topic SDL with location awareness in SASE and Remote Access

SDL with location awareness

rlamerico — Wed, 25 Aug 2021 21:18:52 GMT

I am working on a specific requirement with Endpoint security VPN E84.40 clients. I read the admin guide in order to enable SDL and location awareness (Global properties>Endpoint connect). It contains a group with our internal IP addresses.

SDL is enabled on the client. Now when these users connect over an external network the SDL pops up which is good. But when the user comes into office the client pops up to connect on VPN again, as I understand client need to recognize that host is in a internal network and give a bypass on VPN client.

I have a network with many locations linked by MPLS links and this problem happens just in locations connected on my Datacenter by MPLS, when I connect directly on my LAN on my DataCenter it no happen.

I raised a ticket with CP TAC and receive the answer that is necessary to be connected directly on the same network than my gateway, but it is not clear for me, because my locations is connected by MPLS but have access to firewall directly.

Maybe there is a configuration missing in some point.

Re: SDL with location awareness

PhoneBoy — Wed, 25 Aug 2021 21:26:04 GMT

What settings are you using?

Re: SDL with location awareness

rlamerico — Sat, 28 Aug 2021 17:44:58 GMT

Hi PhoneBoy,

I have enabled the SDL on my client and configure "network location awareness" with my network range 10.0.0.0/8.

Re: SDL with location awareness

PhoneBoy — Sun, 29 Aug 2021 00:10:09 GMT

In the remote sites, it is connecting to the gateway via the internal interface or via the external interface?

Re: SDL with location awareness

rlamerico — Mon, 30 Aug 2021 14:45:16 GMT

Hi PhoneBoy,
In remote sites, we have an MPLS connecting with my DataCenter, in this case we are connecting with the internal interface, but I don´t have a specific configuration for that, on my client, I just configure my external IP when creating a profile.

The only configuration that I have to inform what is my internal LAN is on "location awareness".

Re: SDL with location awareness

PhoneBoy — Mon, 30 Aug 2021 15:16:57 GMT

Have you confirmed traffic to the gateway's external IP is in fact traversing the MPLS?

Re: SDL with location awareness

rlamerico — Tue, 31 Aug 2021 02:38:01 GMT

Yes, in this case, the client can´t reach the gateway´s external IP and it is correct because he is on my LAN, in my mind the client when connected on the first time on VPN need to receive the topology and the information about my internal range and based on this information don´t request to connect when receive one ip from my internal range.