topic Re: R81 VSX site to site vpn source interface in Firewall and Security Management

R81 VSX site to site vpn source interface

checkpointer — Wed, 13 Apr 2022 09:43:12 GMT

Hello

In the following topology, I would like to change the source interface for my site-to-site VPN from my gateway's main public IP address to another interface on the gateway, but I have nothing in the drop-down when I try to do this in the gateway object inside the community. I cannot change the main gateway IP address as this affects other VPNs.

Currently:

(GW main interface) 10.10.10.10 ------------->192.168.10.10 (3rd Party)

But I want:

(GW other interface) 20.20.20.20 ------------->192.168.10.10 (3rd Party)

I try to change my source interface inside VPN community but get nothing in drop-down:

Re: R81 VSX site to site vpn source interface

JanVC — Wed, 13 Apr 2022 09:53:28 GMT

are you trying to change this on the interoperable device/remote end instead of your own virtual system?

Re: R81 VSX site to site vpn source interface

checkpointer — Wed, 13 Apr 2022 10:15:13 GMT

I'm trying to change my own source interface on my device, not remote peer

Re: R81 VSX site to site vpn source interface

JanVC — Wed, 13 Apr 2022 10:38:36 GMT

that i understand, but judging by the screenshot it looks like you are editing the interoperable device since you are missing alot of stuff

first screenshot is of an interoperable device, second is of a virtual system

Re: R81 VSX site to site vpn source interface

checkpointer — Wed, 13 Apr 2022 13:07:17 GMT

I suppose the question then is whether the object has been created correctly? It's a VSX environment and I'll check this again with my customer.

Re: R81 VSX site to site vpn source interface

skandshus — Wed, 13 Apr 2022 20:12:36 GMT

This is Agree.

You need to open the "properties" on the virtual system.. the amount of options available from the screenshot is WAAAAAY too limited.. the "interoperable" device shouldnt be able to change the interface,.. it will never know what interface the virtual system has In real life 😉

Re: R81 VSX site to site vpn source interface

skandshus — Wed, 13 Apr 2022 20:19:51 GMT

Re: R81 VSX site to site vpn source interface

checkpointer — Thu, 14 Apr 2022 08:02:14 GMT

Thanks guys, yes I inadvertently posted the wrong graphic and the one above is correct- the question however is that I have indeed changed the link selection as show above to a my desired interface but the traffic when passing through does not pick up that interface as it's source address, it picks up a source address from another interface (which is not also not the main interface by the way).

Re: R81 VSX site to site vpn source interface

Wolfgang — Thu, 14 Apr 2022 19:48:33 GMT

You have to use the button „Source IP address settings…“ to configure your outgoing IP address.