Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 14 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 22316 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem's making a failover vpn connection + static routes. Advice???

Corey-FTK

So I'm in an interesting situation where I cannot seem to do something as simple as I could in cisco land. The first major issue i've run into in a while with utm.

 

Problem: I need a VPN tunnel of some sort as a failover of a privately managed VPN (MPLS) to cover provide outages. This is routed to by a static route on each gateway (BGP in the future).

 

Option1/Issue1: Create a site2site IPSEC tunnel. This would not work as you cannot set the ipsec-tunnel metric in Sophos UTM. So the tunnel will always have a lower metric that the static route to the MPLS router.

 

Option2/Issue2: Create a site2site Red Tunnel. I had high hopes for this but apparently (for whatever stupid reason) you cannot create a static route for the same destination network (even with a different metric) in Sophos UTM.

 

Does anyone have any ideas? At the moment I may be stuck going the IPSec-tunnel route and just turning the main offices profile off unless there is an outage. But i would rather have an option that was live and could be monitored side by side.

 

EDIT: Saw this https://community.sophos.com/kb/en-us/120239 but this won't help as the gateways, in theory, would be pingable even if the provider's network was down as the first hoop (the gateway) it is local. An even if we had a user unplug one end, there is no chance we could do it at our main office.

Seems very silly that Sophos does not allow us to configure multiple static routes or backup routes. I can understand not setting weight for site2site tunnels but routes, honestly what damage could really be done, and if there were people putting is silly configs then maybe they should not be fiddling with them in the first place. They are likely to do the same damage with 1 route vs multi anyways.



This thread was automatically locked due to age.
  • 0

    Option 1 would work when you tick 'Bind tunnel to local interface' box. With this ticked, the VPN will NOT make a route to the network and you can create one yourself with a different metric....

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels

    But how would you configure this if you cannot set a static route for the same destination network?

    For Reference (replaced ips):

    • Network 1 - 172.16.1.0/24, UTM_1 - 172.16.1.250, MPLS_GW_1 - 172.16.1.230
    • Network 2 - 172.16.2.0/24, UTM_2 - 172.16.2.250, MPLS_GW_2 - 172.16.2.230
    • IPSec tunnel created between public WAN ip's with "Strict Routing" OFF, "Bind Tunnel to local interface" ON.

    The original routes would look like:

    • "Gateway Route | 172.16.2.0/24 via 172.16.1.230 | metric 5" (route to network 2 via mpls_gw_1 from internal interface on utm_1)
    • "Gateway Route | 172.16.1.0/24 via 172.16.2.230 | metric 5" (route to network 1 via mpls_gw_2 from internal interface on utm_2)

    So then how do you add the secondary route over the ipsec-tunnel? Cant use a gateway route because the same issue occurs (same destination network). Interface route doesn't make sense because the ipsec-tunnel isn't a defined interface.

    Am I missing something?

     

    edit: more details

  • 0 in reply to Corey-FTK

    Sorry, my bad... Indeed you cannot create 2 routes to the same network. What you can do is use Multipath Rules. You can configure a multipath rule for traffic from local network to remote network and select which interface to use. By checking the checkbox for Skip rule on interface error the rule will not be evaluated and you can create a second rule just like this one for the normal external interface. These rules should both use Itf persistence set to 'By Interface'.

    If your MPLS interface is also an interface with a default gateway set (just like the WAN connection), you could create only 1 rule using Uplink Interfaces and Itf Persistence set  'By connection'. In this case both interfaces will be used simultaneously.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels

    apijnappels said:
    If your MPLS interface is also an interface with a default gateway set (just like the WAN connection), you could create only 1 rule using Uplink Interfaces and Itf Persistence set  'By connection'. In this case both interfaces will be used simultaneously.

    Yeah, I had that idea, but the MPLS Interface is currently on the LAN. We implemented it this way so that the servers didn't desync if the utm's went down at head office site. For now, I've written a script that will toggle the routes on/off (at both affected sites) based on criteria. I went with a RED tunnel so that each sides interface could be easily monitored.

    It's a shame but at least a workaround for the moment. I hope in the future they add this because there isn't really a reason not to have it if the precautions for it are setup correctly.

  • 0 in reply to Corey-FTK

    Hi, Corey, and welcome to the UTM Community!

    In fact, I believe you can have two separate Static Routes to the same subnet.  Did you try with different metrics?  I know I've done this in the past, but maybe it was with Policy Routes???

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    BAlfson said:
    In fact, I believe you can have two separate Static Routes to the same subnet.

    Hey Bob,

    Not according to the GUI you cannot. This is the message you get if you try to configure two static routes (diff metric, diff gateway, same dest subnet) in the UTM.

     

    Regards,

    Corey

  • 0 in reply to Corey-FTK

    I'm having the exact same problem as Corey.

     

    I have a static route to a remote network. I've set this metric to 1 (static route metric). I need to configure an additional route to the same network, with a higher metric, through my alternative path, in case the first one goes off.

    If you try to do so, the GUI presents you with the same error message pasted.

    This is a common routing functionality, I can't understand why Sophos can't do it. What are metrics ther for in this case?

  • 0 in reply to Corey-FTK

    Just to add some interesting information:

    I've figured out a way around the stupid GUI of Sophos UTM regarding Static Routes. It's completely retarded.

    I was enabling the same configuration on my other end hoping to test the priority and stumbled into this behavior.

     

    Check this out:

    In this end, I have a Network Group (instead of a normal Network object), which contains the multiple remote networks I want to add a fallback route to. Notice the Network Group is exactly the same on both rules.

    Note the group is EXACTLY THE SAME in both rules, thus hey contain the exact same networks.

    Now you just enable both and... voilà! Stupid GUI lets you do it without complaining with that unbelievably idiotic error message.

     

     

    Now, back to reality, if you try to do so with a normal Network Object...

    Again, same object, but now they are of 'Network' type (not a group with multiple, identical ones). Then, you get the stupid message that doesn't know what a goddam 'Metric' stands for.

    Then, to work around this, I've created a Network Group object, inserted some stupid single address object (WHICH IS ALREADY INSIDE OF THIS SAME NETWORK RANGE!!!!) and

    Voilà!

     

    Seriously.... this....


    Now I need only to check if the system will abide by those. I wonder that it'll do.

  • 0 in reply to Thiago Palmeira

    Thiago, this is a new glitch in WebAdmin.  If you are on V9.506, please open a ticket with Sophos Support to make sure this bug is addressed.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    BAlfson said:

    Thiago, this is a new glitch in WebAdmin.

    Hello ,

    Yes, v9.506002 here (latest stable so far).

    By "new glitch" you mean exactly what? The 'workaround' of adding Network Group objects instead of just Network Objects, or the behavior of the GUI telling you cannot add multiple routes to the same network, regardless of metric?

    I as this because I was able to trace reports of the same issue (not being able to add metric routing) back in 2014, which is a long time.

     

    Regards,

Unfiltered HTML