Which IP Address is used for outgoing Gateway connection and how to change the outgoing IP

I have an ZTNA Client which is connected to an ZTNA Firewall Gateway.

The Client is connecting to an ZTNA Ressource (192.168.1.10) which is behind an IPSEC S2S VPN of the Firewall meantioned above as the ZTNA Gateway.

The ZTNA Gateway has more configured VLAN Interfaces internaly. I can see on the other Site of the IPSEC S2S (Firewall 2) connection, that the ZTNA Gateway is useing the first available IP Address of the VLAN Interfaces for the outgoing connection to the ZTNA-Ressource (172.16.10.1).

Can I change the Outgoing IP Address of the ZTNA Gateway?

Is that right that the Firewall is using the first available IP Address or is there an mechanismus which IP Address is choosen?

0 LuCar Toni 7 days ago

Do you have a Route Based IPsec or Policy Based?
We are using the interface used. For RB IPsec, we can use the XFRM Interface.
For Policy Based, you need this rule: https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/SiteToSiteVPN/HowToArticles/S2sVPNIPsecCreateIPsecRouteNAT/index.html

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Christian Wittmann 7 days ago in reply to LuCar Toni

It is an Policy Based VPN connection.

I will only NAT the ZTNA Traffic and not all of the Traffic from internal. I have no option to only select ZTNA as Source IP, haven't I?

There is no Object ZTNA which I can use as Source IP Address in the NAT Rule.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni 7 days ago in reply to Christian Wittmann

As this is an internal service of the firewall itself, there is no ZTNA object.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Christian Wittmann 7 days ago in reply to LuCar Toni

Ok thanks. Is there another way to NAT it only for ZTNA Ressources?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni 6 days ago in reply to Christian Wittmann

No, but is this a problem? You can deny traffic there via Firewall rules.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel