I've read several possible solutions so far but I am having difficulty applying my particular situation to the answers I have found.

I have a "hub and spoke" style VPN running between several locations and headquarters using a TZ-200 at the hub and TZ-105's at the remotes. The hub network is and the spokes are through

I have established a remote office at and would like to be able to access hosts at all of the spokes at this location as I used to from the hub. So far I have tried vpn groups, destination networks, route statements and NAT translation but none have worked and I'm confused as to exactly where I am going wrong. Thank you for any guidance.

  • If I'm understanding you correctly, if you're VPN is up, you would just need to setup the routing so the firewalls would know where to route the traffic. – Nixphoe Apr 25 '16 at 17:00

You can follow two approaches.

To have a 100% routed setup, with no NAT involved, do the following:

  • on the remote office's firewall (the one with network), create a VPN tunnel having local lan defined as and remote lan defined as
  • on the hub firewall, create a VPN (to your remote office) having local lan defined as and remote lan as
  • on the hub firewall, go to the firewall rules and create a rule from VPN zone to VPN zone having as source and as destination.

A simpler solution is to use NAT on the central hub. For this solution to work, simply create plain VPNs to all your remote offices. Then:

  • edit the VPN for the network and check the "Apply NAT rules"
  • in the NAT panel, create a NAT having as source address and "LAN IP address" or "X0 IP" as translated address.

That's all.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.