Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem with Multipath

Hi all, I´m facing a problem with multipath that i would like advice :)

UTM it´s configured using three internet access (three interfaces) – I need to ensure that SMTP traffic goes to the specific interface that has the SMTP MX. From the exchange side, they have changed the default gateway of the servers (we have two exchange servers) to the “internal” IP of the UTM.

 

The UTM is configured with four interfaces:

 

  • Internal Address
  • Internet access 1 (subnet between UTM and ADSL Router1)
  • Internet access 2 (subnet between UTM and ADSL Router2)
  • Internet  access3 (subnet between UTM and cisco PIX).

 

On the UTM, the email proxy is enabled, and i´ve configured multipath:

 

Source: “any”

Services:  “smtp” (actually i´ve created a group with smtp, smtps, authenticated smtp).

Destination: “any” (i´ve tested also using “Internet IPv4 and Internet IPv6”.

Itf. Persistence: By Interface

Bind interface: Internet access3 (the one that should be used when sending SMTP).

 

NAT Rule

 

Source: Internal Network

Internal Network: uplink interfaces

 

This is not working, the emails is sent using Internet Access2 (?)

 

I´ve also tried to create a SNAT:

 

On SNAT,

 

Traffic from: Exchange Servers

Service: SMTP

Going to: Internet IPv4 and Internet IPv6

Action

Change Destination to: Internet access3

 

I also have created the necessary firewall rules.

 

Despite this configuration, the only way I´m able to make the SMTP traffic to go the correct interface, it´s if I leave only the internet access 3 (disabling all the other ones. If I don´t do this, the SMTP traffic goes through Internet Access 2.

 

Also as troubleshooting, the customer has configured a SmartHost from the exchange to the UTM to test if multipath would work correctly like this (that is why, i´ve defined “Any” has the source of the multipath).

what could be here wrong?



This thread was automatically locked due to age.
Parents
  • Did you uncheck "Skip rule on interface error" under Advanced on the multipath rule? I don't think it worked for me until I did that.

    Also, are you using the UTM as a smarthost or is Exchange sending mail directly to the destination.You said you had the email proxy enabled on the UTM, but then you have that SNAT rule like you're sending directly.

  • MisterKing said:

    Did you uncheck "Skip rule on interface error" under Advanced on the multipath rule? I don't think it worked for me until I did that.


    That made the "trick". For some reason, UTM "saw" some errors on the Link status, thus, the other gateways were being used to send the email. Disabling the setting, solve it.


    Thank you all.

Reply
  • MisterKing said:

    Did you uncheck "Skip rule on interface error" under Advanced on the multipath rule? I don't think it worked for me until I did that.


    That made the "trick". For some reason, UTM "saw" some errors on the Link status, thus, the other gateways were being used to send the email. Disabling the setting, solve it.


    Thank you all.

Children
No Data