IPsec interface on additional addresses

Look how old this thread is......

14 years later, I'm asking the same question. I have a block of 16 IPv4's and was wondering how to select one of those instead of the primary WAN address. 

I can't see where to select it for IPsec. 

Hi Louis,

The feature is not supported in UTM, cast your votes here http://feature.astaro.com/forums/17359-utm-formerly-asg-feature-requests/suggestions/1690801-vpn-use-additional-ip-s-for-tunnels#comments.

Thanks

No one from SOPHOS has read that site or implemented an ideas on there in years.  That one is 6 years old.

I still don't understand why one would want to do this - what the benefit is.

Cheers - Bob

BAlfson said:

I still don't understand why one would want to do this - what the benefit is.

Cheers - Bob

 

Not trying to be combative, just trying to understand...

Portability: Can't you resolve that by configuring remote sites as "Respond only," the central site Remote Gateways as "Initiate connection" and making the change of device/IP in the central site?  Just disable the IPsec Connection in the UTM and enable it in the XG.

Clearer reporting - how would an additional IP help there?

Cheers - Bob

BAlfson said:

Not trying to be combative, just trying to understand...

Understood, Bob you are the most helpful person on the forums and very much appreciated!

BAlfson said:

Portability: Can't you resolve that by configuring remote sites as "Respond only," the central site Remote Gateways as "Initiate connection" and making the change of device/IP in the central site?  Just disable the IPsec Connection in the UTM and enable it in the XG.

Sorry, that reply went straight over my head if I am honest! These remote sites are not in my control, they are other different companies that we exchange data with.  

BAlfson said:

Clearer reporting - how would an additional IP help there?

Reporting on that activity of that IP address  would not be mixed up with all the other web surfing traffic & email.

Thanks for all your help.

Thanks, Nathan!

"These remote sites are not in my control, they are other different companies that we exchange data with."

Understood.  As each of them changed their IPsec endpoint to accept "calls" ("Respond only") instead of also making them ("Initiate connection"), you could move your endpoint from the current UTM as I described with only a momentary loss of connection.

Traffic is tracked by IP, Service and Application.  I don't see how having a separate IP for IPsec only could provide more granular information.

Cheers - Bob

Thanks, Nathan!

"These remote sites are not in my control, they are other different companies that we exchange data with."

Understood.  As each of them changed their IPsec endpoint to accept "calls" ("Respond only") instead of also making them ("Initiate connection"), you could move your endpoint from the current UTM as I described with only a momentary loss of connection.

Traffic is tracked by IP, Service and Application.  I don't see how having a separate IP for IPsec only could provide more granular information.

Cheers - Bob