Routing on interfaces

[sabeel_93]

Hi,

I am working for a company who has implemented a pulse secure soloution, but they have default routes on all three interfaces. The set-up is working fine, but struggling to understand why its working and was wondering if pulse prefers maybe external interface as its default route. if anybody has any ideas, please let me know.

Best Regards,

Sabeel

[[email protected]]

@sabeel_93 It's basically virtual routing instance i.e., each interface has their own route table rather than sharing the same one, so if an external client connects to VPN they'd be ending up on the external interface and reply traffic will be sent using the same.

VPN server will always use Internal port sourcing other type of traffic like DNS, etc. which can be configured to other interfaces as well.

[sabeel_93]

Hi,

Thank you for your reply. do you have any links to a document that describes this or maybe a link with a diagram ?

I understand that the clients are given private IP's by the pulse from its pool - these packets coing fromt eh clients will still come from the external interface and then will need to the the internal interface to get to applications and resources whin our DC. How does it know that the traffic received from one interface needs to be passed to another ?

Best Regards,

Sabeel

[zanyterp]

connectivity from the vpn clients to the internal network will source from the assigned IP; the route needs to point to the internal port of the pcs appliance in order to route traffic successfully
you should not see sourcing from the external port of the appliance to internal resources

[[email protected]]

@sabeel_93 Traffic received over the external traffic would be encrypted, hence after decrypting the payload, VPN server will find the destined to the internal resource and sourced from the client's private/tunnel IP address, then the VPN server will use the internal port's route to forward the traffic.

Client public IP >> (encrypted data - tunnel mode) >> VPN public IP - external port >> (decrypts the data) >> (actual IP packet destinated to internal resource) >> VPN server forwards the traffic to next hop based on the Internal port's route.