Nebula Site-to-Site VPN — Configure Site-to-Site VPN Between Nebula Gateways Using Standard VPN and VPN Orchestrator

Nebula provides two different methods for creating Site-to-Site VPN connections between Nebula gateways.

Note: Nebula SD-VPN and VPN Orchestrator support VPN connectivity only between gateways located within the same Nebula organization. For VPN deployments between different organizations or third-party devices, Manual-link VPN must be used.

Note: The configuration examples in this article are based on a Zyxel H Series firewall. The same procedures can also be used for USG FLEX and ATP Zyxel firewalls.

Related Article:  For IPSec VPN deployments where one or both peers are located behind NAT, refer to the following guide: Site-to-Site VPN with NAT on Zyxel USG FLEX H - Configuration Guide

This article explains deployment scenarios:

• VPN Orchestrator

There are two topologies you can use when creating a site-to-site VPN: Site-to-Site and Hub-and-spoke. This article would take the Site-to-Site scenario as an example.

• Scenario 1 — Standard Nebula Site-to-Site VPN

Nebula Manual-link VPN

Nebula SD-VPN

• Scenario 2 — Nebula VPN Orchestrator

Nebula VPN Orchestrator

Objective:

192.168.168.0/24 can communicate with 192.168.160.0/24

192.168.160.0/24 can communicate with 192.168.168.0/24

1. Navigate to "Organization-wide > Organization-wide manage > VPN orchestrator"

Enable both VPN gateways and select the subnet(s) that you want to communicate with each other.

2. We use the external interface as a VPN WAN link by default

If you want to change the VPN WAN link, please navigate to "Site-wide > Configure > Firewall > Site-to-Site VPN", select the Primary/Secondary interfaces that you want.

3. Navigate to "Organization-wide > Organization-wide manage > VPN orchestrator"

and click the refresh button of your browser

Nebula Manual-link VPN

This example demonstrates how to configure a manual IPSec Site-to-Site VPN tunnel using Nebula Manual-link VPN between two Zyxel firewalls managed by Nebula Control Center. Nebula Manual-link VPN can also be used to establish IPSec VPN tunnels between a Zyxel firewall and third-party firewalls, provided that both peers use matching IPSec parameters.

Step 1 — Configure Manual-link VPN 

Navigate to Nebula: Site-wide > Configure > Firewall > Site-to-Site VPN

Step 2 — Configure Manual-link VPN

Navigate to Nebula: Site-wide > Configure > Firewall > Site-to-Site VPN

Check the result. 

Nebula SD-VPN

This example demonstrates how to configure an automatic Site-to-Site VPN connection using Nebula SD-VPN between two Nebula gateways located within the same organization.

Step 1 — Configure Nebula SD-VPN on Site 1

Navigate to Nebula: Site-wide > Configure > Firewall > Site-to-Site VPN

Under the Nebula SD-VPN tab: Select the primary WAN interface. Enable the local subnet(s) that should participate in the VPN tunnel using the Use VPN toggle. Enable Nebula SD-VPN. Select the desired VPN Area. Set the VPN topology to Site-to-Site. Configure NAT Traversal if the device is located behind NAT.

Step 2 — Configure Nebula SD-VPN on Site 2

Navigate to: Site-wide > Configure > Firewall > Site-to-Site VPN

Under the Nebula SD-VPN tab: Select the primary WAN interface. Enable the local subnet(s) that should participate in the VPN tunnel. Enable Nebula SD-VPN. Select the same VPN Area used on Site 1. Set the VPN topology to Site-to-Site. Configure NAT Traversal settings if required.

Check the result.