topic Re: Assigning VPN User a Static IP in General Topics

Assigning VPN User a Static IP

jmahoney — Thu, 04 Oct 2012 15:54:51 GMT

We have a customer who is running a specific thick application that requires the user to have the same IP address every time they attempt to authenticate to their servers. In the office this is not an issue since we can assign them a static IP and then do NAT based on that IP address. However, they need these users be able to VPN in and use the application.

Is there any way we can accomplish this with Global Protect? All I want to do is when the user connects in, to get the same IP address. The user will have one machine so we could do it by MAC address as well. I know the DHCP server can do this, but there doesn't seem to be any way in the VPN config.

The only solution I can think of is to use 8 different Global Protect Gateways (1 for each user) but that seems to be a rather bad solution.

Re: Assigning VPN User a Static IP

ppatel — Thu, 04 Oct 2012 17:33:11 GMT

Hello,

At this time I don't think so you can achieve this by using a single GP gateway as you would not find this in the configuration under VPN settings.

The Ip-pool is the only way to assign the ip-address in the GP config.

Regards

Parth

Re: Assigning VPN User a Static IP

bvandivier — Sat, 20 Oct 2012 00:08:20 GMT

Could you approach this with a unique source NAT when the user connects to global protect?

Something along the lines of this:

set rulebase nat rules GP-NAT source-translation static-ip bi-directional no

set rulebase nat rules GP-NAT source-translation static-ip translated-address <unique source address of GP user>

set rulebase nat rules GP-NAT to trust

set rulebase nat rules GP-NAT from gp-source-zone

set rulebase nat rules GP-NAT source gp-ip-pool

set rulebase nat rules GP-NAT destination application-server-address

set rulebase nat rules GP-NAT service "thick application"

set rulebase nat rules GP-NAT to-interface any