topic MGMT IP address not accessible via RA VPN in SASE and Remote Access

MGMT IP address not accessible via RA VPN

AlexandruD — Tue, 10 Oct 2023 15:02:52 GMT

Hello,

Anyone knows why a security gateway would exclude its management IP address out of the RA VPN client's routing table?

Case in point, the RA VPN community encryption domain includes the whole 10.0.0.0/8 subnet, yet the 10.0.0.X IP address, which is the management IP address of the security gateway where the RA VPN is terminated, is not included in the connected RA VPN client's routing table. The RA VPN client is Check Point Mobile and uses IPsec to tunnel traffic.

Thank you

Re: MGMT IP address not accessible via RA VPN

the_rock — Tue, 10 Oct 2023 17:28:29 GMT

I just checked in one of customers' environments and works fine, no issues. Can you see what is output of route print from user's machine?

Andy

Re: MGMT IP address not accessible via RA VPN

AlexandruD — Tue, 10 Oct 2023 19:01:50 GMT

Hi Andy,

Here is a snippet of a connected RA VPN client's provisioned routes. You can see that the routes exclude the specific 10.0.0.252 IP address (which is the MGMT address of the security gateway) from the rest of the routes within the 10.0.0.0/8 prefix. I cannot find any specific configuration for this behavior via SmartConsole, perhaps there might be some parameter I could ajust directly in the DB.

Best regards,

Alexandru

Re: MGMT IP address not accessible via RA VPN

the_rock — Tue, 10 Oct 2023 19:12:21 GMT

I dont really see anything specific, below is just referred to dns when people log in via RA.

Andy

Re: MGMT IP address not accessible via RA VPN

PhoneBoy — Tue, 10 Oct 2023 21:00:22 GMT

Location Awareness enabled, perhaps?

Re: MGMT IP address not accessible via RA VPN

AlexandruD — Wed, 18 Oct 2023 19:19:57 GMT

Hello,

I finally got this working, it took a while for CP support to provide a fix, although a bit complicated for such a simple need:

- automatic MEP topology must be disabled oin the gateway, based on sk78180 (it already was disabled in my case)

- disable MEP topology retrieval in the VPN client's configuration, sk92676 (different than the default setting)

Best regards,

Alexandru

Re: MGMT IP address not accessible via RA VPN

the_rock — Wed, 18 Oct 2023 19:32:03 GMT

Thanks for the update! 👍