Chapter 7 Tutorials
ZyWALL USG 100/200 Series User’s Guide
148
7.6.0.1 Hub-and-spoke VPN Requirements and Suggestions
Consider the following when implementing a hub-and-spoke VPN.
• This example uses a wide range for the ZyNOS-based ZyWALL’s remote
network, to use a narrower range, see
for an
example of configuring a VPN concentrator.
• The local IP addresses configured in the VPN rules should not overlap.
• The hub router must have at least one separate VPN rule for each spoke. In the
local policy, specify the IP addresses of the hub-and-spoke networks with which
the spoke is to be able to have a VPN tunnel. This may require you to use more
than one VPN rule.
• To have all Internet access from the spoke routers to go through the VPN
tunnel, set the VPN rules in the spoke routers to use 0.0.0.0 (any) as the
remote IP address.
• Your firewall rules can still block VPN packets.
• If the USG ZyWALLs or ZyWALL 1050s’ VPN tunnels are members of a single
zone, make sure it is not set to block intra-zone traffic.
• The ZyNOS based ZyWALLs don't have user-configured policy routes so the only
way to get traffic destined for another spoke router to go through the ZyNOS
ZyWALL's VPN tunnel is to make the remote policy cover both tunnels.
• Since the USG ZyWALLs or ZyWALL 1050s automatically handle the routing for
VPN tunnels, if a USG ZyWALL or ZyWALL 1050 is a hub router and the local
policy covers both tunnels, the automatic routing takes care of it without
needing a VPN concentrator.
• If a ZyNOS-based ZyWALL’s remote network setting overlaps with its local
network settings, set
ipsec swSkipOverlapIp
to
on
to send traffic destined to
A’s local network to A’s local network instead of through the VPN tunnel.
7.7 How to Configure User-aware Access Control
You can configure many policies and security settings for specific users or groups
of users. This is illustrated in the following example, where you will set up the
following policies. This is a simple example that does not include priorities for
different types of traffic. See
Bandwidth Management on page 565
for more on
bandwidth management.
Table 22
User-aware Access Control Example
GROUP (USER)
WEB
SURFING
WEB
BANDWIDTH
MSN
LAN-TO-DMZ
ACCESS
Finance (Leo)
Yes
200K
No
Yes
Engineer (Steven) Yes
100K
No
No
Sales (Debbie)
Yes
100K
Yes (M-F, 08:30~18:00)
Yes
Boss (Andy)
Yes
100K
Yes
Yes
Summary of Contents for ZyWALL USG 100 Series
Page 2: ......
Page 30: ...Table of Contents ZyWALL USG 100 200 Series User s Guide 30 ...
Page 31: ...31 PART I User s Guide ...
Page 32: ...32 ...
Page 46: ...Chapter 2 Features and Applications ZyWALL USG 100 200 Series User s Guide 46 ...
Page 64: ...Chapter 3 Web Configurator ZyWALL USG 100 200 Series User s Guide 64 ...
Page 186: ...Chapter 7 Tutorials ZyWALL USG 100 200 Series User s Guide 186 ...
Page 223: ...Chapter 8 L2TP VPN Example ZyWALL USG 100 200 Series User s Guide 223 ...
Page 224: ...Chapter 8 L2TP VPN Example ZyWALL USG 100 200 Series User s Guide 224 ...
Page 225: ...225 PART II Technical Reference ...
Page 226: ...226 ...
Page 240: ...Chapter 9 Dashboard ZyWALL USG 100 200 Series User s Guide 240 ...
Page 284: ...Chapter 10 Monitor ZyWALL USG 100 200 Series User s Guide 284 ...
Page 372: ...Chapter 13 Interfaces ZyWALL USG 100 200 Series User s Guide 372 ...
Page 382: ...Chapter 14 Trunks ZyWALL USG 100 200 Series User s Guide 382 ...
Page 398: ...Chapter 15 Policy and Static Routes ZyWALL USG 100 200 Series User s Guide 398 ...
Page 412: ...Chapter 16 Routing Protocols ZyWALL USG 100 200 Series User s Guide 412 ...
Page 432: ...Chapter 19 NAT ZyWALL USG 100 200 Series User s Guide 432 ...
Page 437: ...Chapter 20 HTTP Redirect ZyWALL USG 100 200 Series User s Guide 437 ...
Page 438: ...Chapter 20 HTTP Redirect ZyWALL USG 100 200 Series User s Guide 438 ...
Page 460: ...Chapter 23 Authentication Policy ZyWALL USG 100 200 Series User s Guide 460 ...
Page 478: ...Chapter 24 Firewall ZyWALL USG 100 200 Series User s Guide 478 ...
Page 519: ...Chapter 25 IPSec VPN ZyWALL USG 100 200 Series User s Guide 519 ...
Page 520: ...Chapter 25 IPSec VPN ZyWALL USG 100 200 Series User s Guide 520 ...
Page 534: ...Chapter 26 SSL VPN ZyWALL USG 100 200 Series User s Guide 534 ...
Page 544: ...Chapter 27 SSL User Screens ZyWALL USG 100 200 Series User s Guide 544 ...
Page 546: ...Chapter 28 SSL User Application Screens ZyWALL USG 100 200 Series User s Guide 546 ...
Page 554: ...Chapter 29 SSL User File Sharing ZyWALL USG 100 200 Series User s Guide 554 ...
Page 639: ...Chapter 34 IDP ZyWALL USG 100 200 Series User s Guide 639 ...
Page 640: ...Chapter 34 IDP ZyWALL USG 100 200 Series User s Guide 640 ...
Page 661: ...Chapter 35 ADP ZyWALL USG 100 200 Series User s Guide 661 ...
Page 662: ...Chapter 35 ADP ZyWALL USG 100 200 Series User s Guide 662 ...
Page 694: ...Chapter 37 Content Filter Reports ZyWALL USG 100 200 Series User s Guide 694 ...
Page 712: ...Chapter 38 Anti Spam ZyWALL USG 100 200 Series User s Guide 712 ...
Page 734: ...Chapter 39 Device HA ZyWALL USG 100 200 Series User s Guide 734 ...
Page 750: ...Chapter 40 User Group ZyWALL USG 100 200 Series User s Guide 750 ...
Page 756: ...Chapter 41 Addresses ZyWALL USG 100 200 Series User s Guide 756 ...
Page 768: ...Chapter 43 Schedules ZyWALL USG 100 200 Series User s Guide 768 ...
Page 784: ...Chapter 45 Authentication Method ZyWALL USG 100 200 Series User s Guide 784 ...
Page 806: ...Chapter 46 Certificates ZyWALL USG 100 200 Series User s Guide 806 ...
Page 818: ...Chapter 48 SSL Application ZyWALL USG 100 200 Series User s Guide 818 ...
Page 828: ...Chapter 49 Endpoint Security ZyWALL USG 100 200 Series User s Guide 828 ...
Page 880: ...Chapter 50 System ZyWALL USG 100 200 Series User s Guide 880 ...
Page 920: ...Chapter 54 Reboot ZyWALL USG 100 200 Series User s Guide 920 ...
Page 922: ...Chapter 55 Shutdown ZyWALL USG 100 200 Series User s Guide 922 ...
Page 942: ...Chapter 56 Troubleshooting ZyWALL USG 100 200 Series User s Guide 942 ...
Page 954: ...Chapter 57 Product Specifications ZyWALL USG 100 200 Series User s Guide 954 ...
Page 1126: ...Appendix F Open Software Announcements ZyWALL USG 100 200 Series User s Guide 1126 ...