SNAT with Multipath Rules / Dual WAN Setup

Question

Hi all, 
 I have a question on the correct configuration of SNAT in a Dual WAN Environment. Or if it's the right approach to do it at all. 
 As mentioned I have 2 ISPs connected to the UTM. They are both set up as active Uplink Interfaces, the slower Connection is weighted 0, the faster one 100, the purpose is distributing traffic manually over the two lines as needed with Multipath rules but having WAN Failover in place. 
 
 Multipath rules are used to route services over the specific Interfaces (skipping rule on Interface error active for failover). 
 Internal Network is masqueraded with Primary Interface Address -> Uplink Interfaces. 
 DNAT Rules are in place for each public IP Address to ensure that traffic gets to the correct internal destinations over both ISP connections. 
 
 This far everything works fine! 
 Now I'm trying to make sure that traffic from several internal servers leave with the correct public IP for each Provider. The behaviour of outgoing traffic at this point is, that the Primary Interface address of the active WAN Uplink is used - which is as expected because of the masquerading rule above. 
 But I need several Hosts/Services use a specific public IP of the current active WAN Connection. Therefore I tried 2 SNAT Rules for each ISP like the following example for our Remote Desktop Session Host: 
 SNAT1: Traffic selector: RDSH1(Internal Host Address) -> RDSH-GW-Ports (HTTP/HTTPS) -> Internet IPv4 Source translation: WAN #1 RDSH1 (Additional Address) SNAT2: Traffic selector: RDSH1(Internal Host Address) -> RDSH-GW-Ports (HTTP/HTTPS) -> Internet IPv4 Source translation: WAN #2 RDSH1 (Additional Address) 
 But it doesn't seem work. If both WAN Interfaces are up, traffic is always coming from SNAT1 rule WAN #1 RDSH1 Address instead of SNAT2 which would be the actively used ISP as defined by Multipath. Changing order makes no difference. But I can verify that the Multipath rule is working and traffic is leaving over the right WAN Interface (WAN #2). I can also confirm that the right DNAT rule is working for WAN #2 through Firewall log so the correct incoming public IP is used, but the answer is masked with the wrong source IP from the other SNAT1 Rule. 
 Strange thing is, an equal configuration for our mail Server seems to be working. The only difference in the config is the traffic selector of the SNAT rule, which is any instead of the host: 
 SNAT3: Traffic selector: ANY -> SMTP -> Internet IPv4 Source translation: WAN #1 MAILSVR1 (Additional Address) SNAT4: Traffic selector: ANY -> SMTP -> Internet IPv4 Source translation: WAN #2 MAILSVR1 (Additional Address) 
 But I can not use ANY as traffic selector for the Remote Desktop Session Host, as I have several other Server with the same Service set (HTTP/HTTPS) which need to take their own routes. 
 In another post, I read a reply from BAlfson which suggested that it might be smarter to use Masquerade Rules instead of SNAT/DNAT rules to route the traffic? May be this would be the proper way to do it? 
 I'm really stuck here, may be anyone could point me in the right direction? Thanks a lot in advance!

BAlfson · Accepted Answer

Hi Martin, 
 Yes, now that Masq rules are in an ordered list, you should use them. However, if this is traffic that goes through Web Filtering neither NAT approach will work. Multipath rules know the origin of traffic coming to them from the Proxy, but the Proxy has already changed the source of the packets, so you can't use the LAN addresses in NAT rules. 
 In any case, I'm a little confused about the need to change the outgoing IP on responses to traffic that was initiated from the outside. If a connection from the Internet was initiated on "WAN#1 [RDSH1] (Address)," the connection tracker will send all traffic back out from that address and the Multipath rules will not be consulted. Is that what's happening? 
 Maybe we should be talking about the goal instead of assuming that either of us has already asked the right question. 
 Cheers - Bob

BAlfson · Answer

" WAN#2 is offering 5 static public IPs but cannot distribute them over a Network range, public IP is distributed over MAC DHCP reservation per WAN Interface." 
 If your ISP's device supports VLANs, you could use a single physical NIC, but your current solution is good. All of your configuration looks good with two exceptions... 
 " Remote Desktop Gateway should always go out to the Internet with Additional Address #2 (gateway.domain.com / 212.15.0.3) WAN#1 and return this way. " 
 The only thing that determines with which public IP the traffic leaves is the IP that the initiating traffic arrived onn (connection tracking). Only your monitoring service's changing the IP of your FQDN makes any difference here. Any Multipath rule would be redundant. 
 In your fail over scenario: 
 "Mailserver has to go out over ISP2 WAN#2 (mail.domain.com / 9.5.10.100) and return this way (to DNAT it to the Mailserver and SPF/Anti SPAM configuration etc.) " 
 I think I would have two MX records with the one at a lower priority that points at an FQDN for the second ISP. A Multipath rule will take care of outbound traffic, and Masq or SNAT rules can determine the public IP. You shouldn't use a DNAT for SMTP if you're using the SMTP Proxy - see #2 in Rulz . If you're already configured like Basic Exchange setup with SMTP Proxy , you might want to consider using Webserver Protection for external client access: Exchange WAF Guide . 
 If you still have troubles with SNATs and Masq rules, please insert pictures of them. 
 Cheers - Bob