On the same standard Relay, declare the respective network segments for terminals that support networking. Once interconnection is enabled at both ends, the shared Gateway connects the internal networks on both sides.
Learn about internal network interconnectionR&D devices access services in the office network through the tunnel, without changing the device's public egress for the sake of interconnection.
Set private subnets for WireGuard, RouterOS or FortiGate configurations with private-network capability. Both the Gateway and final Connector need firmware supporting private networking, and the device must be able to forward traffic for the declared subnets.
Only when both ends allow intercommunication with other terminals that have it enabled will the Gateway issue bidirectional routes and access rules. If either end turns it off, the pair of terminals no longer receives bidirectional authorization.
When adjusting internal subnets and routes, the original tunnel IP, identity, and keys are preserved. Devices do not need to recreate the terminal, but the updated configuration must be imported.
Use private IPv4 subnets (RFC1918), such as 192.168.10.0/24. When enabling intercommunication, check for overlapping terminal subnets within your team; shared access or routing nodes must also not have conflicting subnets.
After saving the intercommunication settings, download and re-import the device configurations on both ends. Old files will not load the newly added routes.
The devices and the customer network also need the appropriate forwarding, return routes, and firewall rules so that return traffic can reach the peer.
IPsec's "Add return route" only adds a route on the Gateway; it will not modify your customer cloud network's route table, security groups, or traffic selectors for you.
Learn about device onboarding →After revoking the corresponding terminal configuration, the Gateway synchronously removes its connection identity and clears the associated networking routes and access rules. Other independent terminals retain their own settings.
Learn about configuration revocation →Enabling it on one side alone will not establish two-way connectivity. Both sides must enable it, declare non-conflicting internal network segments, and import the updated configuration; device forwarding, return routing, and firewalls must also allow the corresponding access.
No. Interconnection is controlled by terminal configuration, internal network segments, and authorization from both sides. Here, the two sides connect to a common Gateway through the same standard Relay; it does not automatically establish networking between arbitrary Relays or different Gateways.
Yes. After saving, download the new configuration for both sides and import it so the devices load the updated network segments and routes. The original tunnel IP, identity, and keys are retained; the old configuration files will not acquire the newly added routes on their own.
