Remote XG VPN route

Question

I have one main XG in the head office. As of right now I also have 2 remote smaller Xg's that are connecting via ipsec back to the head office XG. I have in the connection settings each remote network listed but they are not able to route to each other. Is there something I am missing? Can 2 remote XG's allow lan access to each other in a setup like this?

This thread was automatically locked due to age.

ErenERTAS · Accepted Answer

Woah there is a very long explanation of the issue, thanks for lca. but i think just adding firewall rule to apply LAN-VPN and VPN-LAN traffic should work.

lna · Answer

Hi Vic, yep it is possible. some Points to check: - VPN Definition in Branch A "Site2Site Branch-A to HeadOffice": Local Networks: "Net_Branch-A" Remote Networks: "Net_Branch-B, Net_HeadOffice" - VPN Definition in HeadOffice "Site2Site Branch-A to HeadOffice": Local Networks: "Net_Branch-B, Net_HeadOffice" Remote Networks: "Net_Branch-A" - VPN Definition in Branch B "Site2Site Branch-B to HeadOffice": Local Networks: "Net_Branch-B" Remote Networks: "Net_Branch-A, Net_HeadOffice" - VPN Definition in HeadOffice "Site2Site Branch-B to HeadOffice": Local Networks: "Net_Branch-A, Net_HeadOffice" Remote Networks: "Net_Branch-B" - Firewall Rule Head Office "VPN to VPN Net_Branch-A and Net_Branch-B to Net_Branch-B and Net_Branch-A" - Firewall Rule Branch-A "LAN to VPN Net_Branch-A to Net_Branch-B" - Firewall Rule Branch-A "VPN to LAN Net_Branch-B to Net_Branch-A" - Firewall Rule Branch-B "LAN to VPN Net_Branch-A to Net_Branch-B" - Firewall Rule Branch-B "VPN to LAN Net_Branch-B to Net_Branch-A" should work. if you additionally want to be able to manage the XG Firewalls through the Tunnel / to use your Head Offices Domain Services you'll Need to configure NAT Rules and IPsec Route for System Context. System IPSEC-Route: console> system ipsec_route add net / tunnelname System NAT-Rule (to tell wich internal IP to use for communication to head Office): console> set advanced-firewall sys-traffic-nat add destination netmask snatip Yours Lukas