VPN to FirstSpot through Zywall-2 firewall

[Anchorline]

Hi,

Anyone ever use Zywall-2 firewalls to establish a site-to-site VPN from remote sites to a central FirstSpot server?

I want remote sites to be able to use the Internet through a FirstSpot server behind one Zywall, and am not sure how to set up the VPN.....FirstSpot has two NICs, the CT one attached to the Zywall and the MTD one going back to the Internet....

Any help would be appreciated.

Thanks,

Sheri
_________________
Anchorline Wireless Internet
www.anchorline.net

[alan]

I don't think you can setup Scenario 3 using Zywall-2. Zywall 10 will be a better bet.

The key feature for Scenario 3 ( see http://www.patronsoft.com/firstspot/topologies.html ) is non-split tunnel. Basically, you need to force all traffic to FirstSpot (using VPN) before reaching the Internet at large.

For definition of split tunnel, please check out http://www142.nortelnetworks.com/bvdoc/contivity/doc_html/315899A00/chapte7a.htm . Non-split tunnel is just the opposite of split tunnel.
_________________
~ Patronsoft Limited ~

[alan]

For information about setting up non-split tunnel using Zywall, please check out:

http://www.zyxel.com/web/support_knowledgebase_detail.php?KnowledgeBaseID=572&pid=20041216174151

Excerpt of the article:

How can I redirect 'All' Internet traffic over VPN tunnel?
Article ID: 572
Views: 62
Type: App/Conf Example
Firmware: 3.64 , 3.65 , 3.63 , 4.00


Problem:
If I have two VPN endpoints, say site A and site B. How can I send All Internet traffic from site A to site B over the VPN tunnel
and then let site B further redirect the traffic to Internet?


Solution:
The key point for this is to include all of the Internet
IP address in Remote network section of VPN policy in
site A.

You can edit VPN rules as the following,
================
Branch Office

Menu 27.1.1 - IPSec Setup

Index #= 1 Name= zw50_a-zw10II_a Tunnel
Active= Yes Keep Alive= No Nat Traversal= No
Local ID type= IP Content= 24.0.0.2
My IP Addr= 24.0.0.2
Peer ID type= IP Content= 24.0.0.1
Secure Gateway Addr= 24.0.0.1
Protocol= 0
Local: Addr Type= SUBNET
IP Addr Start= 192.168.2.0
End/Subnet Mask= 255.255.255.0
Port Start= 0 End= N/A
Remote: Addr Type= SUBNET
IP Addr Start= 0.0.0.0
End/Subnet Mask= 0.0.0.0
Port Start= 0 End= N/A
Enable Replay Detection= No
Key Management= IKE
Edit Key Management Setup= No

Press ENTER to Confirm or ESC to Cancel:

note: Make sure you issue CI command "ipsec swSkipOverlapIp on" in SMT menu 24, otherwise you may have problem access your local LAN network.
================
Central Office

Menu 27.1.1 - IPSec Setup

Index #= 1 Name= zw50_a-zw10II_a Tunnel
Active= Yes Keep Alive= No Nat Traversal= No
Local ID type= IP Content= 24.0.0.1
My IP Addr= 24.0.0.1
Peer ID type= IP Content= 24.0.0.2
Secure Gateway Addr= 24.0.0.2
Protocol= 0
Local: Addr Type= SUBNET
IP Addr Start= 0.0.0.0
End/Subnet Mask= 0.0.0.0
Port Start= 0 End= N/A
Remote: Addr Type= SUBNET
IP Addr Start= 192.168.2.0
End/Subnet Mask= 255.255.255.0
Port Start= 0 End= N/A
Enable Replay Detection= No
Key Management= IKE
Edit Key Management Setup= No

Press ENTER to Confirm or ESC to Cancel:


In the example, you can see that we input 0.0.0.0 in the IP
address start field. In old firmeware, you can't do that.
Because 0.0.0.0 was forbidden. We have this enhanced after V3.52
major release.

For old VPN code, there is another work around.

Please use

Addr Type= RANGE
IP Addr Start= 0.0.0.1
End/Subnet Mask= 255.255.255.255


(Zywall 2 might work but we never test it, so you need to confirm with Zyxel.)
_________________
~ Patronsoft Limited ~

[CyberElements]

So, in order to do sinario #3 you HAVE TO use a VPN?
_________________
Tim Reed
Owner
Cyber Elements WISP
Ellensburg, WA USA

[alan]

No. Either you have control on the outgoing Internet path, or you use VPN to mimic it.

Refer to http://www.patronsoft.com/firstspot/topologies.html for details.
_________________
~ Patronsoft Limited ~

[CyberElements]

Well i've been in contact with my Internet feed.... I'm hoping they're right, which I'm sure they are... i'm going to try using my managed switch and some Cisco 1721's (routers) ... so it would be like in the picture. Hope it all works :)

BTW still not used full 4.0 yet, cause am moving into my apartment tomorrow (very excited) and that will be the central server location :)

Hope all works well.
_________________
Tim Reed
Owner
Cyber Elements WISP
Ellensburg, WA USA