Cloudguard AWS -endpoint security remote access vpn address pool

[Cathy_Cheng]

We have deployed a CloudGuard cluster across multiple AWS Availability Zones in HA mode and are planning to enable Endpoint Remote Access VPN. The CloudGuard gateway will assign DHCP IP addresses to VPN clients.

1. The DHCP pool does not belong to any AWS VPC CIDR range. It is a local subnet in the cloudguard gateway. Is it correct ?

2. Other VPCs will route traffic destined for the VPN client pool  to the CloudGuard VPC, and then the CloudGuard VPC route table set up to route traffic destined for the VPN client IP pool to the active member ENI. Is it correct ? 

Thanks in advance for any response 

[Nir_Shamir · Accepted solution]

when you say "DHCP IP addresses" you mean the local office mode ip addresses or are you actually using a DHCP Server to assign IP addresses ?

the local office mode ip addresses pool are ip addresses assigned by the GW to the clients and it is local to the GW's.

Regarding the route you are correct, you need to return the traffic toward the remote access clients towards the GW, unless you are hiding them behind the GW using NAT.