This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to get multiple AWS public IPs to work with Sophos UTM

I have 5 web servers in an AWS VPC.  The Sophos and web servers are all located in the same public subnet.  While I was first setting up the Sophos, I had an Elastic Network Interface (ENI) with single private and public IP.  While testing connectivity, I set up a real and virtual web server and pointed the web server to the ENI primary public IP and tested connectivity with a browser which worked fine.  The problem is that if I associate another AWS public IP to the ENI and use the 2nd public IP to test connectivity there is no connection.

My AWS ENI

10.0.0.5 / 54.208.x.22 (Sophos UTM primary private and public IPs)
10.0.0.6 / 54.209.x.33 (additional private and public IPs associated to the same ENI)

In Sophos Interfaces & Routing

The AWS ENI shows up on the Interfaces tab as eth0 (10.0.0.5) and is the default gateway and is active.

I have added the public IPs on the Additional Interfaces tab.

54.208.x.22 and 54.209.x.33 both on eth0 and are enabled.

Under WebServer Protection>WAF

I created a real web server and pointed it to one of my web servers (10.0.0.50) and is enabled.

I created a virtual web server and point it (interface eth01 10.0.0.5, port 80, domains box 10.0.0.50,54.208.x.22) to the AWS ENI primary private and public IPs – this worked fine.  I was able to pull up the site in a browser.

To test connectivity to the 2nd public IP, I edited the virtual web server and pointed it (modified the domains box and deleted 54.208.x.22 and added the 2nd IP 54.209.x.33. so the domains box now looks like this:

10.0.0.50
54.209.x.33

I am not able to connect to the site now with a browser.  I have also tried attaching a 2nd ENI to the Sophos instance with its own private and public IPs and updated the virtual web server with no luck.

Is there a trick to getting multiple AWS public IPs to work with the Sophos UTM?

This thread was automatically locked due to age.

0 BAlfson over 9 years ago

Hi, JB, and welcome to the User BB!

I'm a visual-tactile, so without seeing a diagram, I'll just guess...

It sounds like maybe you have public IPs where private ones should be. AWS forwards the public IPs to the 10. IPs in your VPC. If you want to use Webserver Protection (?) or a DNAT to a web server instance, I think you will want to put the corresponding 10. IP on eth0 as an Additional Address and then send the traffic on to the server instance which will have a separate 10. IP.

Cheers - Bob
PS If you want to add an image after you start a thread, you have to click on [Go Advanced] below to get the option to attach something.

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 JBooks over 9 years ago

I figured this out a while ago and thought to update this post with the answer.  You actually don't make any reference to public IPs in Sophos UTM Interfaces & Routing section when the Sophos UTM is in an AWS environment.  This is where I was getting really stumped, because I thought that you needed to also create network definitions for the corresponding public (Elastic) IP addresses.  In the UTM you will define your interfaces and additional interfaces with internal IPs only.  In my example my eth0 interface IP was 10.0.0.5.  In AWS, this 10.0.0.5 internal IP has an associated Elastic (public) IP of 54.208.x.22.  My problem was that I was adding the public IP, 54.208.x.22, as an "Additional Address" in the UTM on the additional addresses tab.  After adding the public IP as and additional address, I would the enable it which would make the slider turn green.  It was green so I thought it was usable - wrong.  You only need reference the AWS internal IPs on both the Interfaces tab AND the Additional Addresses tab in the Interfaces & Routing section.

Here is a very simple example:

A Sophos UTM instance is in an AWS VPC with 1 private subnet and 1 public subnet:

Public subnet 10.0.0.0/24
Private subnet 10.0.1.0/24

The Sophos UTM instance is on an m3.medium which has 2 AWS Elastic Network Interfaces (ENI) attached (1 ENI on the public subnet and 1 ENI on the private subnet). ENI#1 has multiple IPs.

ENI#1 (on the public subnet - source/destination checking is DISABLED in AWS)

10.0.0.4 / 54.x.x.54 (primary private and public IPs)
10.0.0.5 / 54.x.x.96
10.0.0.6 / 54.x.x.123
10.0.0.7 / 54.x.x.221

ENI#2 (on the private subnet)

10.0.1.10 (primary private IP - source/destination checking is DISABLED in AWS)

---------------------------------------------------

In the Sophos UTM web console:

Interfaces & Routing --> Interfaces tab

eth0 will be 10.0.0.4
eth1 will be 10.0.1.10

Interfaces & Routing --> Additional Address tab

- this is where you will add the other private IPs and bind them to an interface.

On interface eth0 - 10.0.0.5 - /24 (255.255.255.0)
On interface eth0 - 10.0.0.6 - /24 (255.255.255.0)
On interface eth0 - 10.0.0.7 - /24 (255.255.255.0)

Definitions & Users --> Network Definitions

Create new network definitions

- Public Subnet - Network - 10.0.0.0 - /24 (255.255.255.0) - interface eth0
- Private Subnet - Network - 10.0.1.0 - /24 (255.255.255.0) - interface eth1

To add a web server to the WAF:

Webserver Protection --> Web Application Firewall

Real Webservers tab

- Create a new real webserver
  - example (your web server) - host 10.0.1.25 - port 80

Virtual Webservers tab

- Create a new virtual webserver
- example - interface eth0, Plaintext (HTTP) - port 80 - domains 10.0.0.5 and 54.x.x.96 - select the real webserver that you just created - choose the firewall profile - check pass Host Header

Now the web server should be available from the public IP 54.x.x.96.

Now let's say you have another web server that you want to route through the WAF on a different public IP:

Real Webservers tab

- Again create a new real webserver (your other web server)
  - example - host 10.0.1.50 - port 80

Virtual Webservers tab

- Again create a new virtual webserver
- example - interface eth0, Plaintext (HTTP) - port 80 - domains 10.0.0.6 and 54.x.x.123 - select the real webserver that you just created - choose the firewall profile - check pass Host Header

Now the other web server should be available from the public IP 54.x.x.123.

You really only reference the actual public IPs in the Domains box of virtual webservers for this example.
Cancel
Vote Up 0 Vote Down

Cancel