SSL-VPN Public IP

[adamsf1]

Hi Guys,

I been looking at making this change for some time now but would like some advice on the best way to get this done.

I have looked through the forums and some CB but the best advice is that from an FG pro.

our public IP in the office is 196.x.x.x.

when our users dial-up to the SSL-VPN they able to access our office servers.

when they dial into the VPN the FG assigns them a local IP of 10.212.x.x. and their public IP does not change to the office IP.

I am looking for a way of giving the users the same IP as our office is this possible?

[jorge_americo]

Can you post policy?

[adamsf1]

WG100D # show firewall policy 21 config firewall policy edit 21 set uuid 429b7a54-ce43-51e5-4620-79c140ddb751 set srcintf "dmz" set dstintf "internal" set srcaddr "ALL" set dstaddr "All LAN SERVERS-192.168.1.3-50" set action accept set schedule "always" set service "RDP" "SAMBA" "SMB" "HTTP" "HTTPS" "ALL_ICMP" "FTP" next end

above is the current policy we have with the working VPN with split tunnel enabled.

below is what I created yesterday:

set name "SSL-VPN-Internet" set uuid b00a0412-d893-51e9-2436-234e0557b1b8 set srcintf "ssl.root" set dstintf "wan2" set srcaddr "all" set dstaddr "all_internal" set action accept set schedule "always" set service "ALL" set groups "SSL_VPN_Users" set nat enable set fixedport enable next end

[jorge_americo]

Check in the client, the route table and post.

[adamsf1]

Thank you for the assistance jorge.americo and rwpatterson.

so to get this working I created a new policy and had the Destination to ALL 0.0.0.0/0 (This was key to getting everything working)

also my outgoing interface was set to internal instead of using my WAN connection where my Primary internet connection is. 

I disabled split tunnelling.

and my client was able to get my office IP of 196.x.x.x

thanks again guys!

[rwpatterson]

Glad you sorted things out.

[malphonse]

Adam can you share you policy.. which worked for you, i am also trying to do the same.