topic Re: its possible have the same ip on proxy id on ipsectunnel and interface in Next-Generation Firewall Discussions

its possible have the same ip on proxy id on ipsectunnel and interface

DSilva102984 — Wed, 04 Jun 2025 23:02:33 GMT

good afternon

for example my ISP give me data link with ip address 192.168.20.2/28 this interface i connect to my interface 1/1 ok this work like my WAN, when i create ipsec tunnel i put same ip address on proxy ID 192.168.20/2/28 peer 10.10.10.10 this its possible ? work o have some issues with routing because en static route i have 0.0.0.0/0 next hop 192.168.20.2/28

Re: its possible have the same ip on proxy id on ipsectunnel and interface

reaper — Thu, 05 Jun 2025 10:07:14 GMT

the proxyID is only used to negotiate tunnel SAs so doesn't impact routing

you can put anything you like in there, if it makes sense to put it there in the first place

will connections go into the ipsec tunnel that originate from the 192.168.20.0/28 subnet ?

ProxyID is set to negotiate which source subnet (clients) is allowed to communicate over the tunnel with a destination subnet (servers), so typically your local 'trust' and the remote 'trust' subnets are in the proxyID, while the untrust IP is only used in the IKE Gateway object to negotiate the tunnel itself

Re: its possible have the same ip on proxy id on ipsectunnel and interface

DSilva102984 — Fri, 06 Jun 2025 15:43:03 GMT

thanks for ask my question