topic SSL VPN client is sending the PA traffic with other local interface IP in General Topics

SSL VPN client is sending the PA traffic with other local interface IP

CarlesGISA — Tue, 15 Jan 2013 17:24:16 GMT

I realised that some traffic from several remote clients is going through the firewall with another remote-local IP address, different from my remote assigned-pool. Obviously, this traffic is beeing dropped. It happens with users accessing correctly to other services (with the correct VPN-assigned IP).

Could it be a Global Protect issue?

It started to happen when we went up from version 3.1.4 to 4.0.5. Now we have 4.1.10 and Global Protect 1.2.1.

Any suggestions?

Thanks.

Re: SSL VPN client is sending the PA traffic with other local interface IP

nbilly — Wed, 16 Jan 2013 14:17:56 GMT

Hello,

You are probalby meeting a split-tunneling issue; Check your access route in your Gateway configuration.

Some traffic is probalby still routed in your LAN and not in your tunnel.

Best Regards

-Nicolas

Re: SSL VPN client is sending the PA traffic with other local interface IP

CarlesGISA — Wed, 16 Jan 2013 16:16:15 GMT

Hi Nicolas,

thanks for reply.

I think it's the opposite. Some local traffic of the remote client is being routed through the VPN, so I can see some incoming traffic from another physical interface the remote computer has.

For exemple: I'm assigning 192.168.1.0/24 IP's to the remote clients. If one client connects, I assign it 192.168.1.1 and I can see traffic to my internal IP's from this IP. But I can see also traffic from 10.10.10.10 (a remote local IP) to machines of my local 10.10.10.0/24 segment.

It's like the Global Protect agent is routing all the traffic (10.10.10.0 is in the acces route of my gateway) to my routed networks including traffic from other interfaces.

Regards,

Carlos.

Re: SSL VPN client is sending the PA traffic with other local interface IP

nbilly — Thu, 17 Jan 2013 08:09:53 GMT

Carlos,

Which access routes did you have configured?

regards

-Nicolas

Re: SSL VPN client is sending the PA traffic with other local interface IP

CarlesGISA — Fri, 18 Jan 2013 12:20:12 GMT

Hi Nicolas,

I have several networks in the access routes list. For example:

But I don't have 0.0.0.0/0, if you mean that... But yes, unusual traffic I'm seeing is coming FROM IP's of these ranges of other interfaces of the remote client.

Here you can see I'm assigning remote IP's from another range, so I wouldn't see traffic from this zone EXCEPT from this range:

Regards,

Carlos.