What is the order of Static Routes?

Policy routes come first and processed from top to bottom. First match ends it. Static routes are not rules, example when you have two static route to fit, example destination as 192.168.10.0/24 to gateway 192.168.5.1 and 192.168.10.10/32 to gateway 192.168.1.2 , and you want to transfer to 192.168.10.10, then 192.168.1.2 gateway is used, when you want to transfer to 192.168.10.1 then 192.168.5.1 gateway was used. Always used route entry that fits more accurate............But me interest instead what is processed first - routing rules or multipath rules and both in case of session and return packets point of view.

Hi, Ivar, and welcome to the UTM Community!

"Always used route entry that fits more accurate" - I know that's right in Cisco, but are you certain that that's the case with the UTM?  I think I've seen that violated, for example, with automatic routes taking precedence over manually-created ones.

Cheers - Bob

Its standard. What are "automatic routes"? Default there must be only direct routes to directly connected subnets and default gateways. Of course direct routes take precedence, as they fit more precisely.....sorry, not precisely but they dont have gateway, just link to interface.

I know you would be right with a pure router, but WebAdmin is a GUI that manipulates databases of objects and settings. A single change there can cause the Configuration Daemon to rewrite hundreds of lines of the code used to run the UTM.  For example, without electing to bind an IPsec Connection to a particular Interface, you cannot manually create a route that takes precedence over the routes automatically created by the Configuration Daemon.

Now, if you've had someone from Sophos tell you that a route for a /30 subnet will always take precedence over one for a /24 subnet, I'll need to rethink my understanding.

Cheers - Bob

This sounds interesting. Im new with UTM VPN. I was worked with OpenVPN server, CheckPoint and Kerio VPNs. They just put routes for other side of tunnel, with gateway as VPN subnet, tunnel other side endpoint. They are just ordinary routing table entries and firewall dont break any routing logic. If UTM makes some unusual logic, then its interesting. But can I at all set VPN interface as multipath choice and make multipath static rule to this VPN tunnel?

With RED tunnels, it's straightforward.  With IPsec site-to-site tunnels, you have to select 'Bind tunnel to local interface' with a duplicate tunnel for each additional WAN connection and you then can use Multipathing.  I like the description in this UTM Wiki entry: Sophos UTM multiple S2S IPsec VPN mit Failover – Tutorial (DE).  Although it's in German, the pictures are all of WebAdmin in English and the pictures are complete documentation on their own.

Cheers - Bob

With RED tunnels, it's straightforward.  With IPsec site-to-site tunnels, you have to select 'Bind tunnel to local interface' with a duplicate tunnel for each additional WAN connection and you then can use Multipathing.  I like the description in this UTM Wiki entry: Sophos UTM multiple S2S IPsec VPN mit Failover – Tutorial (DE).  Although it's in German, the pictures are all of WebAdmin in English and the pictures are complete documentation on their own.

Cheers - Bob