Forum Discussion

mjb109's avatar
mjb109
Icon for Nimbostratus rankNimbostratus
Jan 20, 2023

APM custom address space by client IP?

Hi all: Strange client requirement, but figured I'd ask as a thought experiment. What we'd like to do is use different split-tunnel address spaces depending on a client's location/IP. For example, i...
Security
  • Lucas_Thompson's avatar
    Lucas_Thompson
    Jan 24, 2023

    Juergen_Mang is spot on, it's pretty straightforward. You'd create:

    1. Two or more Network Access Lists that comply with your desired connectivity properties
    2. Create an *empty* item in a per-session access policy, name it "check client IP" or something
    3. Add branch rules to check the client IP. The Expression Builder has these built-in already.
    4. Branch to an Advanced Resource Assign that assigns the appropriate resource

     

     

     

Paulius's avatar
Paulius
Icon for MVP rankMVP
Jan 20, 2023

mjb109 Typically the way traffic is tunneled is by the particular policy applied to the tunnel that you are attempting to form and not dynamically. Realistically you would have to configure two different tunnels one they connect to when they are at work and one when they are at home.