This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Uplink Balancing Problem

Hello,

I have a problem with uplink balancing. This is a simple drawing of the configuration:

Little description:

We have two Internet-Links, Cable, with 8 IPs and a static LTE.

Cable-Switch is only for splitting Cable-IPs.

We work locally and remotely on a terminal server (which is what VPN-Router is for).

"Local Internet" is supplied by the Sophos, and is the network 10.10.10.0/24. The VPN-Router is also part of this network.

VPN-Router uses two internet uplinks two create two VPN-tunnels, one over Cable-Internet (WAN1) and one over LTE (WAN2). VPN-Router manages failover itself, so it needs two active links. It is not configured by us, but comes preconfigured. All we had to give them is a gateway address for the 2nd uplink (WAN2).

 

Current configuration:

Uplink Balancing:

Active Interfaces: LTE

Standby Interfaces: DSL

In this configuration the VPN-Router has no problems. However the switch between the links takes a while, causing some other problems locally (with another VPNs).

 

So I tried following configuration:

Active Interfaces: LTE (Weight 100) and DSL (Weight 0)

This configuration made for way better balancing, so that if LTE went dead, Cable took over almost instantly - locally it works better than using Standby.

 

However, and this is the actual problem:

WAN2 on the VPN-Router doesn't seem to work properly with this configuration. When I switch to the new configuration with two active interfaces, 100/0 balancing, all is working fine for a while, but only until LTE-Link drops. After that, VPN-Router doesn't connect the 2nd VPN over WAN2 any more. The only way to make it connect again is to reset the configuration to Active/Standby Interface.

 

I hope I explained this as good as possible and hope someone can help.

Thank you.



This thread was automatically locked due to age.
Parents
  • I don't understand your diagram, Kosta - what is the extra arrow from the cable switch to the UTM?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Not sure how to better explain it.

    LTE is the primary WAN for SG125. Cable is secondary WAN, and since my cable modem has only one port and 8 IPs, I divide it with a switch. That arrow is the connection from a port of an 8-port switch to SG125 WAN2.

    The reason is because our company who supplied the VPN router REQUIRES me to give the VPN router a direct connection (not NATted from the Sophos).

  • Sorry, I've re-read the description and can't figure out which IPs are where, how you can work both locally and remotely on a terminal server, where the "switch between the links" takes place, etc.  So, just a guess - have you tried a Multipath rule binding 'Any -> Any -> Any' to the LTE interface and just leaving both in 'Active'?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • This reply was deleted.
  • Any replies to this issue?

  • What Multipath rules do you have for this?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • None. No Multipath-Rule.

    There is however a small update:

    It seems that if I set Masquerading on that 2nd-WAN link  for the VPN-Router on the Sophos to go over Uplink Interface, instead of LTE-Link only, the problem seems to go away. Can it be that simple?

  • Yes!

    Cheers - Bob
    PS I would still use a Multipath rule with both Interfaces in 'Active' as I suggested above.

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • Yes!

    Cheers - Bob
    PS I would still use a Multipath rule with both Interfaces in 'Active' as I suggested above.

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children