topic Re: Vpn remote acces mab agains cluster with only private addres in SASE and Remote Access

Vpn remote acces mab agains cluster with only private addres

ERTK — Mon, 17 Jan 2022 13:13:59 GMT

Hi,

A customer had a cluster only with private range addres.

On this cluster it had configured vpn remote acces making Nat on isp provider.

Recently they need to move Nat from isp to this cluster....but client cannot reach.

Is it possible to make than this cluster make also this kind of Nat ( public interface is not configure on this cluster but isp provider route one public ip address for.thqt purpose)?

Re: Vpn remote acces mab agains cluster with only private addres

G_W_Albrecht — Mon, 17 Jan 2022 13:44:07 GMT

If the ISP routes a public IP to a cluster, the cluster needs a WAN interface with that public IP that also should be part of the Remote Access community.

Re: Vpn remote acces mab agains cluster with only private addres

ERTK — Mon, 17 Jan 2022 13:56:19 GMT

i understand. maybe creating an cluster interface with this public ip address like vip.....and configuring rules and vpn link selecction could it be.

Re: Vpn remote acces mab agains cluster with only private addres

G_W_Albrecht — Mon, 17 Jan 2022 14:10:58 GMT

Otherwise, the cluster will not feel responsible for this public IP...

Re: Vpn remote acces mab agains cluster with only private addres

ERTK — Mon, 17 Jan 2022 14:18:30 GMT

I just create a dummy cluster interface with this public ip address like via pf this dummy....it is a internal interface..it means than the traffic must in for current transport interface between isp provider and this cluster.

Vpn client connect but...after a few minutes it disconnect

Re: Vpn remote acces mab agains cluster with only private addres

G_W_Albrecht — Mon, 17 Jan 2022 14:39:33 GMT

Afaik this can not work with an internal interface. Look into GW and RA client logs to see the reason the connection is lost!

Re: Vpn remote acces mab agains cluster with only private addres

ERTK — Mon, 17 Jan 2022 14:44:48 GMT

sorry, the topology interface config like an external....i want to say that this interface is behind firewall in flow....

Re: Vpn remote acces mab agains cluster with only private addres

G_W_Albrecht — Mon, 17 Jan 2022 14:53:58 GMT

Should be the external/WAN VIP interface of the cluster according to Remote Access Admin Guide. I would suggest to contact TAC as there may be a special config making this possible.

Re: Vpn remote acces mab agains cluster with only private addres

ERTK — Mon, 17 Jan 2022 15:10:31 GMT

i'll do. Thanks