Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 6 replies
  • Subscribers 39 subscribers
  • Views 1414 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

1 x WAN, 1 x VPN Router and SMTP Proxy in MTA Mode Routing Problem

WepperCapper

Hi there,
my Problem:

I need to send my SMTP Traffic over an VPN Gateway with is connected to the same WAN as the XG.

Sadly I can't figure out to split up the Traffic into "Everything except SMTP" and "SMTP only". I configured the VPN Gateway as a second Gateway for the UTM.

 

I need to Route SMTP Traffic from the "Sophos XG SMTP Proxy" in MTA mode through Gateway 2.

Everything else has to take Gateway 1. I saw that the emails are coming from the WAN Interface 192.168.178.2 and are going to Gateway 1.

I tried several NAT - Rules, SD-WAN Policies, Gateway Weights, DCSP markings and several combinations, but sadly it seems like sometimes it works and sometimes it likes to use Gateway 2 for HTTP Traffic, or better VOIP Traffic.

I am coming from an UTM 9.7, where the Multipath Rules did perfectly fine for me. Right now I worked several evenings on this problem, but sadly I can't figure out how to fix this properly.

 

WAN Setup - "Gateway 1"

1 x DSL Router with IP 192.168.178.1

 

VPN Router - "Gateway 2 - VPN"

1 x WAN Interface 192.168.178.3 / GW 192.168.178.1

1 x "Internal Gateway" 10.10.10.254

 

Sophos XG Setup

1 x WAN Interface 192.168.178.2 / GW 192.168.178.1

1 x Internal Interface 10.11.10.254

1 x "VPN" Provider WAN Interface 10.11.12.1 / GW 10.11.12.254

 

Interal:

1 x Email Server in the 10.11.10.0/24 Network

 

Best regards,

 

WepperCapper

 

 



This thread was automatically locked due to age.
Parents
  • 0

    Forgot to mention:

    SFOS 18.0.0 GA-Build339 is used.

     

    Best regards,

    WepperCapper

  • 0 in reply to WepperCapper

    Wepper,

    with an SD-WAN policy, you should be able to route the SMTP traffic via VPN gateway. Make sure to configure the proper route precedence. To check route precedence:

    system route_precedence show

    to change the precedence priority use:

    system route_precedence set sdwan_policyroute static vpn

    In this example, SD-WAN policies is the first match and so on.

    If you are upgrading from V17, you also need to enable the reply packet:

    show routing sd-wan-policy-route reply-packet

    set routing sd-wan-policy-route reply-packet enable

    Regards

     

     

     
     
Reply
  • 0 in reply to WepperCapper

    Wepper,

    with an SD-WAN policy, you should be able to route the SMTP traffic via VPN gateway. Make sure to configure the proper route precedence. To check route precedence:

    system route_precedence show

    to change the precedence priority use:

    system route_precedence set sdwan_policyroute static vpn

    In this example, SD-WAN policies is the first match and so on.

    If you are upgrading from V17, you also need to enable the reply packet:

    show routing sd-wan-policy-route reply-packet

    set routing sd-wan-policy-route reply-packet enable

    Regards

     

     

     
     
Children
Unfiltered HTML