topic Re: SecureRemote site address rewriting in SASE and Remote Access

SecureRemote site address rewriting

Libor_Kovar — Thu, 07 Feb 2019 12:36:41 GMT

Hello,

could you comment on this strange behavior ?

When I create remote site, I can connect for the first time and it works fine.

When I try to connect second time, it is not possible, as the site's IP is rewritten with the internal IP of itself.

SecuRemote 80.90, gate cluster 80.10

Many thanks

Re: SecureRemote site address rewriting

PhoneBoy — Fri, 08 Feb 2019 21:58:45 GMT

Is the gateway behind NAT or is it picking, say, a different (non-external) IP on the gateway?

Re: SecureRemote site address rewriting

Netanel_Cohen — Sun, 10 Feb 2019 13:33:18 GMT

This might happen due to wrong 'link selection' configurations.

The default configuration is to use the 'Main address' as the site's IP address for VPN connections.

The 'Main address' is the IP configured in the 'General Properties' tab of the GW\Cluster object.

In case the GW is behind NAT as Demeon suggested or in case the 'Main address' is not the external interface, you need to modify the 'Link Selection' configurations accordingly.

Please note that by default the 'Link Selection' configurations take effect for both RA and Site-to-Site VPN connections.

Re: SecureRemote site address rewriting

Libor_Kovar — Fri, 22 Feb 2019 11:54:52 GMT

Thanks for the reply and sorry for the delay (vacations)

The GW cluster public address is not behind the NAT .

It is defined as usually, but the Securemote client is picking the internal IP address of the cluster.

Cluster address in „general properties“ is really the internal one.

I hesitate to change it to public because of licenses, Site-to-site VPN and other stuff, as I don’t know the side effects.

Is there any other option to rectify this situation ? Hopefully, something what involves RAS VPN only ?

Many thanks

Re: SecureRemote site address rewriting

Libor_Kovar — Fri, 22 Feb 2019 12:02:39 GMT

Thanks for the reply and sorry for the delay , too.

The GW cluster public address is not behind the NAT .

It is defined as usually, but the SecuRemote client is picking the internal IP address of the cluster.

Cluster address in „general properties“ is really the internal one, but in IPSec VPN Link selection section is chosen to always use the "selected address from topology table" with the value of external cluster address, not the "Main address"

Re: SecureRemote site address rewriting

Libor_Kovar — Fri, 22 Feb 2019 12:10:02 GMT

Addendum: On the same page is following option ... link selection - source IP address Settings

Could it help if I change it accordingly as above, could it disturb the Site-toSite VPN's ?

Firewall is in production !

Re: SecureRemote site address rewriting

PhoneBoy — Fri, 22 Feb 2019 13:56:06 GMT

Link Selection setting impacts Remote Access and Site-to-Site VPNs.