This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

limit SSL VPN remote access to specific IP addresses

How can we restrict SSL VPN access to specific IP addresses, if the user is in specific 'group'?

The mechanic attached to the Group only checks the client IP (once on VPN); and then it's only checking the SSL VPN subnet IP (a private subnet), not the public IP where they're coming from. This is effectively a firewall rule - since it's already connected to the SSL VPN. Not sure why there's a duplication of responsibility.

We want:

Group: Employees

can connect from anywhere

Group: Vendors

can only connect from their business IP (so they cant take laptop home and connect from home)

How can this be achieved?

This thread was automatically locked due to age.

Parents

0 FormerMember over 4 years ago

Hi John Woodall,

There is no option to restrict SSL VPN access based on the user IP address, but you should be able to restrict user based on IP address that user is connecting from with Login restriction option under >Authentication > Users > Click on user that you want to restrict login and than scroll all the way down to find Login Restriction option. Please add IP address that user is expected to connect from.

Please check this KB Article :Sophos XG Firewall: How to restrict local user login from specific machines when using DHCP. Let us know if you have any questions?

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel
0 John Woodall over 4 years ago in reply to FormerMember

When I did this as group [user group node] (because management of multiple users should always be done at a group level!), it was listening for the wrong IP (SSL VPN IP, not original public IP)

I will try it modifying a single user.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 John Woodall over 4 years ago in reply to FormerMember

When I did this as group [user group node] (because management of multiple users should always be done at a group level!), it was listening for the wrong IP (SSL VPN IP, not original public IP)

I will try it modifying a single user.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 John Woodall over 4 years ago in reply to John Woodall

Same effect (expected, since the user was a member of the group - and the group had the same restrictions tested).
Cancel
Vote Up 0 Vote Down

Cancel