Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Subscribers 27 subscribers
  • Views 1309 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG identifying remote network as WAN zone instead of VPN zone

Rodrigo Silveira1

Hello,

Here is my scenario:

Head Office network 192.168.200.0/22 and gateway 192.168.200.11 (XG)
Branch Office network 172.16.16.0/24 and gateway 172.16.16.16 (XG)

Both firewalls are running on 18.0.2


VPN IPSEC site-to-site established successfully.

Both firewalls have the same set of rules, one for traffic from LAN to VPN any host and another for traffic from VPN to LAN any host.
From Branch Office XG I can ping the Head Office XG on its LAN IP

But from Head Office XG I cannot ping the Branch Office XG on its LAN IP

Analyzing on Log Viewer I can see that the Head Office XG identified the 172.16.16.0 remote network as part of the WAN zone and the traffic is ignoring the rule I created for VPN traffic.

I have already tried to change the route precedence in SSH but still no luck



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi  

    Thank you for reaching out to the Community! 

    Thank you for providing the screenshots. It seems the traffic from 192.168.200.170 might be hitting the wrong firewall rule, and NAT rule id 10 applies to the traffic; that is the reason why you see the WAN as destination zone.

    Create a LAN to the VPN zone rule above the default LAN to the WAN firewall rule. 

    Thanks,

Reply
  • FormerMember
    0 FormerMember

    Hi  

    Thank you for reaching out to the Community! 

    Thank you for providing the screenshots. It seems the traffic from 192.168.200.170 might be hitting the wrong firewall rule, and NAT rule id 10 applies to the traffic; that is the reason why you see the WAN as destination zone.

    Create a LAN to the VPN zone rule above the default LAN to the WAN firewall rule. 

    Thanks,

Children