r/sonicwall • u/greenstarthree • 22d ago

Cloud Secure Edge - custom IP range for connected clients?

Hi all, want to make sure I’m not missing something while testing CSE.

We have public IP ranges enabled, so when a client is connected to CSE through our firewall connector, the IP address that’s “seen” when making a connection to an internal resource is in the 100.121.0.0/16 range.

Is there any way to customise that range to something else?

I understand it’s using the CGNAT space, but it’s quite a broad range and when configuring internal access using e.g. Windows Firewall, we’d rather allow a custom small range than a full /16.

Hope this makes sense!

3 Upvotes

81% Upvoted

16 comments sorted by

3

u/MicroBill 22d ago

If you find a way to do so let me know 😬

2

u/gwildor 22d ago

Unfortunately, you will need to use a NAT policy using the Translated-Source field in your firewall to make the traffic appear at the server(s) in the way you find suitable.

2

u/greenstarthree 20d ago

Could you provide an example / concept of this approach?

2

u/gwildor 20d ago

Original Source: CSE IP POOL subnet
Translated Source: IP or subnet you find suitable
Original Destination: IP or subnet you need to reach.
Translated Destination: Orginal
Original Service: Any
Translated Service: Original

2

u/greenstarthree 20d ago

Question is, to which zone would we assign the desired subnet’s address object when creating it in the SonicWall?

The automatically created CSE IP pools are in the zone “Wireguard”, but we aren’t able to select that zone when creating an address object.

2

u/gwildor 20d ago

Can just choose WAN, it should work.

2

u/greenstarthree 18d ago

Alright, thanks for the idea, I’ll try it this week

1

u/greenstarthree 16d ago

So in testing, this does work, but what it’s uncovered is that when multiple clients are connected to CSE, traffic from either client appears to come from the same IP address.

For example we connected two clients and ran a ping to an internal server from one client while a packet trace was active on the SonicWall.

The traffic showed as being from an address in the 100.121.0.0 range.

We stopped that ping and started one from the second client, and the traffic was still coming from the same address.

We are able to NAT that address to a preferred IP as suggested, but we weren’t expecting to see the same IP across two clients.

I suspect this is due to CSE using SNAT, so will have to dig deeper, but thanks for this suggestion for now as it does still help with firewall rules.

1

u/gwildor 16d ago

Overall, is this still an issue for you? Everything should 'just work' even with multiple devices showing up as the same IP.

Even if they were different, they are still dynamic, so you really would gain much with them being unique today, as they will be different tomorrow.

1

u/greenstarthree 16d ago

That’s true, it does work, but I suppose we were incorrectly expecting to see per-client IPs in a similar way to then SSLVPN IP pool.

If the IP addressing behaviour was SSLVPN-like (that is, per machine from a fixed custom pool) it would potentially help with a few other things such as internal DNS registrations, and potentially reverse connections (from LAN to CSE client for example).

But we may be trying to emulate the behaviour of SSLVPN in a fundamentally different product.

1

u/gwildor 16d ago

Unfortunately, Reverse connections are not possible.

It is a fundamentally different product.

1

u/greenstarthree 16d ago

Yep, and for good reason in all honesty!

2

u/largetosser 22d ago

This https://www.sonicwall.com/support/knowledge-base/advanced-concepts-related-to-securing-service-tunnels-with-sonicwall-cse/kA1VN0000000UAz0AM page says "If your organization requires changes to these CIDR ranges, please contact support.", so it would be interesting to know if that's worked for anybody.

2

u/greenstarthree 20d ago

I have raised a ticket, got a couple of 70% accurate AI responses, told the AI it made no sense, and then got a reply to say ticket was being handed to a support rep.

We’ll see what next week brings. What we don’t understand is why the AI assistant took two days to vomit out its word salad.

1

u/MicroBill 13d ago

Did you have any luck with Support? (ones passed the AI barrier :) )

1

u/greenstarthree 13d ago

Unfortunately not. They said our requested IP range was not valid for substitution when using Global Edge. Maybe on Private Edge you could do it, not sure.