Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 6 replies
  • Subscribers 6 subscribers
  • Views 1626 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos RED-Tunnel between two UTM´s and two active Uplinks - Multipath Rules not working

it-Abteilung R

Hi everybody,

we´ve got the following setup and I´m pretty sure that I´ve discovered a bug in UTM.

We´ve got a SG430 in the headquater and SG115 in the branch-offices.

In the headquater we have two active wired internet connections for internet breakout (uplink balancing)

In the branch-office we have a wired internet connection and additionally a LTE-Connection connected via LTE-Modem over network (ethernet) attachted to the firewall.

We´ve configured two RED-Tunnels (in the branch-office) which point to the public address(es) of the headquater-firewall.

The config is working so far and everything is fine - except the traffic flow. Here´s the error / misbehaviour:

We´ve configured both internet connections in uplink balancing (wired: 100 percent) and LTE: 0 Percent.

Furthermore we´ve implemented two Multipath Rules (Any Source, Any Service, Destination of the public IP´s of the HQ-Firewall) with an Interface Persistance bound to the wired connection of the branch office. - Option "Skip Rule on Interface Error" is enabled -> Aim is to have both connections active, but traffic should normally go through the wired connection and in event of failure switch to the LTE-Connection.

What happend with this setup in place is, that both connections were used for RED-Traffic, although we tried to stick the traffic to the wired connection.

Therefore the traffic-limit of the LTE-Connection has been reached quiet quickly and the performance broke down....

We´ve done a tcpdump on the interface where the LTE-Modem is connected and could see that the RED-Traffic goes through that interface

Here´s an example-output of the dump:

16:01:06.287243 IP gw-xxx.yyy.com.redv2-data > zzz.yyy.com.redv2-data: UDP, length 116

Strange is, that the headquater-firewall in RED-Management says that both RED-Tunnels come from the public IP-Address of the wired connection of the branch-office...

My question is, has anybody an idea how to solve this? Or any hint? - Or is it actually a case for the support...



This thread was automatically locked due to age.
Parents
  • 0

    Hallo and welcome to the UTM Community!

    Please show pictures of the Edits of the relevant configurations: RED Server, Interfaces using reds# and redc#, firewall rules,Static Routes & Multipath rules.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0

    Hallo and welcome to the UTM Community!

    Please show pictures of the Edits of the relevant configurations: RED Server, Interfaces using reds# and redc#, firewall rules,Static Routes & Multipath rules.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
  • 0 in reply to BAlfson

    Hi BAlfson,

     

    here´s the relevant Configuration. Beginning at the Headquater-Side:

     

    Red-Tunnel defined:

     

    Interfaces defined with RED-„Hardware“

     

     

     

     

    Here´s the Config on the Branch-Office Side:

     

    Two WAN-Connections:

     

     

    Secondary Line is set to 0 Weight.

     

     

     

    redc23 is pointing to the public primary address of the HQ-Firewall

    redc25 is pointing to the public secondary address of the HQ-Firewall

     

    Interfaces defined with RED-„Hardware“

     

     

    We are using transfer-networks (/30) for traffic distribution in the RED-Tunnel. Routing is done via OSPF. Secondary Route has higher cost than primary.

     

     

    Here are the multipath-rules which I created afterwards, after I recognized that traffic went over the LTE-Connection

     

    Of course, they were enabled when I looked at the tcpdump...

    Reseted everything, restarted the firewalls on the branch-office side and so on...

    Both Rules are enabled with Checkbox „Skip rule on Interface error“.

    With these rules in place I tried to bind any traffic destined to the public IP´s of the Headquater to the primary WAN-Interface of the branch-office.

     Unfortunately this does not work, as expected...

  • 0 in reply to it-Abteilung R

    " Routing is done via OSPF. Secondary Route has higher cost than primary." - were those routes active during the testing of the Multipath rules?  I don't know how OSPF interacts with Multipath rules.

    I don't see anything else to question.  Someone else needs to look inside your WebAdmin.  What does Sophos Support say about this situation?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML