topic Re: Static IP ipassignment.conf. How not to assign the static set ones to other people. in SASE and Remote Access

Static IP ipassignment.conf. How not to assign the static set ones to other people.

Mike_Hempel — Wed, 27 May 2020 13:31:22 GMT

If I use $FWDIR/conf/ipassignment.conf to assign a static ip how do I get it to not assign it to someone else? I set my static ip as

* addr 172.16.1.10 TESTUSER

But I went to sign in the next day and it couldn’t assign me the ip because someone had it already. The entire 172.16.1.0 subnet is assigned to the VPN office mode VPN _group. I’d like to assign about 20 clients Static IP’s.

Would I control it all via ipassignment and just assign any a range excluding the 20 I need and assig?

* range 172.16.1.21-172.16.1.254/24 VPN_GROUP

* addr 172.16.1.10 TESTUSER

* addr 172.16.1.2 user2

* addr 172.16.1.3 user3

Also if I have mutliptle groups say VPN_GROUP and VPN_GROUP2 that grab from the same IP range can I just do multiple lines to that range.

EG:
* range 172.16.1.21-172.16.1.254/24 VPN_GROUP

* range 172.16.1.21-172.16.1.254/24 VPN_GROUP2

Re: Static IP ipassignment.conf. How not to assign the static set ones to other people.

PhoneBoy — Wed, 27 May 2020 00:09:21 GMT

What you describe sounds correct.
If you want to be sure no one else is assigned a static IP then it cannot be part of a pool.
Multiple groups can use the same pool.

Re: Static IP ipassignment.conf. How not to assign the static set ones to other people.

Mike_Hempel — Wed, 27 May 2020 13:30:23 GMT

Thanks for the confirmation!

1 more question. If I where to assign USER1 a static IP but that use is also apart of VPN_GROUP. is there an order of operation? Like put Static IP users first in the list?

Re: Static IP ipassignment.conf. How not to assign the static set ones to other people.

Hrvoje_Brlek — Tue, 07 Dec 2021 08:50:13 GMT

Hi,

I have the same question, if someone can just confirm 🙂

So basically we have a VPN pool of 10.10.40.0/21 and 4 different AD groups to have the IPs assigned. The pool is defined in the gateway properties as the object for the VPN pool in Office mode (manual) and also the ipassignment.conf is checked. We need to distribute a subnet of 24 to just one group (AD_group_4) and all other AD groups to share the rest of the IP pool.

(I know that sk116603 states that "The Office Mode IP addresses pool contains some or all IP addresses for specific users in $FWDIR/conf/ipassignment.conf.", but unfortunately I do not have the possibility to add another pool for specific static users, I need to use the same pool).

Can I use the ipassignment.conf configuration as follows:

VPN_GW range 10.10.40.1-10.10.46.254/21 AD_group_1
VPN_GW range 10.10.40.1-10.10.46.254/21 AD_group_2
VPN_GW range 10.10.40.1-10.10.46.254/21 AD_group_3
VPN_GW range 10.10.47.1-10.10.47.254/24 AD_group_4

Will it work fine, is there a possibility that AD groups 1,2 and 3 will try to overwrite each other or will not be able to get the IP address?