Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 18466 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to bind VPN tunnel endpoints to dedicated IP addresses?

Moose

Hi folks,

I'm running a SG 115 W with latest sw release. On WAN NIC I've been assigned a /28 subnet from my ISP. Let's name the net AA.BB.CC.DD/28.

From this /28 I'like to use 3 IP addresse for the UTM itself, i.e.

  • one as "default" gateway for general outbound traffic (this is simple/default)  AA.BB.CC.D1
  • one for Site-2-Site VPNs (IPSec in general) AA.BB.CC.D2
  • one for Client-2-Site VPNs (SSL in general) AA.BB.CC.D3

Well, I know how to assign the second and third IP address to the WAN NIC - this is the simple part.

But, how to force the VPN-Connections to use one of the additional (offical static) IP addresses  AA.BB.CC.D2 or AA.BB.CC.D3 on establishing a VPN connection?

Any ideas/hints/suggestions? May be source/destination NAT or something else?

Greetinx

Moose



This thread was automatically locked due to age.
  • 0

    I believe this can be done under the Remote access section. Choose SSL and then select the 2nd tab for settings. You will find " "Interface Address" drop in any one of your additional addresses there. You may also want to change the Listen Address for the user portal under Management > User Portal > Advanced tab. At the bottom you will see listen address.

     

    --
    SCA/UTM/XG  Sophos Platinum Partner

  • 0 in reply to jflex

    Many thanks, Jaesii!

    I think this is the solution I've been looking for the SSL based VPNs.

    Now I'm looking forward for a similar solution for the IPSec based VPNs too.

    May be, another forum member can/will help me? Would be great!

    Greetinx

    Moose

  • 0 in reply to Moose
    I just encountered the IPsec VPN issue myself. Instead of the usual drag and drop address assignment, IPsec VPN has a dropdown list with only primary interfaces as an option. I could not figure out a way to use "additional" IP addresses with the tunnel. Your options are to use a second physical port or change your primary address to the IP you need to use.

    There is a feature request for this functionality:

    feature.astaro.com/.../1690801-vpn-use-additional-ip-s-for-tunnels
  • 0

    The easiest for SSL VPN Remote Access is to use an FQDN that resolves to AA.BB.CC.D3 (like vpn.domain.com) in 'Override hostname' on the 'Settings' tab.

    For the IPsec site-to-sites, the easiest is to have AA.BB.CC.D2 be the primary address of the External interface.

    For the general traffic, instead of using a masquerading rule, the easiest is to use a NAT rule like: 'SNAT : Internal (Network) -> Any -> Internet : from External [General] (Address)' where "General" is the name of the Additional Address AA.BB.CC.D1.

    Cheers - Bob

    Edit a bit later: I just remembered that it's no longer necessary to use an SNAT.  It's now possible to create a masq rule like 'Internal (Network) ->  External [General] (Address)'.

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Hi Bob,

    your are the BEST - over years now!

    Your post is the answer to both of my questions - great, like every time!

    Great to see you alive here on the new Sophos forum. The switch from the old well know Astaro one to this platform was a little bit heavy for me because all the old post get lost btw. are not directly accessable from here any more. So I have to search in two forums now. Not really the best solution. But I thinks this depends on the Sophos guys themselve.

    Anyway a big THANK YOU to you, Bob! Thanks also to Tim for his post.

    Greetinx

    Moose
Unfiltered HTML