SSL VPN Loopback Address

[jrpayne]

Hello All, 

I am trying to gather as much information as I can prior to making a change to my firewall. I was attempting last week to create an automation stitch. This would place IP addresses associated with SSL VPN brute force attempts, onto a blocked IP address list. I found that this apparently cant be done if your SSL VPN is bound to your WAN interface. I began researching this but cant find a clear answer as to why this is required. I would also like to make sure I understand all of the steps involved in doing this as well as any implications it might have on functionality (pro or con). From what I can tell, it is a matter of creating the interface, assigning some random IP to the interface then creating a VIP that forwards traffic incoming on the SSL VPN IP and port,  to the loopback interface. Are you required to change the actual policies that permit the traffic since the interface is addressed as sslvpnroot and not as an IP? Any information/assistance is greatly appreciated.