Policy Routes and Web Proxy

Hello Nico Klinger ,

Thank you for reaching out to the community, Please refer the following useful KBAs:
> Sophos UTM: Uplink Balancing and Multipath rules.
> Multipath Rules.
> Change the outgoing interface for web filtering.

Hello Vivek Jagad ,

thank you for your answer. Unfortunately your first two answers don't answer my question because it's just information about multipath routes. The only reference regarding proxies is a note which states that connections by source are not possible with proxies except for web-proxies. But my question is, if the web-proxy routes traffic by policy routes or only by multipath routes.

The third link was actually helpful because I didn't know that the option for optional outgoing interface had to be enabled first. However it is not possible to define web-filter profiles based on destination. This however is necessary for our configuration. In general we want to divide the traffic among all WAN interfaces. Only for specific services where the request has to come from a certain ip address should be routed separately.

It might be possible to divide our 1000+ users into groups based on these services but that wouldn't change the fact, that the majority of the traffic that they generate should not be bound to a wan interface. It would also be possible to configure proxy exceptions on all hosts for all users, so the traffic would not use the proxy and it would be possible to route the traffic with policy routes.

However my problem is not that I have to create multipath routes for certain destinations which are accessed by the clients via the web proxy. My problem is that I couldn't find a KBA where routing for the web-proxy is defined. Without that I'm not sure if we have an underlying configuration problem with our UTM firewall.

Kind regards,

Nico

Hello Vivek Jagad ,

thank you for your answer. Unfortunately your first two answers don't answer my question because it's just information about multipath routes. The only reference regarding proxies is a note which states that connections by source are not possible with proxies except for web-proxies. But my question is, if the web-proxy routes traffic by policy routes or only by multipath routes.

The third link was actually helpful because I didn't know that the option for optional outgoing interface had to be enabled first. However it is not possible to define web-filter profiles based on destination. This however is necessary for our configuration. In general we want to divide the traffic among all WAN interfaces. Only for specific services where the request has to come from a certain ip address should be routed separately.

It might be possible to divide our 1000+ users into groups based on these services but that wouldn't change the fact, that the majority of the traffic that they generate should not be bound to a wan interface. It would also be possible to configure proxy exceptions on all hosts for all users, so the traffic would not use the proxy and it would be possible to route the traffic with policy routes.

However my problem is not that I have to create multipath routes for certain destinations which are accessed by the clients via the web proxy. My problem is that I couldn't find a KBA where routing for the web-proxy is defined. Without that I'm not sure if we have an underlying configuration problem with our UTM firewall.

Kind regards,

Nico

Hey Nico Klinger ,

You can refer the concepts in the following recommended read:
> Sophos UTM: Securing and Configuring Web Filtering
> Sophos UTM: How to troubleshoot web filtering

Hello Vivek Jagad ,

routing is not mentioned in both articles.

Kind regards,

Nico Klinger

if you are looking for a dedicated routing article the we have a guide here - https://docs.sophos.com/nsg/sophos-utm/utm/9.708/help/en-us/Content/utm/utmAdminGuide/RoutingStaticPolicyRoutes.htm

I'm looking for a specific information about routing an web-proxy. As mentioned above, my policy routes don't affect routing of the web-proxy for the clients. The "same" (interface rule) rule works in multipath routing with the web-proxy. And would like to know if this is expected behavior (web-proxy not affected by policy routes).

I was wondering if I need the web-proxy port (standard proxy) for the policy route. It's certainly not needed for the multipath route. But I'm going to test it anyway.

Kind regards,

Nico Klinger

Edit: Test failed. Setting the service in the policy route to the web-proxy service had no effect.