mjb109
Jan 20, 2023Nimbostratus
APM custom address space by client IP?
Hi all:
Strange client requirement, but figured I'd ask as a thought experiment. What we'd like to do is use different split-tunnel address spaces depending on a client's location/IP. For example, if a user is in an office we know is protected, don't tunnel things like Internet browsing. If that same user takes their laptop home/to a coffee shop/etc, tunnel everything. Is something like this even possible?
Juergen_Mang is spot on, it's pretty straightforward. You'd create:
- Two or more Network Access Lists that comply with your desired connectivity properties
- Create an *empty* item in a per-session access policy, name it "check client IP" or something
- Add branch rules to check the client IP. The Expression Builder has these built-in already.
- Branch to an Advanced Resource Assign that assigns the appropriate resource