Force all streaming video to specific gateway?

Hi,

you use the gateway function in the firewall rule.

Ian

Agreed, but how would I target all streaming to use a specific gateway?

Looks like I'll have to create some host groups. Would be nice if Sophos built that and kept it up-to-date. :-)

Hi,

you do not need to create host groups, you can do it using application and web policies.

Ian

I'm confused. Are you saying that the User Applications under Advanced function as criteria as well as actions?

Are we talking about the same config page?

Hi,

yes, I am talking about user applications using application policies.

Ian

You cannot split the traffic depending on Application / Web to specific gateways.

XG can only match traffic based on Source IP (User), Destination IP and Service (443) and force a specific gateway on this traffic. 

Everything on "Advanced" is already matched with the criteria mentioned above. 

You cannot split the traffic depending on Application / Web to specific gateways.

XG can only match traffic based on Source IP (User), Destination IP and Service (443) and force a specific gateway on this traffic. 

Everything on "Advanced" is already matched with the criteria mentioned above. 

But he has "none" matched in Application and web.

Ian

The screen captures are merely to indicate which settings I thought you were referring to - it's not a valid policy.

"Everything on "Advanced" is already matched with the criteria mentioned above. "

OK - that's what I had assumed.

So XG is the same as SG/UTM in routing to a specific gateway (multipath rules)?

In this Case - Yes. 

Multipath Rules are some kind the same mechanic like XG performs with its Firewall Handling.  

Maybe I misunderstand Application policies, but to me you setup a policy on the preferred gateway that allows video streaming and on the none preferred gateway you setup another application policy that blocks video streaming. That forces all video streaming on the the preferred gateway?

Ian

You are completely right in this approach.

The point is, if you have two Gateways and want to force for example Youtube to go to Gateway A and the Rest of the HTTPs Traffic to Gateway B, this is not possible. 

It uses HTTPs Traffic (443), so XG cannot split the traffic properly. 

Application Control is a Block/allow mechanism. So if the criteria matching above (Source / Destination / Service), XG will perform the block / allow.

You are stuck now in this Firewall rule and we are not considering any other firewall rule below (First match).