Sophos UTM9 is ip logging per interface possible?

Hallo Kay and welcome to the UTM Community!

The UTM is a stateful firewall.  The connection tracker will route responses back to the requester before any rules are considered - see #2 in Rulz (last updated 2021-02-16).  After that, you could select to have firewall (both manual and automatically-created) rules logged.  Maybe you don't need to go to all that effort.  What is the issue that caused you to think of this approach?

Cheers - Bob

Hi Bob, thank you for your fast reply. The Situation is as follows: One Firewall with two uplinks (one slow, one fast) is serving two companies, that are somehow connected. They are using the slow interface for everything, and the fast one for their VoIP. One of the companies wasn`t (surprise, surprise) not happy with their IT-Service anymore, so they came to us, and we try to Tidy up this mess. We have to figure out, which line is used by whom and what, before we configure anything to be routed via the fast line.

I hope i could you can make something out of my writing.

Cheers, Kay

Please insert a picture of the active rules on the 'Multipath Rules' tab in 'Interfaces & Routing'.  Also, one of the 'Default Web Filter Profile' on the 'Global' tab in 'Web Filtering'.

Cheers - Bob