Static IP assignation for SSL VPN clients

KNowak
KNowak Posts: 3 image  Freshman Member
First Comment
in USG FLEX H Series

Hello.

How to assign specific static IP adrress for SSL VPN clients, for example based on username/password? I have Split Tunnel configuration with two local networks and one client network pool. I would like to assign static IP for every VPN client so it will help me to analyze Security Reports and identify problematic clients. When IP is constantly changing it is very hard to track such client.

All Replies

  • PeterUK
    PeterUK Posts: 4,140 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited September 3

    There is no way to do this currently from the UI that I can see.

    You would likely have to do this at the client side

  • Zyxel_Melen
    Zyxel_Melen Posts: 3,984 image  Guru Member
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @KNowak

    SSL VPN doesn't support static IP address for specific client/user. Would you like to share your use case for us to evaluate it?

    Zyxel Melen


  • KNowak
    KNowak Posts: 3 image  Freshman Member
    First Comment

    Sure.

    Business decided that if remote user is connected to company network, then he is technically 'at work', even when he is using his own PC. Therefore, I decided to filter and log remote users DNS traffic. In SSL VPN configuration, I've pointed Zyxel as only DNS.

    When 'Open VPN Connect' client is connoted to company network then my Zyxel becomes primary DNS for this PC. And this is working fine. Great, now I know which remote PC maybe infected or just risky. Here is example screen from weekly Summary Report:

    st1.png

    Now I want to identify that user quickly to react for threat... How can I do this?

    How to match vpn user with session time, with assigned IP and with security logs? If I will be able to create individual reservation for each user then this task would be simple.

    I'm facing simmilar difficulty when in I have two internal DNS servers which are both forwarding queries to Zyxel. In DNS threat view I see my DNS servers as origin of blocked threat and to identify specific PC on local network I need to use packet trace.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）