Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem with Multipath

Hi all, I´m facing a problem with multipath that i would like advice :)

UTM it´s configured using three internet access (three interfaces) – I need to ensure that SMTP traffic goes to the specific interface that has the SMTP MX. From the exchange side, they have changed the default gateway of the servers (we have two exchange servers) to the “internal” IP of the UTM.

 

The UTM is configured with four interfaces:

 

  • Internal Address
  • Internet access 1 (subnet between UTM and ADSL Router1)
  • Internet access 2 (subnet between UTM and ADSL Router2)
  • Internet  access3 (subnet between UTM and cisco PIX).

 

On the UTM, the email proxy is enabled, and i´ve configured multipath:

 

Source: “any”

Services:  “smtp” (actually i´ve created a group with smtp, smtps, authenticated smtp).

Destination: “any” (i´ve tested also using “Internet IPv4 and Internet IPv6”.

Itf. Persistence: By Interface

Bind interface: Internet access3 (the one that should be used when sending SMTP).

 

NAT Rule

 

Source: Internal Network

Internal Network: uplink interfaces

 

This is not working, the emails is sent using Internet Access2 (?)

 

I´ve also tried to create a SNAT:

 

On SNAT,

 

Traffic from: Exchange Servers

Service: SMTP

Going to: Internet IPv4 and Internet IPv6

Action

Change Destination to: Internet access3

 

I also have created the necessary firewall rules.

 

Despite this configuration, the only way I´m able to make the SMTP traffic to go the correct interface, it´s if I leave only the internet access 3 (disabling all the other ones. If I don´t do this, the SMTP traffic goes through Internet Access 2.

 

Also as troubleshooting, the customer has configured a SmartHost from the exchange to the UTM to test if multipath would work correctly like this (that is why, i´ve defined “Any” has the source of the multipath).

what could be here wrong?



This thread was automatically locked due to age.
Parents
  • Did you uncheck "Skip rule on interface error" under Advanced on the multipath rule? I don't think it worked for me until I did that.

    Also, are you using the UTM as a smarthost or is Exchange sending mail directly to the destination.You said you had the email proxy enabled on the UTM, but then you have that SNAT rule like you're sending directly.

  • Hi Steve and Misterking


    initially the UTM was defined as the default gw of the exchange server, and no smarthost was configured - using the above configuration (configured multipah) the email were sent by the wrong interface. Since this was not working, we have defined a smarthost but still the behaviour did not change.

     I did not create a Masquerade Rule as it was asked by SteveWeber - i will try this configuration and let you know about the results.


    Thank you both :)

  • If your using the Sophos UTM as a SmartHost it will always send the E-mail as the Primary Interface of the UTM.  Currently there isn't a way around this.  If your not worried about filtering outbound e-mail and want the Exchange Server to send e-mail directly.  Setup the Masquerade Rule for the Exchange Host to use the Interface Desired and make sure this is the top rule.

  • Steve, if you are using UTM Email Protection and have configured following Basic Exchange setup with SMTP Proxy, then a Multipath rule with two NAT rules will work.  The trick is in the object used in the 'For traffic from' field.

    Assuming you have an interface named "External A" and an Additional Address on that interface named "Email," your NAT rule for that interface should look like 'SNAT : External A (Address)  -> SMTP -> Internet : from External A [Email] (Address)'.  You need a similar one for each other provider's connection.

    Of course, rDNS and SPF must also be configured for the other IPs.

    Cheers - Bob

Reply
  • Steve, if you are using UTM Email Protection and have configured following Basic Exchange setup with SMTP Proxy, then a Multipath rule with two NAT rules will work.  The trick is in the object used in the 'For traffic from' field.

    Assuming you have an interface named "External A" and an Additional Address on that interface named "Email," your NAT rule for that interface should look like 'SNAT : External A (Address)  -> SMTP -> Internet : from External A [Email] (Address)'.  You need a similar one for each other provider's connection.

    Of course, rDNS and SPF must also be configured for the other IPs.

    Cheers - Bob

Children
No Data