topic Re: Identity propagation ClusterXl members in Firewall and Security Management

Identity propagation ClusterXl members

akurtasanov — Tue, 07 Apr 2026 05:08:23 GMT

It became necessary to establish a connection between PDP and PEP in Identity Sharing mode from the interfaces of ClusterXL members. In short, the analogue of the cause of sk63264.
Is it possible?
The need is that some of the equipment must work via Route-Based IPsec, and, as it turned out, NAT is not possible with vti/vpnt.
Maybe there is an option to set a source IP to establish a connection?

Re: Identity propagation ClusterXl members

emmap — Tue, 07 Apr 2026 05:30:27 GMT

You want to change the IP address being used for ID sharing? We can do that: https://support.checkpoint.com/results/sk/sk60701

Re: Identity propagation ClusterXl members

akurtasanov — Tue, 07 Apr 2026 08:24:05 GMT

I saw this SK. Ithink It doesn't quite fit. The following is required.
There is an Identity Sharing Gateway.
A cluster with a VIP main IP of 172.21.56.1 connects to it. NAT is created. When accessing through regular interfaces via the backup ethxx channel, everything is fine. But when accessing via IPsec, the traffic doesn't follow the NAT rule. Traffic from the VPN simply ignores the NAT and goes from the VPN's src IP (let's say 192.168.1.1 ClusterMemberA, 192.168.1.2 ClusterMemberB). And the output I get is the situation described in sk63264 - Identity Sharing GW with two Incoming sessions from 192.168.1.1 and 192.168.1.2.

Re: Identity propagation ClusterXl members

emmap — Tue, 07 Apr 2026 09:44:28 GMT

Does your VTI have a VIP configured in SmartConsole?

Re: Identity propagation ClusterXl members

akurtasanov — Tue, 07 Apr 2026 10:24:58 GMT

Yes. Explicit Hide rule. NAT doesn't work.

There is a backup plan to simply connect directly to the collector becasue it initiates connection, but I would like to try to make the current configuration work.

Re: Identity propagation ClusterXl members

emmap — Wed, 08 Apr 2026 02:06:25 GMT

This might be a job for TAC, I don't have the setup to test this at the moment. I'm not aware of any reason why it should or should not work but I also haven't tried it before.

Re: Identity propagation ClusterXl members

akurtasanov — Wed, 29 Apr 2026 17:10:57 GMT

According to latest tests, R82.10 supports NAT for vpnt interfaces. But tested only single device.