- Products
- Learn
- Local User Groups
- Partners
- More
This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
- Products
- Learn
- Local User Groups
- Upcoming Events
- Americas
- EMEA
- Czech Republic and Slovakia
- Denmark
- Netherlands
- Germany
- Sweden
- United Kingdom and Ireland
- France
- Spain
- Norway
- Ukraine
- Baltics and Finland
- Greece
- Portugal
- Austria
- Kazakhstan and CIS
- Switzerland
- Romania
- Turkey
- Belarus
- Belgium & Luxembourg
- Russia
- Poland
- Georgia
- DACH - Germany, Austria and Switzerland
- Iberia
- Africa
- Adriatics Region
- Eastern Africa
- Israel
- Nordics
- Middle East and Africa
- Balkans
- Italy
- Bulgaria
- Cyprus
- APAC
- Partners
- More
- ABOUT CHECKMATES & FAQ
- Sign In
- Leaderboard
- Events
What's New in Check Point SASE
Wednesday, 9 September @ 5pm CET / 11am EDT
The State of Ransomware Q2 2026:
This Quarter's Trends, and Their Impact on Your Defenses
AI Security Masters
Implementing the AI Security Trifecta
CheckMates Go:
Half is Not Enough
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- CheckMates
- :
- Products
- :
- Hybrid Mesh
- :
- SASE and Remote Access
- :
- [SASE] connection NATed
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Are you a member of CheckMates?
×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
This widget could not be displayed.
2 Replies
Hello everyone!
In the scenario where we have SASE using the Wireguard connector, we have observed that the connection IP for accessing applications is not from the SASE client but from the connect, that is, the connection is NATed. The question is, how can we make the user connection arrive with the connection IP in the application? Reason: in this scenario, security control in the applications is done by connection IP.
Below is the current scenario.
SASE client network: 10.17.4.0/22
On-premise client network: 10.0.250.0/23, 172.16.0.0/12 and 192.168.0.0/16
In the scenario where I use the IPSec VPN connector, would it be possible to meet this requirement?
Thank you!
Labels
- Labels:
-
corporate access
-
SASE
[SASE] connection NATed
[SASE] connection NATed
Hello everyone!
In the scenario where we have SASE using the Wireguard connector, we have observed that the connection IP for accessing applications is not from the SASE client but from the connect, that is, the connection is NATed. The question is, how can we make the user connection arrive with the connection IP in the application? Reason: in this scenario, security control in the applications is done by connection IP.
Below is the current scenario.
SASE client network: 10.17.4.0/22
On-premise client network: 10.0.250.0/23, 172.16.0.0/12 and 192.168.0.0/16
In the scenario where I use the IPSec VPN connector, would it be possible to meet this requirement?
Thank you!
Labels
- Labels:
-
corporate access
-
SASE
Hello everyone!
In the scenario where we have SASE using the Wireguard connector, we have observed that the connection IP for accessing applications is not from the SASE client but from the connect, that is, the connection is NATed. The question is, how can we make the user connection arrive with the connection IP in the application? Reason: in this scenario, security control in the applications is done by connection IP.
Below is the current scenario.
SASE client network: 10.17.4.0/22
On-premise client network: 10.0.250.0/23, 172.16.0.0/12 and 192.168.0.0/16
In the scenario where I use the IPSec VPN connector, would it be possible to meet this requirement?
Thank you!
Labels
- Labels:
-
corporate access
-
SASE
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yep, as phoneboy said, you're seeing the expected result. We tried that method and found it to be untenable, so we just added ipsec tunnels to all on-prem gateway and now the actual client IP is exposed to the onprem app. hth
Yep, as phoneboy said, you're seeing the expected result. We tried that method and found it to be untenable, so we just added ipsec tunnels to all on-prem gateway and now the actual client IP is exposed to the onprem app. hth
