Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 6 replies
  • Subscribers 6 subscribers
  • Views 1633 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos RED-Tunnel between two UTM´s and two active Uplinks - Multipath Rules not working

it-Abteilung R

Hi everybody,

we´ve got the following setup and I´m pretty sure that I´ve discovered a bug in UTM.

We´ve got a SG430 in the headquater and SG115 in the branch-offices.

In the headquater we have two active wired internet connections for internet breakout (uplink balancing)

In the branch-office we have a wired internet connection and additionally a LTE-Connection connected via LTE-Modem over network (ethernet) attachted to the firewall.

We´ve configured two RED-Tunnels (in the branch-office) which point to the public address(es) of the headquater-firewall.

The config is working so far and everything is fine - except the traffic flow. Here´s the error / misbehaviour:

We´ve configured both internet connections in uplink balancing (wired: 100 percent) and LTE: 0 Percent.

Furthermore we´ve implemented two Multipath Rules (Any Source, Any Service, Destination of the public IP´s of the HQ-Firewall) with an Interface Persistance bound to the wired connection of the branch office. - Option "Skip Rule on Interface Error" is enabled -> Aim is to have both connections active, but traffic should normally go through the wired connection and in event of failure switch to the LTE-Connection.

What happend with this setup in place is, that both connections were used for RED-Traffic, although we tried to stick the traffic to the wired connection.

Therefore the traffic-limit of the LTE-Connection has been reached quiet quickly and the performance broke down....

We´ve done a tcpdump on the interface where the LTE-Modem is connected and could see that the RED-Traffic goes through that interface

Here´s an example-output of the dump:

16:01:06.287243 IP gw-xxx.yyy.com.redv2-data > zzz.yyy.com.redv2-data: UDP, length 116

Strange is, that the headquater-firewall in RED-Management says that both RED-Tunnels come from the public IP-Address of the wired connection of the branch-office...

My question is, has anybody an idea how to solve this? Or any hint? - Or is it actually a case for the support...



This thread was automatically locked due to age.
Parents
  • +1

    Are you by any chance using the "new" RED protocol? I've seen this on a setup I worked a few weeks ago. Despite using multipath rules to force RED traffic through an specific WAN it was actually balancing traffic between both WANs. I only noticed that because one of my WANs was flapping back and forth and (to my complete awe) I had half of my clients losing communication with the remote network and half of them working fine. When tcpdumping the traffic between the UTMs I noticed that half of it were going though a WAN and half though another, completely ignoring my multiptah rule. I think this have something to do with this new SD-WAN approach Sophos is trying to achieve.

    Long story short: I switched the tunnel to legacy mode and this behavior went away. 

Reply
  • +1

    Are you by any chance using the "new" RED protocol? I've seen this on a setup I worked a few weeks ago. Despite using multipath rules to force RED traffic through an specific WAN it was actually balancing traffic between both WANs. I only noticed that because one of my WANs was flapping back and forth and (to my complete awe) I had half of my clients losing communication with the remote network and half of them working fine. When tcpdumping the traffic between the UTMs I noticed that half of it were going though a WAN and half though another, completely ignoring my multiptah rule. I think this have something to do with this new SD-WAN approach Sophos is trying to achieve.

    Long story short: I switched the tunnel to legacy mode and this behavior went away. 

Children
  • 0 in reply to giomoda

    Hi folks,

    I got into contact with our sophos reseller to open a ticket for this issue.

    Yes, we are using the REDv2 Tunnels. I believe it could be the reason and it would explain this behaviour.

    Unfortunately we´ve rolled out all the connections and switching the tunnel to legacy would mean to rebuild all connections, isn´t it?

    Or is there any "hack" to switch the tunnel-config to legacy "manually"? - Big deal to switch all connections then...

    In general as you noticed giomoda, this behaviour sounds like a bug, not like a feature. Autobalancing is ok in general (like a "SD-WAN" feature), but there should be a possibility to suppress this behaviour.

  • 0 in reply to giomoda

    Hi giomoda,

    I´ve rebuilt the configuration on one site with legacy tunnels and now it´s working - as you said. Great!

    Additionally I have no multipath rules in place and the traffic flows over the primary line - as I planned initially.

    Unfortunately I still have no feedback from our reseller regarding the sophos-ticket.

    I will keep my hands on the issue regarding REDv2 Tunnel and stay tuned here.

    I expect that there won´t be a quick solution presended by sophos, so I will migrate the other connections to legacy tunnel, too.

Unfiltered HTML