Group Default IP Address Networks for Access Server

A user assigned to a group will be assigned an IP address from the group's default IP address network. If a subnet is defined on the group, that will be used instead. If neither is defined, an error message will result.

For example, Suppose you have the subnet 192.0.2.0/24; then you might have four connected clients, and Access Server assigns these IP addresses:

The process for a user looks like this:

Suppose you then define access for that user to other subnets using routing or NAT. Then Access Server grants access without issue. Because only one Access Server uses this subnet, one route can properly ensure routing functions.

One server = one group address pool.

Access Server 2.12 and newer handle the group default IP address network differently in a cluster setup. On older Access Server versions, the group default IP address network was assigned to all nodes. That means if you assigned the subnet 192.168.0.0/24, all nodes used it: Alpha, Beta, and Gamma. The same subnet cannot be routed to all three nodes, which makes routing impossible.

The new behavior with Access Server 2.12 and newer allows the administrator to assign unique group default address subnets to each node. That way, routing can now be set up to direct packets to the correct subnets.

This table helps provide an example:

Now, each cluster has its own VPN network and VPN clients. A subnet is no longer assigned to all clusters. This allows routing on cluster configurations where only NAT worked previously because it uses unique node subnets.