We are trying to configure multiple networks (one for each customer) and have a single Peplink router at HQ that can connect with all those networks.
Our current challenge in this is that when we connect our HQ router to multiple customer networks, those customer networks become interconnected as well.
Each customer has multiple Peplink routers with SpeedFusion tunnels to their own FusionHub.
Our HQ router has SpeedFusion tunnels to all FusionHubs.
The red line connection is what happens and what we want to prevent.
As a result, not only can HQ connect to all devices of Customer A and B (as intended), a device from Customer A can now connect to a device from Customer B (what we want to prevent).
In an attempt to have the HQ router block connections between Customer networks, we tried setting an outbound firewall policy on the HQ router that only allows traffic from and to the subnet of the HQ router, but that did not block any traffic between the customer networks.
What exactly is the end goal or problem you are trying to solve here?
By default the FusionHub from Customer A and B will advertise any routes they know about to your HQ FusionHub, that in turn would pass routes that it learns from Customer B to Customer A and so on.
Configuring route / peer isolation on the HQ hub should drop the route advertisments from OSPF between your HQ and the Customers.
However that does not stop traffic flowing if the route could be learned by some other means, so firewall rules should be configured to isolate the customer networks - that may be easier said than done if these customers all manage their own address spaces without any coordination.
Using multiple VRFs on the HQ FusionHub is probably the correct way forward here, you would end up with a routing table per customer, which would solve the isolation problem without complex or unweildy firewall rules on the HQ FusionHub.
Have a look at this post and see if it would do what you want:
