Changing Endpoint Address?

[Toivo_]

We have several clients that cannot connect to our SA-6500 via NC. The log shows

TIME - SA-6500 - [xxx.xxx.152.60] user(DOMAIN)[ROLE] - Remote address for user USER changed from xxx.xxx.152.60 to xxx.xxx.167.32. Access denied.

We do not have any form of NAT or load balancing in front of our SA's; there are two in an active/passive configuration. It looks to me like the client's end has some form of NAT that is mapping different connections to different external IPs -- though the IPs are pretty far apart, so it's not just a small pool of external IPs either.

Has anyone seen this behavior, know what typically causes it, and how to work around it? The clients affected by this aren't particularly technical and we haven't been able to get hold of any technical contacts at the remote networks yet.

[kenlars_ · Accepted solution]

In the UI for the role, enable Roaming. This will allow the user's address to change. You could see this if the user had multiple internet connections, or if the user was being proxied from inside a network on more than one proxy.

Ken

[euanetwork_]

Hi, any idea why this IP change can happen between the public and the private IPs? Private IP given by the gateway DHCP pool. Users who experience this are on a single ADSL home connection...

Bb

[zanyterp_]

are you seeing this only when Network Connect launches? If yes, what type of connection are you allowing (split tunnel enabled or disabled)? If it is disabled, can you enable it and see what happens? If the client connection changes due to network environment, that could trigger the issue. Or if they have a low lease time