SSL VPN cannot working when LAN interface choosed using Sub-interface (VLAN)

is SSL VPN in NGAF cannot support when we used Sub interface(VLAN) ?

In certain network configurations, SSL VPNs might encounter limitations when deployed over subinterfaces or VLANs due to potential complexities in routing and encapsulation. While SSL VPNs can function across VLANs with proper configuration and routing settings, certain firewall or NGAF (Next-Generation Application Firewall) setups might pose challenges when handling traffic traversing VLANs, leading to issues with SSL VPN functionality. These challenges could arise from misconfigured routing, improper handling of VLAN tagging, or limitations within the NGAF system itself, potentially causing difficulties in passing SSL VPN traffic across subinterfaces or VLANs within the network architecture. Therefore, thorough configuration analysis and potential adjustments within the NGAF and VLAN settings might be necessary to enable proper SSL VPN support across subinterfaces or VLANs.

Here are some of the considerations for using SSL VPN with sub interfaces (VLANs) in NGAF:

Compatibility and Configuration:

    General Support: Most NGAFs support SSL VPN with sub interfaces, but specific configurations and limitations may vary depending on the vendor and model.
    Thorough Documentation Review: Always consult your NGAF's documentation for precise guidance and configuration steps.

Potential Considerations:

    VLAN Configuration:
        Ensure correct VLAN configuration on both the NGAF and the interface.
        Verify that the SSL VPN configuration is aware of and uses the appropriate VLAN.
    Routing:
        Confirm proper routing between the sub interface and other network segments to guarantee VPN traffic flow.
    Access Control:
        Implement appropriate access control rules on the NGAF to manage VPN traffic based on VLAN membership.
    NAT:
        If Network Address Translation (NAT) is involved, consider its configuration and potential impact on VPN traffic.
    Performance:
        Sub interfaces can introduce some overhead, so assess potential performance impacts, especially for high-traffic VPNs.
        Monitor resource usage and adjust configurations if needed.

Best Practices:

    Planning and Testing:
        Carefully plan the SSL VPN deployment with sub interfaces, considering network design, security requirements, and performance implications.
        Conduct thorough testing in a non-production environment to ensure compatibility and functionality before deployment.
    Vendor Support:
        If unsure, consult your NGAF vendor's support for best practices and troubleshooting specific to your setup.

Additional Information:

    Specific NGAF Details: For more tailored guidance, please provide the vendor and model of your NGAF.
    Diagrams and Visuals: If you have access to network diagrams or configuration examples, sharing them could facilitate a more accurate assessment.

SSL VPN only support physical interface or sub-interface it cannot be used on virtual interfaces.

at the deployment of ssl vpn can choose specific interface

HiHi,

SSL VPN cannot be deployed on virtual interfaces.

For SSL VPN:

The LAN or WAN interface under Deployment doesn’t support the VLAN interface.

It only supports the physical interface or Sub-Interface (It only supports the WAN interface).

Hi, no problem to use ssl vpn to reach some sub networks (vlan) in your environment. You have to adjust traffic rules in order to define where vpn ssl users can go (in order to permit/exclude reaching some networks related to your vlan)

Yes, SSL supports  Sub-Interfaces on WAN sites