Information Systems:Dual WAN with Sophos UTM - Revision history

Norwinu at 22:34, 27 September 2018

2018-09-27T22:34:49Z

Norwinu: /* Uplink Balancing */

2018-09-27T22:32:12Z

Uplink Balancing

Norwinu: /* Implementation notes */

2018-09-27T22:31:28Z

Implementation notes

Norwinu: /* Implementation notes */

2018-09-27T22:24:03Z

Implementation notes

Norwinu: /* Background */

2018-09-27T22:21:26Z

Background

Norwinu at 21:52, 27 September 2018

2018-09-27T21:52:58Z

Norwinu: Norwinu moved page Information Systems:Sophos Multipath to Information Systems:Dual WAN with Sophos UTM

2018-09-27T20:00:03Z

Norwinu moved page Information Systems:Sophos Multipath to Information Systems:Dual WAN with Sophos UTM

Norwinu at 19:34, 30 June 2016

2016-06-30T19:34:19Z

Norwinu at 15:48, 23 June 2016

2016-06-23T15:48:06Z

New page

'''Objective''': Convert WAN redundancy configuration from what is currently a failover setup (with a primary interface and a backup, inactive interface), to an active redundancy setup with both interfaces active, but with traffic prioritized to the primary line.

[[Category: Firewall]]
[[Category: Networking Projects]]

Norwinu: Created page with "'''Objective''': Convert WAN redundancy configuration from what is currently a failover setup (with a primary interface and a backup, inactive interface), to an active redunda..."

2015-11-11T01:00:06Z

Created page with "'''Objective''': Convert WAN redundancy configuration from what is currently a failover setup (with a primary interface and a backup, inactive interface), to an active redunda..."

New page

@@ Line 13: / Line 13: @@
 ==Implementation notes==
-These are major points regarding the Uplink Balancing and Multipath implementation at uniPHARM, including the type of configuration (in brackets). Analyze the configuration using WebAdmin for a deeper understanding of the setup.
+These are major points regarding the Uplink Balancing and Multipath implementation at uniPHARM. Analyze the configuration using WebAdmin for a deeper understanding of the setup.
-* (Uplink Balancing) The Shaw and Telus WAN interfaces are marked as Active. The interface weighting has been left at the default (50/50), since the multipath rules supersede this.
+* The Shaw and Telus WAN interfaces are marked as Active. The interface weighting has been left at the default (50/50), since the multipath rules supersede this.
-* (Multipath rule) A catch-all rule routes all traffic out the Telus line.
+* Traffic from the Trusted LAN destined for the internet routes out the Telus connection.
-* (NAT) The Trusted LAN is masqueraded out the Telus WAN. The Guest LAN is masqueraded out the Shaw LAN.
+* Traffic from the Guest LAN destined for the internet routes out the Shaw connection. Loomis and Purolator computers are in this LAN.
 * (Switch configuration) Switches have L3 presence (i.e. have an IP address) in the Trusted LAN only. This is because VLAN switching is done in layer 2 (by port/MAC), and the switches don't otherwise provide services to or need to be accessible from the Guest LAN.
 * (AP configuration) The APs have two virtual interfaces (present in two VLANs) - one in the Trusted LAN, the other in the Guest LAN. The Guest LAN interface on the controller AP hosts the captive portal web server accessed by devices for authentication.

@@ Line 5: / Line 5: @@
 ===Uplink Balancing===
-Uplink Balancing is a feature that balances traffic passing through uplink interfaces (in most situations, these uplink interfaces are essentially default gateways). This feature is the recommended way of implementing multiple WAN connections on Sophos UTM. There are two ways to use Uplink Balancing (assuming a situation where there are 2 WAN connections) - either both WAN interfaces are marked as Active, or if one is marked Active and other as Standby. The manual for UTM explains Uplink Balancing in detail. The current setup uses Shaw and Telus in an Active/Active configuration.
+Uplink Balancing is a feature that balances traffic passing through uplink interfaces (in most situations, these uplink interfaces are default gateways). This feature is the recommended way of implementing multiple WAN connections on Sophos UTM. There are two ways to use Uplink Balancing (assuming a situation where there are 2 WAN connections) - either both WAN interfaces are marked as Active, or if one is marked Active and other as Standby. The manual for UTM explains Uplink Balancing in detail. The current setup uses Shaw and Telus in an Active/Active configuration.
 The default behavior for Uplink Balancing is to balance traffic equally (round-robin and by source IP) across 'Active' interfaces, which is not suitable when the WAN connections are not of equal quality (one is managed with a higher SLA, and also has symmetric upload/download, while the other is unmanaged and asymmetric). Multipath rules must therefore be used to route different types of traffic through a specific WAN connection.

@@ Line 19: / Line 19: @@
 * (Multipath rule) Traffic from the Guest LAN destined for the internet routes out the Shaw connection. Loomis and Purolator computers are in this LAN.
 * (Multipath rule) A catch-all rule routes all traffic out the Telus line.
 * (NAT) uniPHARM servers and services that are exposed to the internet have DNAT rules to Telus WAN IPs. They will not be reachable via the Shaw WAN.
 * (Firewall rule) Hosts in the Trusted LAN can access the Guest LAN.
 * (Firewall rule) Hosts in the Guest LAN cannot access the Trusted LAN.

