Sophos Firewall: v19.5 MR2: Feedback and experiences

We have an interesting problem after updating to MR2 (from 19.5-MR1). We have a web server that is made available via a DNAT rule in the DMZ. From the WAN this is not a problem, this works.

Since the update, we have some networks on the LAN that can no longer access the web server. Other networks from the LAN have no problem with this.

With a tcpdump I have seen that requests from the LAN without NAT go directly over the WAN interface to the Internet:

XGS5500_CI02_SFOS 19.5.2 MR-2-Build624 HA-Primary# tcpdump -i Port2 host 10.0.2.200
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on Port2, link-type EN10MB (Ethernet), capture size 262144 bytes
18:34:46.269798 Port2, OUT: IP 10.0.2.200.50011 > 10.0.5.80.https: Flags [SEW], seq 454467722, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
18:34:46.519736 Port2, OUT: IP 10.0.2.200.50012 > 10.0.5.80.https: Flags [SEW], seq 3042186263, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0

10.0.2.200 is the Client in LAN, 10.0.5.80 is the private IP of Web-Server in DMZ, Port2 is the WAN-Port

I have tried with different source IPs (in my NAT rule) to access the web server from the LAN. Whenever the DNAT rule takes effect, the traffic goes to the WAN without NAT instead of the DMZ. 

Hi Ben,

Thank you for reaching out to Sophos Community.

Apologies for the experience. Would it be possible to raise a case ID and share it here? 

Hello Ben,

Would it be possible for you to share access ID via PM?

Also, could you please share working and non-working tcpdump from LAN side clients as some networks are working as you mentioned?

Hi guys,

the Case ID is: 06543219. I also send the tcpdumps to Sanket and Support Access ID.

Ben

Hi Ben@Network ,

Thank you for the SR id, we'll get this expedited !

Hi Ben@Network ,

Thank you for the SR id, we'll get this expedited !

Hi guys,

I was able to isolate the problem with support. Shortly after the update, we had to set an SD-WAN route for a specific tunnel that overlapped with the IP scope of another tunnel (both via tunnel interfaces). To make this work we had to adjust the routing order. On the firewall, there was a forgotten config fragment that for specific networks (the exact networks it didn't work from), an SD-WAN profile should run Internet traffic over the WAN port with the least amount of jitter. By adjusting the routing order there was a collision with the DNAT rule. We disabled the SD-WAN route in doubt and now everything works as usual. 

Thank you for the very quick analysis by Sophos support. So I can confirm that the MR-2 is running stable.

Cheers,

Ben