Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 18469 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to bind VPN tunnel endpoints to dedicated IP addresses?

Moose

Hi folks,

I'm running a SG 115 W with latest sw release. On WAN NIC I've been assigned a /28 subnet from my ISP. Let's name the net AA.BB.CC.DD/28.

From this /28 I'like to use 3 IP addresse for the UTM itself, i.e.

  • one as "default" gateway for general outbound traffic (this is simple/default)  AA.BB.CC.D1
  • one for Site-2-Site VPNs (IPSec in general) AA.BB.CC.D2
  • one for Client-2-Site VPNs (SSL in general) AA.BB.CC.D3

Well, I know how to assign the second and third IP address to the WAN NIC - this is the simple part.

But, how to force the VPN-Connections to use one of the additional (offical static) IP addresses  AA.BB.CC.D2 or AA.BB.CC.D3 on establishing a VPN connection?

Any ideas/hints/suggestions? May be source/destination NAT or something else?

Greetinx

Moose



This thread was automatically locked due to age.
Parents
  • 0

    The easiest for SSL VPN Remote Access is to use an FQDN that resolves to AA.BB.CC.D3 (like vpn.domain.com) in 'Override hostname' on the 'Settings' tab.

    For the IPsec site-to-sites, the easiest is to have AA.BB.CC.D2 be the primary address of the External interface.

    For the general traffic, instead of using a masquerading rule, the easiest is to use a NAT rule like: 'SNAT : Internal (Network) -> Any -> Internet : from External [General] (Address)' where "General" is the name of the Additional Address AA.BB.CC.D1.

    Cheers - Bob

    Edit a bit later: I just remembered that it's no longer necessary to use an SNAT.  It's now possible to create a masq rule like 'Internal (Network) ->  External [General] (Address)'.

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0

    The easiest for SSL VPN Remote Access is to use an FQDN that resolves to AA.BB.CC.D3 (like vpn.domain.com) in 'Override hostname' on the 'Settings' tab.

    For the IPsec site-to-sites, the easiest is to have AA.BB.CC.D2 be the primary address of the External interface.

    For the general traffic, instead of using a masquerading rule, the easiest is to use a NAT rule like: 'SNAT : Internal (Network) -> Any -> Internet : from External [General] (Address)' where "General" is the name of the Additional Address AA.BB.CC.D1.

    Cheers - Bob

    Edit a bit later: I just remembered that it's no longer necessary to use an SNAT.  It's now possible to create a masq rule like 'Internal (Network) ->  External [General] (Address)'.

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • 0 in reply to BAlfson
    Hi Bob,

    your are the BEST - over years now!

    Your post is the answer to both of my questions - great, like every time!

    Great to see you alive here on the new Sophos forum. The switch from the old well know Astaro one to this platform was a little bit heavy for me because all the old post get lost btw. are not directly accessable from here any more. So I have to search in two forums now. Not really the best solution. But I thinks this depends on the Sophos guys themselve.

    Anyway a big THANK YOU to you, Bob! Thanks also to Tim for his post.

    Greetinx

    Moose
Unfiltered HTML