2.4 Configuring Route and Source NAT for Enterprise Mode

In the Enterprise mode, the SSL VPN assigns IP addresses to each client from the subnet specified in the configuration. The values specified in the OpenVPN Subnet Address and OpenVPN Subnet Mask fields determine the IP addresses that are assigned to the clients. Make sure that the assigned IP address and the IP address of the client do not match.

For more information on configuring the IP address, see Section 2.3, Configuring the IP Address, Port, and Network Address Translation.

The packets from these clients reach the application server with the IP address of the client as the source address. The response packets need to be routed back to the SSL VPN, which sends them on to the clients. You can solve this routing problem in one of the following ways:

2.4.1 Configuring the OpenVPN Subnet in Routing Tables

If you have a gateway for your network between the application server and the SSL VPN, you can configure the gateway to send the dynamically assigned IP addresses from the OpenVPN address pool to the SSL VPN. This is the best routing approach because most applications, including ActiveFTP and TFTP, can work in this type of environment. To establish this type of routing, you need to add a static route to your network’s routing infrastructure so that traffic to the OpenVPN subnet pool of addresses is sent via the SSL VPN gateway.