topic Re: Remote access clients receiving routes not in remote access encryption domain in SASE and Remote Access

Remote access clients receiving routes not in remote access encryption domain

chuka — Tue, 12 May 2020 12:36:38 GMT

Hello everyone,

we are running an environment with 2 clusters MEP R 80.1 internet gateways offering remote access connectivity via Endpoint Connect and SNX.

We started having an issue which i find strange, Normally when clients connect via remote access, they obtain office mode IPs and the networks on the remote access encryption domain are published to the clients routing table.

However, what we have seen is clients routing table getting populated with IP's that are not part of the remote access encryption domain, including whole public ip ranges like 12.0.0.0/16. These additional routes are dropped at the gateway because they are not part of the remote access encryption domain.

This has led many remote access users not being able to access the internet resources while connected via remote access.

If any one have experienced this kind of issue and how to resolve.

Re: Remote access clients receiving routes not in remote access encryption domain

Wolfgang — Tue, 12 May 2020 13:01:17 GMT

Are you sure you‘re using the remote access encryption domain? Maybee something changed and you use too the normal encryption domain for remote access.

Are the routes on the clients only shown If connected ?
Wolfgang

Re: Remote access clients receiving routes not in remote access encryption domain

G_W_Albrecht — Tue, 12 May 2020 13:16:39 GMT

Looks like a MEP missconfiguration issue - see sk105638, sk92676, sk42164...

Re: Remote access clients receiving routes not in remote access encryption domain

chuka — Fri, 22 May 2020 11:50:15 GMT

Hi Wolfgang,

The routes on the client only show when connected, yes.