IPsec Tunnels Phase 2 and groups

Forum|Forum|8 years ago
May 11, 2018
4 replies
5298 views

Hi!

I've added a addressgroup under Remote Address for Phase 2 Selectors. Does this work or do I have to add the addresses separately?

Thank you.

Toshi_Esumi

SuperUser

How did you create a group in IPsec Phase2 setting GUI? I don't see any option to set a "group" there.

The traffic selectors are pare of local<->remote. If you need to set multiple subnets on remote side you need add a new set like 172.16.0.0/16<->192.168.0.0/16 and 172.16.0.0/16<->10.10.0.0/16.

Toshi_Esumi

SuperUser

Ok, through the wizard, you can put multiple subnets like my previous post on remote side separated by a comma ','. Then it would generate two pairs with the same local subnet.

emnoc

New Member

It really depends

1: if it's FGT-to-FGT firewall and route-based, than a 0..0.0.0/0:0 is good enough

2: if it's FGT-toSRX firewall and route-based, than a 0..0.0.0/0:0 is good enough

3: if it a FGT-2- <insert almost anything else CHKP/SonicWall/ASA/ForcePT/pfSense > than unique src/dst-subnets or unique named-network-elements must be used in the phase2

YMMV, but the 1-3 rules are pretty much what it is

Carlanderska_SAuthor

New Member

Thank you for the answers. What I meant was that I added an address-group which contains more than one address into the Phase 2 Selectors Remote Address.

Sign up

Login with SSO

Login to the community

Login with SSO