How to prevent SSL-VPN port from using all configured IP addresses

VPN
1

WAN1 port has got 5 different IPs from the same block. I noticed SSL-VPN is active all of those IPs, but I wish for it to only reply to the main address.

Are you forced to write a specific firewall policy, or is there a way to only bind SSL-VPN service to a single, specific IP address?

2

As far as I know you can only select an interface and if that interface has multiple IPs it will work on all of them.
I would suggest using a loopback interface for better security and with that you can also restrict it to one address.

3

You have two options

  1. ( the recommended one) ,use a loopback interface ,create a loopback interface with routed public ip ,or if you do not have a routed pool ,just do NAT via VIP that maps one of your external interface ip to your loopback ip and after that you can control the access to the vpn on the firewall policy ( good advantage)

  2. Use a local in policy, create a local in policy that block the access to the relevant external IP’s that you want to prevent the vpn connectivity on them.

4

It sounds like you have configured 4 secondary IPs on your WAN interface, usually this is not best-practice. What is the reason you configured it this way?

5

Create a loopback interface. Put your SSLVPN service on that loopback. Set up a VIP honoring inbound traffic to your VPN port from only one of those IPs. Point the VIP to your loopback interface where the VPN is waiting for connections.

6

use loopback and set it’s policy to use a nat pool of the IP you want for SSLVPN

7

Loopback interface and NAT Policy

8

Check the Current SSL-VPN Configuration:

  • Access the CLI or GUI and verify the SSL-VPN configuration. Make sure it is enabled on the intended WAN interface.
  • show vpn ssl settings
  • Bind SSL-VPN to a Specific IP Address: config vpn ssl settings set source-interface set source-ip end

Update the Firewall Policy:

  • If necessary

Optional: Restrict Listening Ports (If Needed):

  • Confirm that the correct port (default is 443) is being used, and adjust as needed:

config vpn ssl settings set port end

9

this

Create a loopback interface. Create a virtual ip object to map 1 public IP address to the internal loopback ip address and adjust your policy

10

This is the answer. Use the loopback with VIP

11

We chose to split several services on different IPs, and match different DNS hostnames to them… easier to manage if suppressing an IP does not disrupt other services that IP is not associated with.

Maybe a virtual interface associated with each public IP would be a better solution?

12

set source-ip

That’s not a thing for SSL-VPN.

13

To elaborate even further, use security profiles on the policy from WAN to loopback and have a more secure sslvpn overall. Combine this with local in policies, geo blocking and so on…

14

Why don’t you just use VIPs without configuring everything as a secondary IP?

15

To add even more on top of all of this, see my SSL VPN config here

This has a loopback with the VIP, plus blocks many ASN of server rental companies, auto blocks failed log in attempts, uses the ISDB, blocks by geography etc.

This will really limit the amount of brute force attacks on your log in

16

Conflicting ports, i.e. differente HTTPS servers, FTP servers, etc

17

That does not make sense. To use one of your public IPs in a VIP you do not need to configure that public IP as a secondary IP.