VPN to allow remote branch accessing Internet through central GW

[DR_74]

Hello,

We have the following setup:

2 R80.10 clusters managed by a R80.10 SmartCenter

A VPN is established between the 2 clusters

The VPN community allows only VPN domains defined behind each Firewall.

How can we reconfigure it so that the remote branch can access the corporate LAN AND also be routed to the Internet through the Central FW?

Regards

[G_W_Albrecht · Accepted solution]

1: Change VPN community to star topology

2. Set main GW to Center GW

3. Add peer as satellite GW

4. Enable VPN Routing with option To center, or through the center to other satellites, to internet and other VPN targets. Use VPN routing for every connection a satellite gateway handles. Packets sent by a satellite gateway pass through the VPN tunnel to the central gateway before being routed to the destination address.

[Will_Hargreaves]

Is it possible to ENFORCE remote access users to break out to the internet only through the VPN to their corporate LAN, and deny them internet access when they are not connected to the VPN? (except for allowing the minimum necessary internet access to establish the VPN).

[mdjmcnally]

Not sure why posted this onto this as surely a different question,

Whilst you can enable Hub Mode and enforce it so that when connected to the Remote Access VPN then forces you to go via the VPN, it won't block access to the Internet when not on the VPN.

Possibly with the Endpoint Suite and the Connected/Disconnected Policy then on the Disconnected Policy then could block access to the Internet and just access to the Gateway, and DNS, DHCP etc.   Make sure that HotSpot is enabled so can authenticate as well to Wifi if neccessary.

That way when out of the Office forces the Client to hookup the VPN to get anywhere