topic Re: SecuRemote with IP Pool NAT in SASE and Remote Access

SecuRemote with IP Pool NAT

Thorsten_Kowalc — Mon, 29 Oct 2018 14:01:10 GMT

Hi Folks, I'm sitting here and the old #SecuRemote with R80.10 driving me crazy. I have configured IP Pool NAT in my R80.10 Cluster.

In 77.30 this was working properly. Since R80.10 it is not working any longer and I get IP's from a DHCP Server somewhere in the wild from my net. Do you have any ideas? How to get my IP Pool back?

Just for info, we just using the free SecuRemote licences.

Regards

Re: SecuRemote with IP Pool NAT

PhoneBoy — Sat, 03 Nov 2018 07:20:36 GMT

Office Mode is not supported with the SecuRemote client.

The fact it worked in R77.30 could be considered a bug.

Re: SecuRemote with IP Pool NAT

Matthias_Haas — Thu, 20 Dec 2018 12:16:34 GMT

Hi Thorsten,

I guess it is no longer relevant, but your screenshot does not show the IP Pool-NAT settings, should be this Tab :

I have tested it with R80 a while ago and it was still working

Matthias

Re: SecuRemote with IP Pool NAT

I_Santos — Fri, 19 Nov 2021 18:03:06 GMT

I know it has been a long time since this post last update, but I'm facing the same situation. I can't use the IP Pool NAT, even when I've set the network at the right location (image below). It is really like there is a DHCP server somewhere providing addresses that even are configured on the firewalls.

Someone knows how to implement this feature with SecuRemote?

OBS: I have read the article from @PhoneBoy about the use with SecuRemote (Quick Primer on How to Configure your Gateway for SecuRemote) but I think I'm missing something.

Re: SecuRemote with IP Pool NAT

PhoneBoy — Fri, 19 Nov 2021 18:15:41 GMT

DHCP implies Office Mode, which SecuRemote does not provide.
That means DHCP is irrelevant, you can only use IP Pool NAT.
Each client will have something like a 192.168.0.1 assigned to it on the client itself.

Re: SecuRemote with IP Pool NAT

I_Santos — Fri, 19 Nov 2021 18:49:33 GMT

Thanks for replying @PhoneBoy.

In my case, the SecuRemote client is getting a 10.8.220.0/24 network, which is not part of the topology, but I have one network object with this range. I can see new routes from the gateway VPN domain, and the output of "route print" points this routes to an IP of 10.8.220.0/24 range.

Can I state that if I am using SecuRemote I need to see the IP Pool NAT address range at the client?

Re: SecuRemote with IP Pool NAT

PhoneBoy — Fri, 19 Nov 2021 19:12:57 GMT

Some IP address must be assigned to the client in order to route traffic for the relevant subnets through the Remote Access VPN interface.
In the case of Office Mode, we use the IP address assigned as part of that process.
For SecuRemote, we choose a subnet that doesn't conflict (it varies), and it probably won't be the subnet configured for IP Pool NAT.

Re: SecuRemote with IP Pool NAT

I_Santos — Fri, 19 Nov 2021 19:25:50 GMT

For SecuRemote, we choose a subnet that doesn't conflict (it varies), and it probably won't be the subnet configured for IP Pool NAT.

So, can I assume that it is not user defined?

Sorry to stick on this, but I'm struggling to configure firewall rules and access from SecuRemote traffic. Can you give an example of how can I point my rules and routes to manage the SecuRemote incoming traffic?

Re: SecuRemote with IP Pool NAT

PhoneBoy — Sat, 20 Nov 2021 00:30:11 GMT

Incoming from what: the SecuRemote client?
The primer you linked to previously should cover that.

Incoming traffic to the SecuRemote clients aren't supported.
That requires Office Mode, which is not supported with SecuRemote.