Virtual Address Mapping

Transcription

1 Virtual Address Mapping Ziel ist es, zwischen zwei ZyWALL Routern (ZyWALL 2 Plus <~> ZyWALL P1), welche sich beide im selben Lokalen IP Bereich ( /24) befinden, einen VPN-Tunnel mittels NAT over IPSec zu etablieren. Overlapping Local And Remote Network IP Addresses Devices behind the ZyWALL (local devices) and the devices behind the remote IPSec router (remote devices) may use private IP addresses. Therefore it is possible that local devices and remote devices may have the same IP addresses. This is known as overlapping local and remote IP addresses. For example, local network X uses IP addresses to Remote network Y uses IP addresses to If you select the VPN rules skip applying to the overlap range of local and remote IP addresses option (see VPN Global Setting ), every time a computer on network X tries to access a network X computer with an IP address from to , the ZyWALL sends the traffic through the VPN tunnel to network Y. If you clear the VPN rules skip applying to the overlap range of local and remote IP addresses option (see VPN Global Setting ), every time a computer on network X tries to access a network X computer with an IP address from to , the ZyWALL sends the traffic to the local network. Virtual Address Mapping Virtual address mapping (NAT over IPSec) changes the source IP addresses of packets from your local devices to virtual IP addresses before sending them through the VPN tunnel. Avoiding Overlapping Local And Remote Network IP Addresses If both IPSec routers support virtual address mapping, you can access devices on both networks, even if their IP addresses overlap. You map the ZyWALL's local network addresses to virtual IP addresses and map the remote IPSec router's local IP addresses to other (non-overlapping) virtual IP addresses. Take Overlapping Local And Remote Network IP Addresses as an example of overlapping local and remote IP addresses. You can set up virtual address mapping on both IPSec routers to allow computers on network X to access network X and network Y computers with the same IP address. You set ZyWALL A to change the source IP addresses of packets from local network X ( to ) to virtual IP addresses to before sending them through the VPN tunnel. You set ZyWALL B to change the source IP addresses of packets from the remote network Y ( to ) to virtual IP addresses to before sending them through the VPN tunnel. On ZyWALL A, you specify to as the remote network. On ZyWALL B, you specify to as the remote network. Computers on network X use IP addresses to to access local network devices and IP addresses to to access the remote network devices. Computers on network Y use IP addresses to to access local network devices and IP addresses to to access the remote network devices.

2 ZyWALL 2 Plus 1. LAN = /24 ( ) 2. WAN = /24 ( ) - # Name Local Network Remote Network Encapsulation IPSec Algorithm Tunnel ESP AES--SHA1 (ZyWALL2A)

3

4 ZyWALL P1 1. LAN = /24 ( ) 2. WAN = /24 ( ) - # Name Local Network Remote Network Encapsulation IPSec Algorithm Tunnel ESP AES--SHA1 (ZyWALLP1)

5

6 Führt man aus dem LAN der ZyWALL P1 nun einen ping aus, ist dieser an die Adresse zu richten um die ZyWALL 2 Plus auf deren eigentlichen Adresse zu erreichen. Syslogergebnis am LAN der ZyWALL P1: :30:06 Local1.Info src=" " dst=" " msg="firewall default policy: :30:05 Local1.Info src=" " dst=" " msg="firewall default policy: :30:04 Local1.Info src=" " dst=" " msg="firewall default policy: :30:03 Local1.Info src=" " dst=" " msg="firewall default policy: Syslogergebnis am LAN der ZyWALL 2 Plus: :34:02 Local2.Info ZyWALL2A.zyxeltech.de src=" " dst=" " msg="firewall :34:01 Local2.Info ZyWALL2A.zyxeltech.de src=" " dst=" " msg="firewall :34:00 Local2.Info ZyWALL2A.zyxeltech.de src=" " dst=" " msg="firewall :33:59 Local2.Info ZyWALL2A.zyxeltech.de src=" " dst=" " msg="firewall