Skip to main content
BusinessUser
Explorer
January 18, 2024
Solved

How Do you create an ssl interface?

  • January 18, 2024
  • 4 replies
  • 1688 views

Let me explain.

Users SSL VPN into firewall A.

Firewall A send the traffic to firewall B via a site to site vpn.

So I have to configure an SSL VPN interface on firewall B to accept the traffic from A.

How do I do it?

Best answer by funkylicious

Hi,

No, there's no need to create a SSL interface.

On firewall A you need : srcintf ( ssl interface ) dstintf ( ipsec tunnel ) srcaddr ( vpn group / vpn pool ) dstaddr ( subnet on firewall B )

On firewall B you beed : srcintf ( ipsec tunnel ) dstintf ( interface for the local subnet to be reached by the users ) srcaddr ( sslvpn pool ) dstaddr ( local subnet ) 

4 replies

AEK
SuperUser
SuperUser
January 18, 2024
funkylicious
SuperUser
SuperUser
January 18, 2024

Hi,

No, there's no need to create a SSL interface.

On firewall A you need : srcintf ( ssl interface ) dstintf ( ipsec tunnel ) srcaddr ( vpn group / vpn pool ) dstaddr ( subnet on firewall B )

On firewall B you beed : srcintf ( ipsec tunnel ) dstintf ( interface for the local subnet to be reached by the users ) srcaddr ( sslvpn pool ) dstaddr ( local subnet ) 

"jack of all trades, master of none"
hbac
Staff
Staff
January 18, 2024

Hi @BusinessUser,

 

On both firewalls, you need to add SSLVPN subnet to phase2 selectors of the IPsec tunnel and also add it to the firewall policy accordingly. Please refer to the document shared by AEK. 

 

Regards, 

mle2802
Staff
Staff
January 18, 2024

Hi @BusinessUser,

Make sure you add the SSL VPN subnet to P2 and have policy as well as routing accordingly. You can use the following command for troubleshooting also:

diag debug reset
diag debug flow filter addr x.x.x.x (SSL VPN IP)
diag debug flow show ip en
diag debug flow show func en
diag debug console time ena
diag debug ena
diag debug flow trace start 999