topic Re: IP assignment for remote VPN in Firewall and Security Management

IP assignment for remote VPN

Leonardo_Tessar — Mon, 22 Apr 2019 12:06:14 GMT

Hello,

I would like to assign an IP address to a user connected to remote VPN.

I've edited the $FWDIR/conf/ipassignment.conf file with below syntax and installed the security policy but it's not working.

GWIPADDR addr 192.168.99.250, dns=(10.1.1.1,10.1.1.2) user1

The IP address 192.168.99.250 is outside of my OM IP Pool (192.168.98.0/24)

I've checked the syntax with the command "vpn ipafile_check" and it seems correct:

line 0065 is OK. User="user1"

But the user keep getting an IP from my OM IP Pool instead of the specified IP address.

Here is the config on the cluster:

Any suggestion to solve my issue?

Thank you!

Re: IP assignment for remote VPN

Maarten_Sjouw — Mon, 22 Apr 2019 20:59:46 GMT

To my knowledge you cannot assign an IP outside the OM range.

Re: IP assignment for remote VPN

Leonardo_Tessar — Mon, 22 Apr 2019 21:06:14 GMT

Initially I had assigned an IP of the OM range, then I read that the IP had to be external to the pool and so I changed it.
But the behavior is the same on both cases.

Btw I'm working on R80.20, was anyone else able to make this configuration work on this release?

Re: IP assignment for remote VPN

Andreas_Aust — Tue, 23 Apr 2019 08:17:07 GMT

Did you install the policy after editing ipassignment.conf ?

Re: IP assignment for remote VPN

Timothy_Hall — Wed, 24 Apr 2019 01:53:25 GMT

Instead of the GWIPADDR, try using the name of the firewall object instead, install policy and try again. Note that if it is a cluster, it must be the name of the firewall object, not the cluster object.

Re: IP assignment for remote VPN

Leonardo_Tessar — Wed, 24 Apr 2019 11:56:01 GMT

Of course I've installed the policies.

Re: IP assignment for remote VPN

Leonardo_Tessar — Wed, 24 Apr 2019 12:00:06 GMT

I've already tried different combo, including the name of the Security GW instead of the IP address, but nothing changed.

Yes, I used the firewall object name and not the cluster object.

Re: IP assignment for remote VPN

Leonardo_Tessar — Thu, 30 May 2019 19:14:28 GMT

The issue was related to spacing.

It's mandatory to use tabs between fields, if you use spaces the config will be ignored.