topic Re: Multiple WAN IP for IPSEC in Firewall and Security Management

Multiple WAN IP for IPSEC

nycc3883 — Fri, 21 Feb 2020 14:11:36 GMT

I have 5 public static IP.

1 IP attach cluster, 2 IP attach each member.

Remaining 2 IP, i would like to use it as IPsec to serve as primary and secondary.

Is it possible? Please advise

Re: Multiple WAN IP for IPSEC

Maarten_Sjouw — Fri, 21 Feb 2020 21:50:15 GMT

Where would you want to assign those extra IP's?
When the Cluster is running the VPN's you use the cluster IP to terminate the VPN on and the 2 members will utilize that IP whenever they are the active member.

Re: Multiple WAN IP for IPSEC

FedericoMeiners — Sat, 22 Feb 2020 00:38:06 GMT

Can you tell us what's your use case?

In other words: What are you trying to achieve by having two IPs from the same prefix and same ISP for IPSEC VPNs?

Re: Multiple WAN IP for IPSEC

nycc3883 — Sat, 22 Feb 2020 01:14:15 GMT

What i want to achieve is, in my environment i have separate entity company.

They are using the same Infra, but the network inside are separated, not communication with each other.

So for this, i would like to also separate the public ip that the user from external point to them.

For example,:

User from company A point to this public ip to access their company resources

User from company B point to a different public ip than company A to access their company resources.

Re: Multiple WAN IP for IPSEC

nycc3883 — Sat, 22 Feb 2020 01:16:03 GMT

Yeah, this is one of the thing which i want to know, is there anywhere that i can attach these public ip.

Re: Multiple WAN IP for IPSEC

PhoneBoy — Sat, 22 Feb 2020 01:23:35 GMT

Pretty sure you can't do what you're describing without using VSX on your gateways.
Each company would have its own VS (virtual system, i.e. firewall) each with its own access policy and public IP.

Re: Multiple WAN IP for IPSEC

nycc3883 — Sat, 22 Feb 2020 01:51:11 GMT

I thought so too.

Just verifying whether is there alternative solution to these as the support is taking long time to assist on troubleshooting.

Re: Multiple WAN IP for IPSEC

Danzaroonie — Tue, 25 Feb 2020 10:59:22 GMT

Might be able to use Gaia Policy-Based routing...(just a thought)

You can define x2 default routes for ISPA and ISPB, However you still need to define the cluster topology information correctly.

The Policy-Based routing table will also have to be manually defined for each connected network. (bit of a pain if you have a few).

As an example...(I have done this for a customer that wanted a DMZ routed out a specific ISP, so can't see why this would not work in the same manner)

Client A - 10.100.0.0/24 would always route out of ISPA

Client B - 10.200.0.0/24 would always route out of ISPB

regards

Dan

Re: Multiple WAN IP for IPSEC

nycc3883 — Wed, 26 Feb 2020 14:58:40 GMT

Thanks for the sharing.

Will explore on this.

Re: Multiple WAN IP for IPSEC

Chris_Hoff — Thu, 05 Mar 2020 21:50:44 GMT

I would have to agree with Phoneboy that if you are wanting to keep them isolated, you would need to utilize VSX. Beyond the issue of IPs/Isolation, how are you planning to authenticate the users (I am assuming remote access based on your "user" verbiage above)? With a single Gateway/cluster, you are not going to be able to use different authentication methods.

Are you planning to use the Mobile Access Blade (i.e. SSL VPN)? Or are you planning to use the Endpoint Client?