ZyXEL Communications ZyWALL Series Support Note page 31

5.2 Configuration Guide
Network conditions:
ZyWALL:
Site WAN IP
HQ 10.59.3.201
Branch 1 10.59.3.200
Branch 2 10.59.3.37
Goals to achieve:
Mobile users can communicate with headquarters and all branch offices with only one
VPN tunnel.
VPN Tunnel VPN Policy(Local-Remote)
HQ-Branch 1 172.28.0.0/20 - 172.28.1.0/24
HQ-Branch 2 172.28.0.0/20 - 172.28.2.0/24
Branch 1-HQ 172.28.1.0/24 - 172.28.0.0/20
Outbound Traffic (SNAT)
Source: 192.168.1.0/24
Destination:172.28.0.0/20
SNAT:172.28.1.0/24
Inbound Traffic(DNAT)
Original IP: 172.28.1.0/24
Mapped IP: 192.168.1.0/24
Branch 2-HQ 172.28.2.0/24 - 172.28.0.0/20
Outbound Traffic (SNAT)
Source: 192.168.2.0/24
Destination:172.28.0.0/20
SNAT:172.28.2.0/24
Inbound Traffic(DNAT)
Original IP: 172.28.2.0/24
Mapped IP: 192.168.2.0/24