For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jonathon_Page's avatar
Jonathon_Page
Icon for Nimbostratus rankNimbostratus
Oct 26, 2016

Internet access on F5 VPN with SNAT and split-tunnel disabled

Hi. I'm relatively new to the F5 environment, and we have a 4200 appliance set up to provide remote access services. We deployed a VPN profile and connect using the Edge client and local access is...
BIG-IP Access Policy Manager (APM)
routing
security
vpn
Leonardo_Souza's avatar
Leonardo_Souza
Icon for Cirrocumulus rankCirrocumulus
Oct 26, 2016

You are using F5 APM module. However the APM uses internally another module called LTM. Virtual Servers are LTM objects.

 

You first need to split the problem in 2 small problems:

 

1 - Internet traffic must go inside the VPN

 

2 - The F5 must have access to the Internet to be able to route the traffic to the Internet

 

First point, requires APM configuration. Second point, requires LTM configuration and routing in your network.

 

Very important is to make sure traffic returning from the Internet goes back to F5 unit and consequently the VPN tunnel. SNAT can help with that.

 

Some documentation that can help you with that:

 

https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-network-access-12-1-0.html

 

https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-routing-administration-12-1-1.html