topic Re: Remote Access VPN Interface selection in General Topics

Remote Access VPN Interface selection

nemezis_rock — Wed, 27 Nov 2024 10:17:53 GMT

Hi all,

I have two GWs in Cluster.

Here are its external interfaces:
1. Internet - with white IP 8.8.8.8 (for example purposes);
2. Private network - with IP 10.10.10.10 (for example purposes).

At the moment the 2nd network's topology setted up as Internal. When I change topology to External, remote users starts connect to those External interfaces with private addresses.

VPN clients connect to domain myvpn.mydomain.com - its IP adress is 8.8.8.8, and client application CP Endpoint Security shows:

Site: myvpn.mydomain.com
IP Address: 10.10.10.10 (instead of 8.8.8.8)
And fails to connect to that private address.

IP Selection by Remote Peer setted up as Calculate IP based on topology.

Can anyone help with that?
Thanks in advance.

Re: Remote Access VPN Interface selection

G_W_Albrecht — Wed, 27 Nov 2024 10:50:09 GMT

Why would you set topology to external if it is not external and not facing the internet?

Re: Remote Access VPN Interface selection

nemezis_rock — Wed, 27 Nov 2024 10:57:20 GMT

Because it is actually an External network - L2 VPN. It is not local network but network between group of organizations.

Re: Remote Access VPN Interface selection

nemezis_rock — Wed, 27 Nov 2024 11:00:57 GMT

I have some IPSec tunnels in that private external network. And also have Remote access community for VPN from internet.

Re: Remote Access VPN Interface selection

AkosBakos — Wed, 27 Nov 2024 11:03:04 GMT

Have you try to use "link selection" here:

Re: Remote Access VPN Interface selection

nemezis_rock — Wed, 27 Nov 2024 11:17:59 GMT

Will this affect on all IPSec tunnels or only for RA VPN users?

Re: Remote Access VPN Interface selection

AkosBakos — Wed, 27 Nov 2024 11:24:29 GMT

Yes, so be careful.

What is set here?

Re: Remote Access VPN Interface selection

nemezis_rock — Wed, 27 Nov 2024 11:48:05 GMT

IP Selection by Remote Peer setted up as Calculate IP based on topology.

Re: Remote Access VPN Interface selection

G_W_Albrecht — Wed, 27 Nov 2024 12:47:21 GMT

Better open SR# with CP TAC for this configuration !

Re: Remote Access VPN Interface selection

Wolfgang — Wed, 27 Nov 2024 13:10:30 GMT

@nemezis_rock You can configure link selection for remote access independent from site2site VPN via sk32229 - Configuring VPN Link Selection for Remote Access client