topic Re: Identity awareness does not work, routing problem. How to be in such a situation? in Firewall and Security Management

Identity awareness does not work, routing problem. What are the options for solving the problem?

Andrew25 — Sat, 04 Dec 2021 16:25:45 GMT

We plan to use authentication on the FW-B for Internet access and Mobile Access connections

Description of the problem

FW-B uses an external IP (2.2.2.2) address for requests (Identity Avareaness) to DC-1. DC-1 sends a response in the wrong direction, according to routing

Is it possible to configure the FW-B so that it sends requests (Identity Avareaness) using its local IP address as the source interface?

Re: Identity awareness does not work, routing problem. How to be in such a situation?

the_rock — Sat, 04 Dec 2021 13:05:15 GMT

What do you see if you issue ip route get and then IP of the DC1? just run ip r g 192.168.0.1 on expert mode of firewall B.

Re: Identity awareness does not work, routing problem. How to be in such a situation?

Andrew25 — Sat, 04 Dec 2021 13:47:21 GMT

192.168.0.1 via 2.2.2.1 dev eth1 src 2.2.2.2

Re: Identity awareness does not work, routing problem. How to be in such a situation?

the_rock — Sat, 04 Dec 2021 13:50:54 GMT

Well, if you want it to take different path, just change the route to reflect different interface. It seems at this point its using 2.2.2.2 interface IP with gateway of 2.2.2.1.

Re: Identity awareness does not work, routing problem. How to be in such a situation?

Andrew25 — Sat, 04 Dec 2021 13:54:10 GMT

I don’t understand, you can learn more?

Re: Identity awareness does not work, routing problem. How to be in such a situation?

the_rock — Sat, 04 Dec 2021 14:03:52 GMT

What Im saying is, it does not sound logical to use external interface to access something internal from the firewall itself. Just change it to reflect internal interface of the firewall, as long as topology is right.

Re: Identity awareness does not work, routing problem. How to be in such a situation?

Andrew25 — Sat, 04 Dec 2021 14:07:46 GMT

Yes, it is not logical, I agree. How to change it to reflect internal interface of the firewall?

Re: Identity awareness does not work, routing problem. How to be in such a situation?

the_rock — Sat, 04 Dec 2021 18:56:53 GMT

From web UI or clish. Just change it via web UI in the browser, it takes 15 seconds literally.

Re: Identity awareness does not work, routing problem. What are the options for solving the problem?

Andrew25 — Wed, 08 Dec 2021 17:47:13 GMT

You could do a hide NAT on the traffic from FW-B when it passes through FW-A to go to the DC-1