UPDATE: Turns out this is a known issue during the 1.5 > 5.1 VSM upgrade and a fix should be released in an upcoming patch.
That's about the shortest title I could think of to be descriptive of this issue. TLDR is that NAT rules on vShield Edge appliances appear to be causing unexpected behavior on VPN traffic after a vCloud upgrade from 1.5 to 5.1.
Background: We recently upgraded from 1.5 to 5.1. For most of our vDCs, we simply have a
single vSE/Routed network that connects a private subnet to a "WAN" network and
pulls a public IP from a pool. We forward (NAT) and allow (firewall) selected
ports (e.g. 3389 for RDP) to virtual machines. Most of these networks also have
a site-to-site VPN tunnel with a physical firewall across the internet. After
the upgrade, we went and converted our rules to match on original IP and then
enabled "multiple interfaces" - effectively taking them out of compatibility
mode. Everything looked good (even for the vSE devices still in compatibility
mode)
Issue: We first noticed this when a client reported that
they could not access a virtual machine via RDP using it's internal (VSE
protected) IP across a VPN tunnel, but could access the VM via RDP using it's
public hostname/IP address. We allow all traffic across the VPN (firewall has an
any:any rule for VPN traffic). When we logged in to troubleshoot (simply
thinking the VPN was down), we found that we could connect to any port on the
remote VM across the VPN tunnel except 3389. I could ping from the
local subnet to the troubled VM on the vApp network with no problem. I could
connect to other ports that were open on the remote VM with no problem. I could
not connect to 3389 across the VPN.
We thought it might be isolated, but found the issue on every VSE we have: If
there existed a DNAT rule to translate inbound traffic for a particular port,
that port would be unresponsive when traffic traversed the VPN tunnel destined
for the target of the DNAT rule.
While vCloud Director doesn't show anything strange in the firewall section of vSE configuration, if you log in to vShield Manager and look at the firewall rules there, a "Deny" rule with the private/internal/translated IP is added for any NAT rule that exists:
This, I'm assuming, is for security reasons during the upgrade but it does not show up in vCloud Director (thus our confusion). After taking our appliances out of compatibility mode post-upgrade, the rules were still there.
Solution: After the vSE is out of compatibility mode (see pg. 49 of the vCD 5.1 Install Guide), re-apply the service configuration (Right-Click vShield Edge Appliance in vCloud Director and select "Re-Apply Service Configuration"). You can also re-deploy the appliance or add an arbitrary rule to the firewall list - both appear to have the same effect.
That's about the shortest title I could think of to be descriptive of this issue. TLDR is that NAT rules on vShield Edge appliances appear to be causing unexpected behavior on VPN traffic after a vCloud upgrade from 1.5 to 5.1.
While vCloud Director doesn't show anything strange in the firewall section of vSE configuration, if you log in to vShield Manager and look at the firewall rules there, a "Deny" rule with the private/internal/translated IP is added for any NAT rule that exists:
This, I'm assuming, is for security reasons during the upgrade but it does not show up in vCloud Director (thus our confusion). After taking our appliances out of compatibility mode post-upgrade, the rules were still there.
Solution: After the vSE is out of compatibility mode (see pg. 49 of the vCD 5.1 Install Guide), re-apply the service configuration (Right-Click vShield Edge Appliance in vCloud Director and select "Re-Apply Service Configuration"). You can also re-deploy the appliance or add an arbitrary rule to the firewall list - both appear to have the same effect.
Everything looked good (even for the anonymous vSE devices still in compatibility mode)
ReplyDeleteVPN is offered to remote workplaces and individual clients with the goal that they can get to the system of the association in a successful way.buy vpn online
ReplyDeleteGreat Information sharing .. I am very happy to read this article .. thanks for giving us go through info.Fantastic nice. I appreciate this post. private internet access review
ReplyDeleteThe tips said in this article ought to have the capacity to enable you to pick the best VPN supplier. It is perfect to have a rundown of a couple of VPN suppliers. To pick the best specialist organization, you have to consider every one of the tips specified above while evaluating the shortlisted specialist organizations.VPN service
ReplyDeleteWhile free VPN services are good, the amount of security that they offer is questionable and you are only provided with a small list of servers to choose from. Moreover, the features of the VPN service are also limited.utorrent
ReplyDeleteWhat is VPN? VPN is a shortened form for virtual private system. It can be characterized as the strategy that is generally connected to add to the protection and the security into people in general and private systems, the web and Wi-Fi hotspots. read
ReplyDeleteHow effective the VPN server is will significantly affect the speed.india vpn proxy
ReplyDeleteI appreciated your work very thanks online
ReplyDeleteThanks for sharing nice information with us. i like your post and all you share with us is uptodate and quite informative, i would like to bookmark the page so i can come here again to read you, as you have done a wonderful job. online
This is very educational content and written well for a change. It's nice to see that some people still understand how to write a quality post! convert psd to wordpress theme
ReplyDeleteThis comment has been removed by the author.
ReplyDeleteAlso,https://novavpn.com/blog/yify/ running your VPN straightforwardly on a quicker CPU PC brings down the association time and consequently making your VPN speed to be speedier, than running the VPN on a switch.
ReplyDeletePersons appreciate shopping for amazing, appealing, fascinating and from time to time attractive aromas for them selves and pertaining to others. This can be executed conveniently along with inexpensively in an on-line perfume shop. diebestenvpn
ReplyDeleteWaow this is quite pleasant article, my sister love to read such type of post, I am going to tell her and bookmarking this webpage. Thanks https://prywatnoscwsieci.pl
ReplyDeleteThank you again for all the knowledge you distribute,Good post. I was very interested in the article, it's quite inspiring I should admit. I like visiting you site since I always come across interesting articles like this one.Great Job, I greatly appreciate that.Do Keep sharing! Regards, diadiktiokaiasfalia
ReplyDeleteSo luck to come across your excellent blog. Your blog brings me a great deal of fun.. Good luck with the site. lemigliorivpn
ReplyDeleteCorporates utilize it to impart in secrecy video, voice or information over an open system.https://www.router-reset.com/does-avast-vpn-keep-logs/
ReplyDeleteFor other helpful tips & tricks, or to submit your own question to be answered, visit my site at, http://whatsmyrouterip.com/.
ReplyDeleteI've been contemplating composing an extremely tantamount post in the course of the last couple of weeks, I'll most likely keep it straightforward and connection to this rather if thats cool. Much obliged vpnveteran.com
ReplyDeleteThis blog has communicated its importance in a short yet clear way, so compact.
ReplyDeletebest VPN service
It is likewise a decent choice when workers are dissipated everywhere throughout the globe. VPN for privacy
ReplyDeleteThis comment has been removed by the author.
ReplyDeleteWow, this is really interesting reading. I am glad I found this and got to read it. Great job on this content. I like it. https://allertaprivacy.it
ReplyDeleteI recently came across your article and have been reading along. I want to express my admiration of your writing skill and ability to make readers read from the beginning to the end. I would like to read newer posts and to share my thoughts with you. deze website
ReplyDelete