Cloudguard AWS -endpoint security remote access vpn address pool

Cathy_Cheng — Mon, 16 Mar 2026 06:03:39 GMT

We have deployed a CloudGuard cluster across multiple AWS Availability Zones in HA mode and are planning to enable Endpoint Remote Access VPN. The CloudGuard gateway will assign DHCP IP addresses to VPN clients.

1. The DHCP pool does not belong to any AWS VPC CIDR range. It is a local subnet in the cloudguard gateway. Is it correct ?

2. Other VPCs will route traffic destined for the VPN client pool to the CloudGuard VPC, and then the CloudGuard VPC route table set up to route traffic destined for the VPN client IP pool to the active member ENI. Is it correct ?

Thanks in advance for any response

Re: Cloudguard AWS -endpoint security remote access vpn address pool

Nir_Shamir — Mon, 16 Mar 2026 07:47:00 GMT

when you say "DHCP IP addresses" you mean the local office mode ip addresses or are you actually using a DHCP Server to assign IP addresses ?

the local office mode ip addresses pool are ip addresses assigned by the GW to the clients and it is local to the GW's.

Regarding the route you are correct, you need to return the traffic toward the remote access clients towards the GW, unless you are hiding them behind the GW using NAT.

topic Cloudguard AWS -endpoint security remote access vpn address pool in Cloud Firewall

Cloudguard AWS -endpoint security remote access vpn address pool

Re: Cloudguard AWS -endpoint security remote access vpn address pool