topic Route VPN users through gateway for specific external sites only in SASE and Remote Access

Route VPN users through gateway for specific external sites only

albertcuy — Wed, 21 Apr 2021 23:57:54 GMT

Good day everyone,

Hope everybody is keeping safe and healthy.

So aside from access to our internal systems, our users also need access to external sites for research. These sites restrict access to our campus public IPs, so somehow i need to add specific routes on the VPN client side to do this.

Can anyone point me to the right documentation? i've added external sites to the VPN domain(even though i'm not sure if this is wise). i've checked that routes indeed have been added to the client's routing table, and i've verified that traffic from VPN client -> external site is being allowed through...but it still doesn't work. Is there anything else i need to check/do ?

Thanks

Re: Route VPN users through gateway for specific external sites only

PhoneBoy — Thu, 22 Apr 2021 05:26:01 GMT

I presume you need some NAT rules in place for this.
Have you configured that?

Re: Route VPN users through gateway for specific external sites only

albertcuy — Thu, 22 Apr 2021 06:02:58 GMT

Yes sir. i enabled the automatic NAT rules for the whole VPN subnet. But i don't see the NAT'ing in the logs.

Re: Route VPN users through gateway for specific external sites only

PhoneBoy — Thu, 22 Apr 2021 06:33:14 GMT

I presume you did it this way:

Configure NAT for the Office Mode network:

In SmartDashboard, open the Office Mode network properties.
Go to "NAT" tab.
Check the box "Add Automatic Address Translation rules".
In "Translation method" field, select "Hide" and then select "Hide behind Gateway".
Click on 'OK'.

Re: Route VPN users through gateway for specific external sites only

albertcuy — Thu, 22 Apr 2021 06:36:15 GMT

Yes sir, exactly like that 😀

Re: Route VPN users through gateway for specific external sites only

PhoneBoy — Thu, 22 Apr 2021 06:38:23 GMT

What version/JHF level?
Seems like it might be a bug since many customers use a similar configuration (albeit using "Route All Traffic").