topic Re: disable vpn client from updating the site ip address in SASE and Remote Access

disable vpn client from updating the site ip address

Dor_Marcovitch — Mon, 13 Dec 2021 09:17:04 GMT

hey,

how can i disable the client from updating the gateway ip on the vpn site once it connects to the gateway ?

Re: disable vpn client from updating the site ip address

G_W_Albrecht — Mon, 13 Dec 2021 11:28:37 GMT

Why would you have to do this ? Is the client unwilling to work over RA VPN and boycotts it by changing the site IP ? I would just sack em...

Re: disable vpn client from updating the site ip address

Dor_Marcovitch — Mon, 13 Dec 2021 18:23:50 GMT

we have multiple APNs configured as External Interface, and event one with VIP on different subnet, what happens is that the client update the GW IP to one of the APN that the SIM of the client does not belongs to.

one time i even got the "private ip" of the interface with the VIP on different subnet.

VPN Clients comes only from one APN to one VIP of the FW so i want to harden this configuration.

Re: disable vpn client from updating the site ip address

RS_Daniel — Mon, 13 Dec 2021 18:33:47 GMT

Hello,

Try using that APN VIP on remote access link selection config:

Configuring VPN Link Selection for Remote Access client (checkpoint.com)

Regards

Re: disable vpn client from updating the site ip address

Dor_Marcovitch — Sat, 18 Dec 2021 19:58:36 GMT

thanks, this is what i was looking for, i will try this configuration