Problems with inbound traffic on one WAN interface in a multi WAN setup

Hi,


I've been working on a Soiphos XG 125 v18 for the last week to get it production ready, setting up the WAN interfaces (2) and the DNATs and FW rules. I thought I had everything covered, but I'm running into an issue I simply cannot resolve. So if anyone can give me some support, that would be great.

My setup is as follows. I have two WAN interfaces (both set to active) on port 5 and 6. I've created aliases for IPs terminated on port 5 and on port 6 in the network section, created DNATs and FW rules for the inbound traffic. The DNAT is configured as follows for Port 5:0:

Original source: Any
Original destination: #Port5:0
Original service: FTP, HTTP, HTTPS
Translated source (SNAT): Original
Translated destination (DNAT): 172.16.1.59
Translated service (PAT): Original

Inbound interface: Any
Outbound interface: Any

The FW rule for this server configured as follows:

Source zones: WAN
Source networks and devices: Any
During scheduled tim: All the time
Destination zones: DMZ
Destination networks: #Port5:0
Services: FTP, HTTP, HTTPS

I see traffic being logged hitting the right DNAT and FW rule for this. So this works good.

However, I have a similar DNAT & FW rule set for another host

Original source: Any
Original destination: #Port6:3
Original service: FTP, HTTP, HTTPS
Translated source (SNAT): Original
Translated destination (DNAT): 172.16.1.63
Translated service (PAT): Original

Inbound interface: Any
Outbound interface: Any

The FW rule for this server configured as follows:

Source zones: WAN
Source networks and devices: Any
During scheduled tim: All the time
Destination zones: DMZ
Destination networks: #Port6:3
Services: FTP, HTTP, HTTPS

And no traffic is allowed to pass through the FW and hits the drop all rule (0). I added my own drop all to activate logging, and that revealed that the NAT rule is being hit correctly from the WAN to the ext IP address (as defined in the alias port 6:3), but traffic from 172.16.1.252 (DMZ interface XG) to 172.16.1.63 (internal IP address host) is being denied. PCAP doesn't tell me anything when I check the denied traffic.

Both hosts reside on the same DMZ network. The DNAT rules were setup like this after consultation with support staff of Sophos.

I searched for hours on the discussion groups to find hints and clues, but was unable to. Any ideas from anyone?

Regards
Guy