Assigning static ip to SSL VPN users

Hi Romanek,

this is a feature request. Please vote it:

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/20343496-assign-static-ip-in-ssl-vpn

Regards

One way would be possible quite easily. 

SNAT via policy. Using a User in Zone VPN, SNAT to a specific IP. So the Client will always access all internal resources via IP X. (One Way). 

Maybe thats enough for your setup? 

Hi Lucar,

Thank for your reply

It must be  an internal server accessing an VPN user IP.

The internal server must know the vpn user IP, but the way that SSL VPN works, the VPN user IP change a lot (dhcp pool), the server can`t send the document to the client.

So I think it is not SNAT, but DNAT. I saw DNAT rules ...  but the destination box is an static IP and not an user VPN

My workaround only works with SNAT (from SSLVPN to Server). 

Maybe you can rework the need for this access? Why does the server need a static IP to a certain user? What is the use case? Sometimes, there is a better solution for this? 

Maybe you could move to Sophos Connect (IPsec). IPsec is able to use Static IPs. 

LuCar Toni ,

The server needs a static IP because it is an old ERP systems that uses static ip to send some reports to that static ip printer in  client vpn.

If I use sophos connect (to have a static IP), What will happen when that vpn user use a Web browser to navigate to Internet ? Will that traffic go to the local link or through to vpn and then to Internet using the main office link ? I would like that web browser traffic to go using the local link (in this case).

Thank you

LuCar Toni ,

The server needs a static IP because it is an old ERP systems that uses static ip to send some reports to that static ip printer in  client vpn.

If I use sophos connect (to have a static IP), What will happen when that vpn user use a Web browser to navigate to Internet ? Will that traffic go to the local link or through to vpn and then to Internet using the main office link ? I would like that web browser traffic to go using the local link (in this case).

Thank you

Since the SSL VPN is passing the configuration to the client, static IP should not require so much effort for Sophos team. This is another workaround on XG to deal with and to be honest, customers are not happy with that.