Setting up second wan connection.

RE: Setting up second wan connection.

Budgie2 — Fri, 03 Dec 2021 14:35:20 GMT

Hi Bob,

Just wanted to apologise to you for making such a meal of this and to thank you for your help.

My problems were due to lack of know how on my part and a mis-configured router thanks to ISP.

With some additional help from Dirk and some time on phone with ISP I now have the basics sorted out and have two WAN connections. I therefore am closing this thread and thanks again,

Budge

RE: Setting up second wan connection.

Budgie2 — Mon, 29 Nov 2021 15:15:01 GMT

Hi Bob,

Had to leave the second connection mid thread while trying to keep business running. Should have finished it as now I need the fallback connection to work and it doesn't. Please could I resume on this thread or should I start over.

Regards,

Budge

RE: Setting up second wan connection.

Budgie2 — Thu, 23 Sep 2021 17:57:48 GMT

Bob I mistyped. I was referring to Uplink balancing.

I shall gladly share a few lines from the Web Filtering log when I know where to find them and copy them. All new stuff to me I regret.

RE: Setting up second wan connection.

BAlfson — Thu, 23 Sep 2021 14:50:00 GMT

"Uplink" balancing is different from "load" balancing. The latter applies to inbound traffic that's load-balanced between two or more servers.

Show a few lines from the Web Filtering log where the traffic is blocked.

Cheers - Bob

RE: Setting up second wan connection.

Budgie2 — Thu, 23 Sep 2021 09:03:28 GMT

Hi Bob,

As usual I am finding this hard going. I was able to select the button on WebAdmin and download the certificate to my laptop. I was then able to go into Firefox an upload the certificate using settings security pages in Firefox. To be sure I rebooted but sadly when I then enabled the default GW on the AAISP port and the load balancing clicked in, I still could not access a website. This really shouldn't be this hard. Where next?

RE: Setting up second wan connection.

BAlfson — Wed, 22 Sep 2021 22:36:50 GMT

That PC needs to have the Proxy CA from the UTM installed on it, Alaatair. You can download that in WebAdmin or via the User Portal. With a second WAN connection, you want Uplink Balancing enabled.

Cheers - Bob

RE: Setting up second wan connection.

Budgie2 — Wed, 22 Sep 2021 10:14:36 GMT

OK, I have checked out my other broadband connection with AAISP. The connection is up and working. The router lan port is configured as a normal access port with DHCP and default GW and I can connect to it with laptop and browse. All OK so far.

On the UTM I have set up a dedicated access port, port 1 on its own subnet with unique IP/25 addresses and it is connected to the AAISP lan port.

The problem is when I try and set the default GW for port 1 on the UTM, things go wrong. As soon as I do this I get the warning that uplink balancing is required and is enabled. I then get a link error on the AAISP.

If I try and cinnect to a website using a Firefox browser I then get an Warning:Potetntial Security Risk from Firefox with the message. See screenshot and note the Network management prompt in the corner. Unfortunately this also took me off line so I have to back out to be able to send this which may be why the screenshot appeared above!!!

Grateful for what to try next.

RE: Setting up second wan connection.

Budgie2 — Tue, 21 Sep 2021 09:26:18 GMT

Hi Bob & Philipp,

Sorry for the long pause. We have guest occupying the room and I have to wait until he leaves and I can access the AAISP router. Hope will get there this evening and check out the AAISP connection and router settings. I thought AAISP could access from their end but couldn't. More fun later!!!

RE: Setting up second wan connection.

BAlfson — Sun, 19 Sep 2021 16:09:35 GMT

Thanks, Alastair, that helps. I don't think this will work if the AAISP interface doesn't have a default gateway.

Agreed, Philipp, that confused me, too...

Cheers - Bob

RE: Setting up second wan connection.

PhilippRusch — Sun, 19 Sep 2021 14:47:32 GMT

Hello Alastair,

what makes me wonder here is your remark "it automatically turns on the Uplink Balancing which calls a login popup and stops my WAN connection". What do you mean by "login popup"?
And, of course, the second GW forces uplink balancing to be enabled, that's by design.

@Bob: I think we need to fix this "login popup" thing before we ca go any further here...

RE: Setting up second wan connection.

Budgie2 — Sun, 19 Sep 2021 14:06:47 GMT

Hi Bob,

Ok I think my file was damaged. Try this.

RE: Setting up second wan connection.

BAlfson — Sun, 19 Sep 2021 12:12:07 GMT

Sorry, Alastair, but I don't have a tool that lets me see those pics. How about just jpegs or pngs?

Cheers - Bob

RE: Setting up second wan connection.

Budgie2 — Sat, 18 Sep 2021 19:37:24 GMT

For reasons I don't understand I cannot insert my zipped screenshots this time. I get a message saying the file or url is not allowed to be inserted!community.sophos.com/.../4667.Pictures.tar.gz

But this seemed to work.

RE: Setting up second wan connection.

Budgie2 — Sat, 18 Sep 2021 19:31:14 GMT

Hi Bob,

If I try and set the GW on the second interface it automatically turns on the Uplink Balancing which calls a login popup and stops my WAN connection so I have not included the default GW on the AAISP interface.

