topic Re: VPN Access Rules in SASE and Remote Access

VPN Access Rules

Steve_Walker — Fri, 21 Mar 2025 20:06:40 GMT

We have a couple of users who access services based on the IP address of their VPN. However, they then can't access services as their local computer IP address, not the allowed address, is being seen by the firewall which then blocks them.

These users do not have a static local IP address.

I am not sure how to resolve this. Any thoughts?

Running R81.20

Thanks -

Steve

Re: VPN Access Rules

_Val_ — Mon, 24 Mar 2025 10:52:22 GMT

Just to clarify, they can establish a VPN tunnel but cannot access internal resources? Some additional information would be helpful. Are you using Office Mode? Do you see which rule is dropping the problematic traffic?

Re: VPN Access Rules

Steve_Walker — Mon, 24 Mar 2025 13:47:59 GMT

_Val_ -

Your comment "Do you see which rule is dropping the problematic traffic?" pointed me in a direction I missed on my original troubleshooting. The rule dropping the traffic is the cleanup rule.

I need to explore this further on my end.

Re: VPN Access Rules

the_rock — Mon, 24 Mar 2025 15:12:55 GMT

Hey Steve,

Just make sure rule to allow this is above clean up rule.

Andy

Re: VPN Access Rules

_Val_ — Mon, 24 Mar 2025 16:28:42 GMT

Sure, let us know if you need any additional assistance

Re: VPN Access Rules

the_rock — Mon, 24 Mar 2025 17:16:16 GMT

Hi Steve,

Not sure how many rules you have in the rulebase, but generally, at least my recommendation is always to create RA access rule towards the top, something like bwlow (example from my lab)

Andy

Re: VPN Access Rules

PhoneBoy — Mon, 24 Mar 2025 21:09:50 GMT

The thought that went through my mind is that the clients installed as SecuRemote...which would also cause this behavior.

Re: VPN Access Rules

AkosBakos — Tue, 25 Mar 2025 14:16:47 GMT

True, check the installed version of the VPN client on the affected endpoints.