Access VPN Policy not tagging traffic with VLAN
Hello!
I'm trying to setup a VPN profile for traffic into the network. I'm trying to have it setup so that the VIP for the VPN lives on (for example) 192.168.10.10 however it assigns users IP's from a pool of IP's (192.168.11.10-20). Each is a different Subnet/VLAN. Currently, from doing packet captures, its correctly assigning users an IP from the pool of IP's, however I see two issues. 1) The IP doesn't appear in ARP Tables and 2) Its not tagging the traffic coming from the assigned IP address, which in turn it appears that the router is then dropping it due to mismatch.
I've gotten pretty much stumped on this one and haven't found any good articles on it. Anyone have any suggestions on where to look? I do have proxy ARP enabled in the Policy.
Posted Feb 14, 2023, 3:58 AM UTC
Assuming that the IP Pool range (192.168.11.0/24) is outside of the actual subnet of the physical interface (192.168.10.0/24) it won't appear in the ARP Table as it is routed traffic. ARP is only applicable for a locally connected subnet, so unless your IP Pool range is within your physical interface subnet then ARP for IP Pool is not applicable.
Why would it tag it? VLAN Tagging is a layer 2 concept, this is layer 3 traffic, either you have a tagged VLAN interface on the F5 and all traffic laving that interface will have a VLAN tag, or its an access port (i.e. untagged) and it won't, however it likely has nothing to do with your issue as:
What you probably need is a route on your router pointing the IP Pool range at the F5 itself, the router needs to know how to send the return traffic. It needs a route to tell it that it needs to route traffic for 192.168.11.0 to 192.168.10.10.
The other simple trick would be to enable SNAT on the VS and it will hide all IP pool traffic behind the F5 interface IP and then all your routing will be simpler, however all traffic will look like it is coming from the IP of the F5 itself instead of individual IP pool addresses.
Would the route need to point back to the VIP? I do have the subnet built in my router and the vlan assigned to it. I also have that vlan tagged on the F5 and assigned to the interface traffic is coming out. I can also see it routing out in some instances and the wrong tag is applied, it's the tag assigned with the VIP IP subnet.
From what you are saying, you are running in two arm mode, with the VIP on the "outside" and the router on the "inside" (even if these are two tagged VLANs on the same physical interface).
In this scenario the router would need a route for the IP Pool that sends the traffic back to the interface it comes out of, likely to the device itself.
I think you need to diagram this out as it's not entirely clear what your network topology is though.
At the end of the day, the your network needs to know where to send the traffic back to, treat the F5 as a router for these purposes. It has its own route table, so IP Pool traffic will egress the F5 out of which ever VLAN that the route takes it.
If you don't have any explicit additional routes then directly connected subnets (like the one that your router is on) will route correctly, and everything else will follow default route, which is probably what is happening when you say that "the wrong tag is applied"
The tag being applied is entirely due to which interface (vlan or physical) that the traffic is egressing, and this is controlled by routes on the F5.
So the F5 will need explicitly defined routes for any/all subnets that are behind your router, otherwise its going out of default route.
https://imgur.com/lPWRsMd
Here is a diagram I created real fast.
You are correct, my default gateway is out the interface that is getting tagged with what I don't want.
As addition. My router is pfSense. The switch that its all connected to is Ubiquiti. The device is an android device with F5 Access edge client. (Which, i think im going to spool up a VM of windows and use that instead or use a spare machine so i can run wireshark.)
I do agree, I dont think anything knows how to route traffic back or where to route, i'm just a bit stumped on what I need to do to get it to work.
I did add a VIP earlier that was a performance L4 VIP, with the source as the client VPN subnet and destination as 0.0.0.0/0 with the pool being the gateway IP. It did kinda work, however the client kept getting the cert of the router, which was causing SSL failures. I'm not sure if I need to go back to that approach or something else.
As an aside, I thought I knew F5's and networking and i'm feeling like i'm back to being a student again, haha!
Forget about tagging. Tagging is inconsequential, the F5 is behaving as it should.
Taking the diagram at face value, there is no need to have the IP pool subnet configured as a vlan on the router, it doesn't technically exist anywhere but "inside" the F5 itself, so you would treat it as a routed network with the F5 itself as the next hop.
Then, anything to the VIP from the client would follow its default route to the router, then the router has an interface in this subnet and forwards traffic to the F5 by a directly connected route.
Then any traffic from the IP pool addresses will follow the F5 default route, which takes traffic out on vlan50, but with a source of 192.168.10.x, which is correct. The router can then forward any return traffic back to the VLAN50 interface, which is how it should work.
I've messed with your diagram to show you how it should logically hang together. Apologies for the quick/dirty paint job, but I couldn't be arsed to break out Visio. 192.168.14.X being the interface (or floating IP if a pair) IP of the F5, and 192.168.14.Y being the router interface IP in that VLAN.
edit: on an F5 if you are connected to a access-port then you want the vlan untagged on the interface. A trunk port with a single tagged VLAN would also do the same, but the important thing being that you don't want vlan100 defined anywhere other than just an IP range as the IP pool. Take the IP pool as a (bunch of) loopback addresses on the F5 and it may make itself clearer in your mind.