ZyXEL Communications ZyWALL USG 100 Series User manual

1/8
www.zyxel.com
ZyWALL USG-Series
How to setup a Site-to-Site VPN connection between two ZyWALL USG series
appliances.

2/8
www.zyxel.com
Table of Content
Introduction 3
ZyWALL USG 100 4
Creating the address objects 4
Creating VPN Gateway 4
Creating VPN Connection 5
ZyWALL USG 200 6
Creating the address objects 6
Creating VPN Gateway 6
Creating VPN Connection 7
Establish connection 8

3/8
www.zyxel.com
Introduction
This guide will explain how to configure a site-to-site VPN connection as
shown in the picture below:
In the above scenario the clients at the Branch office wants to be able
to access the Headquarters entire LAN subnet and vice versa. The setup
will be the same regardless what ZyWALL USG model you are using. In
this example we will be looking at a ZyWALL USG 100 and ZyWALL USG
200.
To setup this scenario you need to configure the following in both
ZyWALL USG’s:
Address object for remote subnet.
VPN Gateway.
VPN Connection.
After configuring these three things on both ZyWALL USG’s, you will have
established the connection.

4/8
www.zyxel.com
ZyWALL USG 100
Creating the address objects
Go to Configuration Object Address and click the Add button.
Now create a Subnet address that contains the LAN Subnet of the
opposite ZyWALL USG as shown in the picture below:
Creating VPN Gateway
Go to Configuration VPN IPSec VPN VPN Gateway and click the
Add button. You need to make sure the Gateway is enabled. Fill in the
Interface field with the WAN IP of the ZyWALL USG 100. For Peer
Gateway Address you should choose “Static Address”and type in the
remote ZyWALL USG 200 WAN IP or Domain/DDNS hostname. You also
need to type in a Pre-Shared Key of the VPN connection. This key should
match that of the remote ZyWALL USG 200.

5/8
www.zyxel.com
Creating VPN Connection
Go to Configuration VPN IPSec VPN VPN Connection and click
the Add button. Enable the Connection. Under Application Scenario
choose Site-to-site. Make sure that you select the correct VPN Gateway,
in this case Headquarters. In Local policy select the LAN Subnet of the
ZyWALL USG 100. In Remote policy you need to select the Address
object created earlier in this guide.
You have now finished the required configurations on the ZyWALL USG
100.

6/8
www.zyxel.com
ZyWALL USG 200
Creating the address objects
Go to Configuration Object Address and click the Add button.
Now create a Subnet address that contains the LAN Subnet of the
opposite ZyWALL USG as shown in the picture below:
Creating VPN Gateway
Go to Configuration VPN IPSec VPN VPN Gateway and click the
Add button. You need to make sure the Gateway is enabled. Fill in the
Interface field with the WAN IP of the ZyWALL USG 200. For Peer
Gateway Address you should choose “Static Address”and type in the
remote ZyWALL USG 100 WAN IP or Domain/DDNS hostname. You also
need to type in a Pre-Shared Key of the VPN connection. This key should
match that of the remote ZyWALL USG 100.

7/8
www.zyxel.com
VPN Connection
Go to Configuration VPN IPSec VPN VPN Connection and click
the Add button. Enable the Connection. Under Application Scenario
choose Site-to-site. Make sure that you select the correct VPN Gateway,
in this case Branch_Office. In Local policy select the LAN Subnet of the
ZyWALL USG 200. In Remote policy you need to select the Address
object created earlier in this guide.
You have now finished the required configurations on the ZyWALL USG
200.

8/8
www.zyxel.com
Establish connection
Both ZyWALL USG’s are now configured. The only thing left, is to establish
the VPN connection. This can be done manually by selecting your VPN
connection and clicking the Connect button in Configuration VPN 
IPSec VPN VPN Connection. Alternatively you can edit the VPN
Connection rule, click Show Advance Settings and enable Nailed-Up.
With Nailed-Up enabled the VPN tunnel will connect up automatically
when the ZyWALL USG boots up.
All devices at the Branch Office will now be able to access devices and
computers on the Headquarters subnet and vice versa.