Identity propagation ClusterXl members

[akurtasanov]

It became necessary to establish a connection between PDP and PEP in Identity Sharing mode from the interfaces of ClusterXL members. In short, the analogue of the cause of sk63264.
Is it possible?
The need is that some of the equipment must work via Route-Based IPsec, and, as it turned out, NAT is not possible with vti/vpnt.
Maybe there is an option to set a source IP to establish a connection?

[emmap]

You want to change the IP address being used for ID sharing? We can do that: https://support.checkpoint.com/results/sk/sk60701

[akurtasanov]

I saw this SK. Ithink It doesn't quite fit. The following is required.
There is an Identity Sharing Gateway.
A cluster with a VIP main IP of 172.21.56.1 connects to it. NAT is created. When accessing through regular interfaces via the backup ethxx channel, everything is fine. But when accessing via IPsec, the traffic doesn't follow the NAT rule. Traffic from the VPN simply ignores the NAT and goes from the VPN's src IP (let's say 192.168.1.1 ClusterMemberA, 192.168.1.2 ClusterMemberB). And the output I get is the situation described in sk63264 - Identity Sharing GW with two Incoming sessions from 192.168.1.1 and 192.168.1.2.

[emmap]

Does your VTI have a VIP configured in SmartConsole?

[akurtasanov]

Yes. Explicit Hide rule. NAT doesn't work.

There is a backup plan to simply connect directly to the collector becasue it initiates connection, but I would like to try to make the current configuration work.

[emmap]

This might be a job for TAC, I don't have the setup to test this at the moment. I'm not aware of any reason why it should or should not work but I also haven't tried it before.

[akurtasanov]

According to latest tests, R82.10 supports NAT for vpnt interfaces. But tested only single device.