On the multipath rules there is only the one rule.

I have set an arbitrary IP subnet for the AAISP interface. I do not have the IP address of the router but can get it in the morning.

I am having trouble inserting the file so see if it works:-

file:///home/alastair/Pictures/Pictures.tar.gz

RE: Setting up second wan connection.

BAlfson — Sat, 18 Sep 2021 17:42:12 GMT

Yes, it's not advised for people to start mucking around with things at the command line unless it's something known to be acceptable. Sophos UTM: How to change the outgoing interface for Web Filtering gives more instruction than I did, but it clearly indicates that the command I give above is acceptable.

How about a picture of your Multipath rules?

Cheers - Bob

RE: Setting up second wan connection.

Budgie2 — Sat, 18 Sep 2021 08:17:01 GMT

Hi Bob, I am not having much success here. The Web Filtering was a surprise as I had no idea it had been set. I wonder if it came as a result of my setting something else.

Can I leave Web Filtering off while I try and sort out my second WAN connection?

I tried this, as I said earlier, but even with Web Filtering turned off I still had no internet or email access as soon as I turned on the multipath rules and uplink balancing. What next I ask?

With regard to Philipp's advice and your related help I note that if I access the UTM as root it negates any support available from Sophos. Do I really have to go in using SSH. Surely it shouldn't be necessary for what I am trying to achieve?

RE: Setting up second wan connection.

BAlfson — Fri, 17 Sep 2021 20:38:14 GMT

Hi Alastair,

In Web Filtering you can configure different Profiles so that traffic for different groups or internal LANs can be handled differently. In order for WebAdmin to show the 'Optional interface for outgoing traffic' as suggested by Philipp, you must run the following command as root at the command line:

cc set http enable_out_interface 1

Cheers - Bob

RE: Setting up second wan connection.

Budgie2 — Fri, 17 Sep 2021 15:58:03 GMT

Hi Philipp,

The Optional Interface you have highlighted is not visible on my device.

I turned the Web Filtering off and the Uplink balancing still does not work.

Is there a step by step guide on how to do this please?

RE: Setting up second wan connection.

Budgie2 — Thu, 16 Sep 2021 17:22:19 GMT

Hi Philipp, Thanks for pointing this out to me but as I stated above I have no idea how this has been set up or when. What is worse is that I have no idea if I need Web Filtering or on which interfaces. What function do these serve?

Why for example are Admin and Internal allowed and how are they defined. I shall now look further into the machine but if there are any guidance notes please advise.

Many thanks again,

Alastair.

RE: Setting up second wan connection.

PhilippRusch — Thu, 16 Sep 2021 15:55:15 GMT

Hello,

again: you do not have defined an outgoing interface there?

RE: Setting up second wan connection.

Budgie2 — Thu, 16 Sep 2021 12:12:41 GMT

Hi Philipp,

Many thanks for your kind reply. Many thanks for the use of English as my German is non existent but I do listen to a great deal of Bach..

It seems I do have some web filtering set up. I am not aware of this but may have been set up by original supplier, long since departed. Two networks are shown on the Allowed Networks tab. Neither involving my planned uplink balancing.

Should I just add the two interfaces or is there more configuration required.

RE: Setting up second wan connection.

PhilippRusch — Thu, 16 Sep 2021 11:28:20 GMT

Hello,
are you using webfiltering? Do you have setup an outgoing interface there?

RE: Setting up second wan connection.

Budgie2 — Thu, 16 Sep 2021 08:40:09 GMT

I am attaching screenshots of the settings I have set up for multipath rules and uplink balancing and the pop up messages I received when I tried to use browser and email after enabling these settings.

I have had to disable them to be able to send these screenshots. I have zipped the screenshots and am trying to send them here as a compressed file hich I hope you will be able to open. Please let me know if you need these shots in a different format.

community.sophos.com/.../Pictures.tar.gz

RE: Setting up second wan connection.

Budgie2 — Wed, 15 Sep 2021 19:42:11 GMT

Hi Bob,

So I have multipath rule set up now as any->any->any->Uplink interfaces and two interfaces set up on Uplink Balancing with the Active interfaces as External (WAN) and the interface I created using vlan. My problem is that when I enable this configuration I get an error message on the new interface I get a prompt that a login is required but no clue which or where as when I select the UTM comes up with an error and to cap it all I have no internet or email.

I know I have been slow but hope you haven't given up on me as I am stuck.

RE: Setting up second wan connection.

Budgie2 — Wed, 15 Sep 2021 16:21:02 GMT

My problem is with the Multipath Rules and Uplink Balancing.

I tried to set up the multipath rules as any -> any -> any -> undefined. I am OK with persistence by source/destination but I am stuck with undefined.

I have set up the subnet for a new connection on the UTM which has dns and dhcp services but my other router also has it's own dhcp server and subnet for the ISP. When I tried to make this work I had an unexpected prompt for a login from the UTM (I was already logged in) and my ISP email service was blocked. I know I have made a mistake and sure enough on the UTM dashboard the port was flagged with an error. Further guidance would be appreciated please.