Issue using Machine based Access Roles with Office Mode/Remote Access VPN

[Nocky24]

We have an R80.10 Azure based Gateway Cluster with Identity Awareness/AD Query and Mobile Access Office Mode enabled. User based access roles (e.g. AD user security groups, user accounts) work absolutely fine when a user VPNs in and receives an Office Mode IP, but the same can't be said for an access role which defines the machines as well e.g. Any Identified Machine or a select group of machines in AD - the traffic always fails to match.

I spoke to CP TAC briefly and they said it's because the IP of the machine (physical NIC IP) and the source IP of the traffic (the Office Mode Virtual IP) doesn't match, which it wouldn't in a remote access scenario. What it does have though is all the required info to determine that 10.60.60.1 belongs to machine 1210R32-LT-S despite it having 192.168.1.230 as the assigned IP as shown in the attached pic.

Anyone come across this before?

What I'm trying to achieve here is have identified domain machines hit a different rule/layer compared to a machine that remotely connects and is not identified.

Thanks in advance!

[G_W_Albrecht]

Why not involve TAC here ?

[PA]

Have you solved this problem?