Connecting to an IPsec endpoint from behind the Firewall
Last modified on 1 Dec, 2022. Revision 8Up to date for | cOS Core 14.00.06 |
Supported since | cOS Core 11.x |
Status | OK |
Author | Peter Nilsson |
Problem
I want to configure a roaming/roadwarrior IPsec client/server setup where I can can connect to the Firewall VPN server from the Internet but also from inside/behind the firewall. But when i try to connect with the client from the inside nothing happens, the Firewall does not reply at all.
Solution
The Firewall behaves this way because the IPsec engine expects that the interface where the request was received will be the sending interface as well. But if you connect to e.g. WAN from LAN it will be the LAN interface that will be the sender interface towards the client.
The solution to this problem is straightforward. Configure the Local Endpoint setting on the IPsec tunnel to be the IP address of the external interface, as shown in the screenshot below:
Now, the IPsec engine and cOS Core will know which IP address it should use as the sender IP even if the sender interface is the internal LAN interface.
Note: In older cOS Core versions where the Local Endpoint setting does not exist, the solution is to set the same IP address on both WAN and LAN interface.
Related articles
11 Jan, 2023 ipsec core vpn
23 Aug, 2022 core certificate oneconnect ipsec vpn
23 Nov, 2022 core ipsec
22 Mar, 2021 core ipsec routing
17 Jun, 2021 core ipsec routing
14 Apr, 2021 core license ipsec
8 Sep, 2020 core ipsec rules access
27 Jan, 2023 ipsec core windows vpn l2tp
16 Sep, 2020 vpn ipsec ikev2 windows howto dh
7 Dec, 2022 ipsec ike troubleshoot core
14 Dec, 2022 core ipsec
23 Aug, 2022 core ipsec license memory
23 Aug, 2022 core connections ipsec memory
2 Dec, 2022 dhcp ipsec core