topic Re: VPN on Proxy ARP IP Address in General Topics

VPN on Proxy ARP IP Address

Kurt_Abela — Thu, 09 Nov 2017 15:31:21 GMT

Dear all,

Is it possible to setup a site to site VPN tunnel with a proxied IP address (proxy arp)? i.e. an address which is not on the physical interface?

Thanks,

Re: VPN on Proxy ARP IP Address

PhoneBoy — Fri, 10 Nov 2017 01:23:01 GMT

Yes.

From the R80.10 Site-to-Site VPN docs:

There are several methods that can determine how remote peers resolve the IP address of the local Security Gateway. These settings are configured in Security Gateway Properties > IPsec VPN > Link Selection. Remote peers can connect to the local Security Gateway with these settings.
Always Use This IP Address:
Configure a certain IP address that is always used. The options are:
Main address - The VPN tunnel is created with the Security Gateway main IP address, specified in the IP Address field on the General Properties page of the Security Gateway.
Selected address from topology table - The VPN tunnel is created with the Security Gateway using a selected IP address chosen from the drop down menu that lists the IP addresses configured in the Topology page of the Security Gateway.
Statically NATed IP - The VPN tunnel is created using a NATed IP address. This address is not required to be listed in the topology tab.

That last option is what you're surely looking for.

Re: VPN on Proxy ARP IP Address

Kurt_Abela — Fri, 17 Nov 2017 07:45:32 GMT

Many Thanks for your reply. The issue we have is that we already have VPN tunnels on addresses from the topology table and we need a new VPN tunnel on a routed IP (not in topology). I think these are mutually exclusive.

Re: VPN on Proxy ARP IP Address

PhoneBoy — Fri, 17 Nov 2017 17:07:21 GMT

Since this is a per-gateway setting (not a per-tunnel setting), I believe you are correct.

The way you would meet this requirement today would be using Virtual Systems (VSX).

You would have a VS (basically a virtual gateway) that has the configuration you desire.

This VS could enforce the same or different policy, depending on your requirements.

Re: VPN on Proxy ARP IP Address

Kurt_Abela — Thu, 23 Nov 2017 22:48:30 GMT

Thanks for your suggestions.

We have natted internet traffic behind another public ip as a workaround to the issue.