topic Access to ipsec resources from remoteaccess users in SASE and Remote Access

Access to ipsec resources from remoteaccess users

c5d51d79-b177-4 — Thu, 17 Jun 2021 07:29:14 GMT

Hello,

I would like to allow my users to access resources located behind an ipsec tunnel with one of our clients but i don't understand how to do this.

I work with a gateway 3000 appliances in version 80.40 and a management appliance in 80.40 also.

What i want to do is allow flow like this :

RemoteAccess users --> 3000 appliances --> ipsec tunnel --> Clients

A very big thank you to those who can help me !

Re: Access to ipsec resources from remoteaccess users

PhoneBoy — Thu, 17 Jun 2021 16:16:49 GMT

The Remote Access encryption domain must include the encryption domain of the remote site.
If you are not using Office Mode for Remote Access clients. you will also need to configure IP Pool NAT.

Re: Access to ipsec resources from remoteaccess users

c5d51d79-b177-4 — Tue, 22 Jun 2021 10:17:35 GMT

a big thank you for your feedback !

just to be sure of the manipulation, is it about adding the remote client's encryption domain to this encryption domain ?

Re: Access to ipsec resources from remoteaccess users

PhoneBoy — Tue, 22 Jun 2021 14:35:05 GMT

I'm referring specifically to this:

For your regular VPN gateway, ensure the Office Mode address space is included in the encryption domain.
Your partner will need to ensure the Office Mode address space is included as part of their definition of your encryption domain.

Re: Access to ipsec resources from remoteaccess users

the_rock — Tue, 22 Jun 2021 14:43:59 GMT

Not exactly...what phoneboy is referring to is what I attached in the screenshot. Make sure that firewall is part of remote access community, save, then edit the object and apply the changes as per photo attached. Though, you could also do it from that window as well that you showed.

Re: Access to ipsec resources from remoteaccess users

the_rock — Tue, 22 Jun 2021 14:45:11 GMT

Sorry, my apologies, I see that firewall is indeed part of RA community, so your answer is definitely correct, you can do it that way too.