SSL Webportal, WAN-subnet

[skorge]

Hi all,

I am about to implement the SSL Webportal in our environment, but cannot find an answer to the following question:

My WAN-interface has a public subnet assigned. When setting up SSL I need to select which interface to listen to, but I cannot see where to assign a specific IP where I want the service to listen. Is this controlled by a policy? I don't want the SSL Webportal to listen to all public IPs.

Thanks in advance

Regards

Michael

[Christopher_McMullan · Accepted solution]

AFAIK, the port selection can't get more granular than the physical interface. Unless it's feasible for you to craft VLANs on the WAN port, the only other option I can think of would be to define local-in policies denying the traffic when it targets any address other than your desired IP:

config firewall address

edit "sslvpn_no_ip_1"

set type ipmask

set subnet 1.1.1.1/32

next

edit "sslvpn_no_ip_2"

...

end

config firewall addrgrp

edit "sslvpn_dstip_deny"

set member "sslvpn_no_ip_1" "sslvpn_no_ip_2"

end

config firewall local-in-policy

edit 0

set intf wan1

set srcaddr all

set dstaddr "sslvpn_dstip_deny"

set schedule always

set service ALL

set action deny

set status enable

end

The only traffic left to pass through would be on your desired IP.