replies
-
Hi @JeroenSoree,
You can create the following two security policy rules.
The priority of Rule 1 must be higher than Rule 2.
Rule 1
From: IPSec-VPN
To: LAN
Source: the group with hosts from the remote VPN site you'd like to allow
Destination: the address of the local servers in ATP
Action: allow
Rule 2
From: IPSec-VPN
To: LAN
Source: any
Destination: any
Action: deny
In the following example, site to site VPN is established between ATP and another ZyWALL.
(192.168.1.0/24)ATP-----VPN------ZyWALL(192.168.10.0/24)
Only the IP addresses 192.168.10.33 and 192.168.10.34 from the remote site are able to access the local server in ATP.
Other IPs from the remote ZyWALL is not able to access the local server in ATP.
5 -
Thanks a lot, works!
0
Categories
- All Categories
- 347 Beta Program
- 2.1K Nebula
- 114 Nebula Ideas
- 77 Nebula Status and Incidents
- 5K Security
- 44 USG FLEX H Series
- 246 Security Ideas
- 1.2K Switch
- 65 Switch Ideas
- 901 WirelessLAN
- 33 WLAN Ideas
- 5.8K Consumer Product
- 204 Service & License
- 326 News and Release
- 71 Security Advisories
- 21 Education Center
- 5 [Campaign] Zyxel Network Detective
- 1.8K FAQ
- 831 Nebula FAQ
- 401 Security FAQ
- 219 Switch FAQ
- 190 WirelessLAN FAQ
- 45 Consumer Product FAQ
- 136 Service & License FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 71 About Community
- 61 Security Highlight