topic SSL Webapp in SASE and Remote Access

SSL Webapp

SdanteMate — Wed, 12 May 2021 08:26:47 GMT

Dear mates

I create one webapp on ssl vpn. The thing is that I use the SSL VPN to connect on internal local but the host is on Azure that I have another site to site VPN with the internal net.

It seems that I can not access the webapp this way.

Can you assist me?

Thank you.

Re: SSL Webapp

PhoneBoy — Fri, 14 May 2021 22:10:59 GMT

So you're trying to access a web application from your gateway that is only available from a site-to-site VPN?
What are you connecting to at the other end of the VPN?
Is it configured to allow traffic from the gateway itself as a source (i.e. as part of the Encryption Domain or equivalent)?

Re: SSL Webapp

SdanteMate — Mon, 17 May 2021 05:44:55 GMT

Hi PhoneBoy, Thank you for the reply.

Yes, I'm trying to access through SSL vpn a host on azure that is connecting from a site-to-site.

It's machine that hosting a website.

Please note that with ipsec vpn, i can access the website.

Re: SSL Webapp

PhoneBoy — Mon, 17 May 2021 05:56:29 GMT

What is hosting the IPSec VPN at the Azure end?
And is it configured to allow encrypted traffic that originates from the gateway's external IP?

Re: SSL Webapp

SdanteMate — Mon, 17 May 2021 06:21:43 GMT

Yes, the VPN is hosting by the checkpoint appliance and the Azure virtual gateway object. Also i notice that when I'm trying to access the web from SSL VPN. I'm not getting any logs on my checpoint gw

Re: SSL Webapp

PhoneBoy — Mon, 17 May 2021 20:44:29 GMT

The connection is probably being allowed from the gateway itself via an implied rule.
However, the remote end must be explicitly configured to allow a connection from the gateway's external IP.
I don't remember what they refer to it as on the Azure side, but it would be equivalent to the Encryption Domain on the Check Point side.
Although this would not be required on the Check Point side since the gateway IPs are always included in the Encryption Domain without explicitly being configured.