[SASE] connection NATed

[eltonsimoes]

Hello everyone!

In the scenario where we have SASE using the Wireguard connector, we have observed that the connection IP for accessing applications is not from the SASE client but from the connect, that is, the connection is NATed. The question is, how can we make the user connection arrive with the connection IP in the application? Reason: in this scenario, security control in the applications is done by connection IP.

Below is the current scenario.

SASE client network: 10.17.4.0/22
On-premise client network: 10.0.250.0/23, 172.16.0.0/12 and 192.168.0.0/16

In the scenario where I use the IPSec VPN connector, would it be possible to meet this requirement?

Thank you!

[PhoneBoy]

I believe this is expected behavior when using the Wireguard connector.
IPsec should work better in this regard.

[D_TK]

Yep, as phoneboy said, you're seeing the expected result.  We tried that method and found it to be untenable, so we just added ipsec tunnels to all on-prem gateway and now the actual client IP is exposed to the onprem app.  hth