Remote access SSL VPN and same 192.168.1.x network on both ends? (XG 125)

Hi Ruben,

When you get connected through SSL VPN, what is the VPN pool network IP leased to your endpoint?

Thanks

Hi,

Not with a default configuration, no. There would be no destination for the traffic as it would be kept locally and wouldn't be routed.

Here is how you'd do it (I have tested and verified this working on an SG firewall): https://community.sophos.com/kb/en-US/115579 

Basically what the article has you do is to do two 1:1 maps, one for 'map source' and another for 'map destination'. From there we create a fake VPN with a fake network that doesn't exist, like 192.168.200.0/24, and on your other network, another fake lan like 192.168.100.0/24. The rules say "From fake lan A to fake lan B, change to my real network" and vice versa. The article should show it.

On the XG there's no 1:1 NAT, so we would do differently. I would try:

User/Network rule

Match based on identity: OFF

Source

Zone: VPN

Networks: (local lan)

Services: (whatever's applicable)
Schedule: Whatever works for you.

Destination

Zone: VPN

Networks (your other side's fake LAN, like 192.168.100.0/24)

routing: Rewrite source address (Masquerading) ON

Create a new IP network for your local fake lan, like 192.168.200.0/24

Then in VPN, your local networks and remote networks would both be your fake LANs.

I can't bench this at present, but give it a try and see if it works for you.