How does Secure Connect deal with NAT rules?

[Bucket]

If spokes receive a default route from the SC hubs, does that mean NAT (1:1, 1:many, port forwards) on the spoke stops working when SC is enabled?

[PhilipDAth]

I haven't tested this - but I would expect this to be the case (nat stops working).

You would need to change the device to being in hub mode so its Internet didn't go via SecureConnect.

BUT - could you configure it as a zero trust application and access it using that method?

[SahandC · Accepted solution]

Hi Bucket, it isn't that NAT stops working, it's that the default route installed to the appliance creates an asymmetric route.

For sites with resources that need to be accessible from the public internet, you need to either create a VPN exclusion rule to break traffic out of the VPN tunnel, or deploy the appliance as a hub to prevent the default route from being propagated.

[Kriver]

Correct, the issue arises due to asymmetric routing, as return traffic exits at the POP within the Secure Connect data center. Unfortunately, in some cases, it’s not possible to exclude these IPs from the VPN or configure them as a hub. This limitation is a significant blocker for us in adopting Secure Connect, and we hope it will be addressed in a future update.