Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 6 replies
  • Answers 2 answers
  • Subscribers 4 subscribers
  • Views 9992 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem with Multipath

PeterRL

Hi all, I´m facing a problem with multipath that i would like advice :)

UTM it´s configured using three internet access (three interfaces) – I need to ensure that SMTP traffic goes to the specific interface that has the SMTP MX. From the exchange side, they have changed the default gateway of the servers (we have two exchange servers) to the “internal” IP of the UTM.

 

The UTM is configured with four interfaces:

 

  • Internal Address
  • Internet access 1 (subnet between UTM and ADSL Router1)
  • Internet access 2 (subnet between UTM and ADSL Router2)
  • Internet  access3 (subnet between UTM and cisco PIX).

 

On the UTM, the email proxy is enabled, and i´ve configured multipath:

 

Source: “any”

Services:  “smtp” (actually i´ve created a group with smtp, smtps, authenticated smtp).

Destination: “any” (i´ve tested also using “Internet IPv4 and Internet IPv6”.

Itf. Persistence: By Interface

Bind interface: Internet access3 (the one that should be used when sending SMTP).

 

NAT Rule

 

Source: Internal Network

Internal Network: uplink interfaces

 

This is not working, the emails is sent using Internet Access2 (?)

 

I´ve also tried to create a SNAT:

 

On SNAT,

 

Traffic from: Exchange Servers

Service: SMTP

Going to: Internet IPv4 and Internet IPv6

Action

Change Destination to: Internet access3

 

I also have created the necessary firewall rules.

 

Despite this configuration, the only way I´m able to make the SMTP traffic to go the correct interface, it´s if I leave only the internet access 3 (disabling all the other ones. If I don´t do this, the SMTP traffic goes through Internet Access 2.

 

Also as troubleshooting, the customer has configured a SmartHost from the exchange to the UTM to test if multipath would work correctly like this (that is why, i´ve defined “Any” has the source of the multipath).

what could be here wrong?



This thread was automatically locked due to age.
Parents
  • 0

    The easiest way to ensure that traffic from your Exchange Server is going out the correct Interface and Address is to setup a NAT Masquerading Rule.

    Network(Exchange Host)

    Position: TOP

    Interface(Interface 3)

    Use Address: Primary address, unless it needs to be something other than the primary.  

    This will send any traffic from the Exchange Server out over Interface 3.  If your blocking SMTP Traffic on the Firewall Rules, ensure that you have a Firewall setup on Top for the Exchange Server to be allowed to send SMTP Traffic.

Reply
  • 0

    The easiest way to ensure that traffic from your Exchange Server is going out the correct Interface and Address is to setup a NAT Masquerading Rule.

    Network(Exchange Host)

    Position: TOP

    Interface(Interface 3)

    Use Address: Primary address, unless it needs to be something other than the primary.  

    This will send any traffic from the Exchange Server out over Interface 3.  If your blocking SMTP Traffic on the Firewall Rules, ensure that you have a Firewall setup on Top for the Exchange Server to be allowed to send SMTP Traffic.

Children
No Data