topic Re: fwrl.conf & ipasssignment.conf in SASE and Remote Access

fwrl.conf & ipasssignment.conf

lukaszfatyga — Tue, 11 Apr 2023 14:43:41 GMT

I use the fwrl.conf file to push the ttm file from MDS to the gateways. Probably, I will have to start using the ipasssignment.conf file, keeping it separate on 8 gateways will be a nightmare. I thought maybe fwrl.conf would help me keep this file centrally.

Does anyone know if this will work?

And other thing - I have 8 gateways in the community for remote access. If I need to assign a specific IP subnet to a group of users, I actually need 8 of them, for each gateway separately. It's a terrible waste of addressing.

Can it be done smarter?

Re: fwrl.conf & ipasssignment.conf

Chris_Atkinson — Wed, 12 Apr 2023 13:32:32 GMT

Have you considered using Radius?

sk43857: How to configure RADIUS to assign Office Mode IP addresses

Re: fwrl.conf & ipasssignment.conf

lukaszfatyga — Wed, 12 Apr 2023 13:42:36 GMT

We use SAML for authentication.

If we have multiple gateways in the community, what about the routing issue then? The address assigned by RADIUS may appear on different gateways. Is there an option to advertise /32 client routes?

Re: fwrl.conf & ipasssignment.conf

Chris_Atkinson — Wed, 12 Apr 2023 14:35:30 GMT

Despite the name NAT Pools are one option to help simplify the routing of networks associated with specific gateways, refer:

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Gaia_Advanced_Routing_AdminGuide/Topics-GARG/NAT-Pools.htm