Quick Overview

Subnet Groups in zAccess define collections of IP address ranges, including both IPv4 and IPv6, that are assigned to specific gateway devices for traffic routing. These subnet groups determine how endpoint traffic is segmented and routed across the network, enabling policy enforcement at the network layer.

How to Use This Feature in the UI

1. Navigate to Network Configuration > Subnet Groups in the zAccess UI.
2. Click ADD SUBNET GROUP.
3. Provide a Group Name (e.g., “VPN Clients” or “Corporate LAN”).
4. Enter the following details:
   • IP Address – Specify a base IP (e.g., 192.168.100.0).
   • Prefix/Netmask – Define the subnet size (e.g., /24).
   • Gateway IP – Assign the IP of the local zAccess gateway responsible for this subnet.
5. Click Save to finalize the subnet group.

Concepts & Use Cases

• Logical Network Segmentation: Use subnet groups to assign different IP blocks to different user roles, departments, or physical locations.
• Gateway-Based Routing: Direct traffic from a defined subnet through specific gateways for enforcement and monitoring.
• Policy-Based Access Zones: Link subnet groups to policies through rulesets, ensuring the correct access level is enforced based on network location.
• IPv6 Enablement: Future-proof your environment by including IPv6 subnets for compatible endpoints.

Troubleshooting & FAQs

• Why isn’t a device receiving the expected policy?
  Verify that the device’s IP address falls within the correct subnet group and that the group is properly referenced in your ruleset logic.
• Can a subnet group be assigned to more than one gateway?
  Yes. This is often done for load balancing or high availability. However, be cautious with routing logic.
• How are subnets prioritized if multiple match?
  Rulesets determine final policy application. Subnet overlap should be avoided or tightly controlled through gateway assignment and group structure.
• Can I use dynamic IPs with subnet groups?
  Yes. As long as the DHCP server issues addresses within the subnet’s defined range, devices will be correctly associated.