VPN BIG-IP Edge client : firewall rules applied by BIG-IP Edge Client

Yes, the BIG-IP APM system applies firewall rules (ACLs) for other types of VPN connections that do not use "always connected mode" (as part of the customized BIG-IP Edge Client download). You can configure this by applying ACL resources in the access policy for the VPN connection. However, this does not apply ACLs to the client device when the NA/VPN is not established. Please note that this functionality is unique to the "always connected" feature of the customizable Edge Client download package.

Thank you for your answer.

With "always connected mode", we can choose the following option : "block all traffic when VPN is disconnected".

According to your answer, the traffic is blocked thanks to ACLs. Can we specify exceptions by adding ACLs ?

Can we enable "allow local subnet" with "always connected mode & block all traffic" when VPN is disconnected ?

When creating the "Customize Windows Package".

When logged on to the BIG-IP APM GUI go to:

Access > Connectivity / VPN > Connectivity > Profiles.

Select the profile for your "always connected mode".

Click Customize Package.

Select BIG-IP Edge Client

Under Exclusions List click Add.

Per the help section:

Exclusions list The Exclusions list specifies addresses that are accessible when Block mode is configured. You can specify up to ten addresses. Addresses can be IPv4 addresses, IPv4 address:port pairs, or fully qualified domain names.

If you are looking for a broader access for clients when they are disconnected from the VPN, you may want to consider using Allow-Only-In-Enterprise-LAN.

Per the help section: Allow-Only-In-Enterprise-LAN - In this mode, traffic in the local network is allowed when the VPN is not connected. The local network is determined by configuring the Location DNS List in the Connectivity Profile.

Once the is configure the package will need to be downloaded and installed on the client device.

Hope that helps.

Thank you. It helps and raises the following question : what is the difference between "allow-only-in-entreprise-LAN" and "allow local subnet" ?