snat multiple gateways

SNAT with multiple WAN gateways isn't working..

WAN Gateway 1 = Port3 - its public with /27 worth of aliases

WAN Gateway 2 = Port5 - its public with /28 worth of aliases

(IP Host) SNAT with Port3 aliases work for all of the rules I've created.

(IP Host) SNAT rules for Port5 don't work at all. They use the main Port3 address no matter what I do.

Anyone know how to fix this? I'm not doing any thing exotic. Not using SD-Wan or failover...Just simple rules for in and simple rules for out.

Added TAGs
[edited by: Raphael Alganes at 9:57 AM (GMT -7) on 16 Oct 2024]

Top Replies

Mayur Makvana 4 hours ago in reply to midnightSun +1

Hello, You need to review the settings of " Override source translation (SNAT) for specific outbound interfaces" in snapshot shared. You might wants to open support ticket to understand or differentiate…

Parents

0 LuCar Toni 4 hours ago

NAT is not doing Routing.
NAT will do what you tell NAT should do. But the Routing is another story.
If you tell the Firewall to use a SNAT IP for a matching traffic, it will do it.
But if the routing decision for example is another Port, then we will SNAT the wrong IP for your Outbound Port.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 midnightSun 3 hours ago in reply to LuCar Toni
How does that apply to SNAT when using Multiple WANs?

LAN to WAN3:6

LAN to WAN5:3

You wrote = "If you tell the Firewall to use a SNAT IP for a matching traffic, it will do it."

I'm finding its not doing it when using different ports.

My mail servers need to leave via specific IPs so headers match DNS lookups.
echo " __ __ __ __ __ _______ "; echo ".--------.|__|.--| |.-----.|__|.-----.| |--.| |_ | __|.--.--..-----."; echo "| || || _ || || || _ || || _||__ || | || |"; echo "|__|__|__||__||_____||__|__||__||___ ||__|__||____||_______||_____||__|__|"; echo " |_____| ";

~~~ I miss Port 17. Remember using telnet to get the Quote of the Day? Maybe I'll set one up for all the port scanners. ~~~
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni 2 hours ago in reply to midnightSun

You have a default SNAT, which will use the SNAT IP of the interface.

If you want to specify the alias of the port, you need an own SNAT Rule, matching the traffic you want to SNAT.

Your use case is here: https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/Email/HowToArticles/EmailSetupMTAModeWithMultipleWANPortsOrAliasIPAddresses/index.html

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel

Reply

0 LuCar Toni 2 hours ago in reply to midnightSun

You have a default SNAT, which will use the SNAT IP of the interface.

If you want to specify the alias of the port, you need an own SNAT Rule, matching the traffic you want to SNAT.

Your use case is here: https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/Email/HowToArticles/EmailSetupMTAModeWithMultipleWANPortsOrAliasIPAddresses/index.html

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel

Children

No Data