topic Re: RA VPN on non-interface IP in Network Security

RA VPN on non-interface IP

gcook0001 — Thu, 04 Feb 2021 17:18:05 GMT

Is it possible to use a different IP from our WAN subnet for RA VPN?

We currently port-forward 443 to an internal proxy server on the interface IP. We do this for a couple of reasons. I realize I can use a different external port for this but thought there would be some benefits to having the VPN on it own external IP.

We currently using Firepower 1140s managed by FMC.

Re: RA VPN on non-interface IP

balaji.bandi — Thu, 04 Feb 2021 17:27:05 GMT

Sure you can use free IP address for your VPN bind to interface. (it has own advantages than using external IP configured in shared basis).

Re: RA VPN on non-interface IP

Rob Ingram — Thu, 04 Feb 2021 17:24:48 GMT

@gcook0001

You can only terminate a VPN (RA or L2L) on an IP address assigned to a physical interface (i.e. OUTSIDE) of an FTD or ASA, so in your scenario no.

If you don't want to change the existing nat to a spare IP address, then you could change the SSL-VPN port or use IPSec instead on the existing IP address assigned to the outside interface.

HTH

Re: RA VPN on non-interface IP

gcook0001 — Thu, 04 Feb 2021 19:14:37 GMT

Is there documentation or something that explains how to do this? I can't find anything and when I setup the VPN it only allows me to select the interface.

Re: RA VPN on non-interface IP

balaji.bandi — Thu, 04 Feb 2021 19:37:37 GMT

There may be a typo in my last message, you need to have the interface configured with IP to get working.

Re: RA VPN on non-interface IP

gcook0001 — Thu, 04 Feb 2021 20:19:29 GMT

So just to be clear. I have a wan subnet xxx.xxx.xxx.0/28 from my ISP. xxx.xxx.xxx.1 is the ip assigned to my wan interface. I can't setup xxx.xxx.xxx.2 for my RA VPN.

Re: RA VPN on non-interface IP

Rob Ingram — Thu, 04 Feb 2021 20:22:49 GMT

@gcook0001

No, not unless you change the physical interface of the device to .2. You can only terminate a VPN on the physical interface.