This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Possible Network Config Issue - Two Subnets - One WAN - Proxy doesn't work on secondary LAN

I'll try to keep the details and summary short and sweet. Hopefully someone can point me in the right direction.

We just upgraded from an Astaro UTM to a Sophos SG330. We simply backed up the UTM config, uploaded it to the sg 330 and then applied the license file. Everything seems to have crossed over fine. I thought, for awhile that everything had gone smoothly. HOWEVER, we have no proxy on our secondary (remote) LAN. Any browser trying to pass through the proxy gets a browser "this page can't be displayed" message.

Network setup: 

INTERNET -> CISCOASA -> SG330 (eth1 and 0 bridged mode) -> Internal LAN1 -> Layer 3 Switch /Router -> LAN2

We have a direct fiber line to a building in another town that is on a different subnet. All routing between these two subnets is done behind the SG330 by a switch/router. 

Prior to the upgrade everything was great. An http request comes in from LAN2 hits the router and then passes through the SG330 (in bridge mode) on its way to the internet.

Now, the proxy doesn't work for LAN2. Works fine with LAN1 (the LAN it's "part of")

I hope that makes sense. Where do I start?

 

I can see this in the Network Log:

 

13:06:12 Default DROP TCP [PC on LAN2 IP] : 49596? [SG 330 IP Address] : 80 [SYN] len=48 ttl=127 tos=0x00 srcmac=[MAC] dstmac=[MAC]

 

Thanks



This thread was automatically locked due to age.
  • Not a problem, I understand removing the link. I hesitated to post it, didn't see the Insert menu.

    I think I figured it out and it's embarrassing... keep in mind I'm more of a systems guy, fairly green with networking.

    In my attempt to enable the reply portal to SPX I forwarded port 10444 on our outside interface (our Cisco ASA) to our UTM. 

    So the cisco had a NAT rule of (outside IPs:10444) -> 192.1.1.149:10444 (our UTM) and an ACL to allow that. Somehow this was causing an issue. I thought I had removed these rules prior to posting this message, but apparently I never applied the changes. Anyway, they are gone and the proxy works...

    I guess I need to connect a different eth port to our LAN and bind an IP to it to be used for SPX portal? I'll do some more digging and probably start another thread. 

    For reference:

    Outside -> Cisco ASA -> UTM -> Company LAN