@@ Line 22: / Line 22: @@
 * (Firewall rule) Hosts in the Trusted LAN can access the Guest LAN.
 * (Firewall rule) Hosts in the Guest LAN cannot access the Trusted LAN.
-* (Switch configuration) Switches have L3 presence (i.e. have an IP address) in the main LAN only. This is because VLAN switching is done in layer 2 (by port/MAC), and the web interface of the switches doesn't otherwise need to be accessible from the Guest LAN.
+* (Switch configuration) Switches have L3 presence (i.e. have an IP address) in the Trusted LAN only. This is because VLAN switching is done in layer 2 (by port/MAC), and the switches don't otherwise provide services to or need to be accessible from the Guest LAN.
 * (AP configuration) The APs have two virtual interfaces (present in two VLANs) - one in the Trusted LAN, the other in the Guest LAN. The Guest LAN interface on the controller AP hosts the captive portal web server accessed by devices for authentication.

@@ Line 2: / Line 2: @@
 ==Background==
-uniPHARM uses two internet connections, but primarily for segregating traffic (as opposed to redundancy). Rather than maintain two physical networks, VLANs have been created to separate LANs logically. The Sophos UTM does network routing. With regards to managing multiple WANs, the Sophos UTM platform has two proprietary features that accommodate such a setup - Uplink Balancing and Multipath.
+uniPHARM uses two internet connections, but primarily for segregating traffic (as opposed to redundancy i.e. having one connection be redundant for the other). Rather than maintain two physical networks, VLANs have been created to separate LANs logically, with the Sophos UTM being used for network routing. With regards to managing multiple WANs, the Sophos UTM platform has two proprietary features that accommodate such a setup - Uplink Balancing and Multipath.
 ===Uplink Balancing===
-Uplink Balancing is a feature balances traffic passing through uplink interfaces (in most situations, these uplink interfaces are essentially default gateways). This feature is the recommended way of implementing multiple WAN connections on Sophos UTM. There are two ways to use Uplink Balancing given a situation where there are 2 WAN connections - either both WAN interfaces are marked as Active, or if one is put into Standby. The manual for UTM explains Uplink Balancing in detail. The current setup uses Shaw and Telus in an Active/Active configuration.
+Uplink Balancing is a feature that balances traffic passing through uplink interfaces (in most situations, these uplink interfaces are essentially default gateways). This feature is the recommended way of implementing multiple WAN connections on Sophos UTM. There are two ways to use Uplink Balancing (assuming a situation where there are 2 WAN connections) - either both WAN interfaces are marked as Active, or if one is marked Active and other as Standby. The manual for UTM explains Uplink Balancing in detail. The current setup uses Shaw and Telus in an Active/Active configuration.
-The default behavior for Uplink Balancing is to balance traffic equally (round-robin and by source IP) across 'Active' interfaces, which is not suitable when the WAN connections are not equal (one is managed with a higher SLA as well as symmetric, the other is unmanaged and asymmetric). Multipath rules must therefore be used to route traffic accordingly.
+The default behavior for Uplink Balancing is to balance traffic equally (round-robin and by source IP) across 'Active' interfaces, which is not suitable when the WAN connections are not of equal quality (one is managed with a higher SLA, and also has symmetric upload/download, while the other is unmanaged and asymmetric). Multipath rules must therefore be used to route different types of traffic through a specific WAN connection.
 ===Multipath===

← Older revision		Revision as of 21:52, 27 September 2018
Line 1:		Line 1:
		+	[[Information Systems:WAN connections at uniPHARM\| uniPHARM utilizes two WAN connections.]] These connections are managed by the Sophos UTM firewall/gateway. This page discusses the technical implementation of dual WAN using the Sophos platform.
−	'''Objective''': Convert WAN redundancy configuration from what is currently a failover setup (with a primary interface and a backup, inactive interface), to an active redundancy setup with both interfaces active, but with traffic prioritized to the primary line.

		+	==Background==
⚫	[[Category: ~~Firewall~~]]
		+	uniPHARM uses two internet connections, but primarily for segregating traffic (as opposed to redundancy). Rather than maintain two physical networks, VLANs have been created to separate LANs logically. The Sophos UTM does network routing. With regards to managing multiple WANs, the Sophos UTM platform has two proprietary features that accommodate such a setup - Uplink Balancing and Multipath.
−	[[Category: I.T. Projects and Ideas]]
		+
		+	===Uplink Balancing===
		+	Uplink Balancing is a feature balances traffic passing through uplink interfaces (in most situations, these uplink interfaces are essentially default gateways). This feature is the recommended way of implementing multiple WAN connections on Sophos UTM. There are two ways to use Uplink Balancing given a situation where there are 2 WAN connections - either both WAN interfaces are marked as Active, or if one is put into Standby. The manual for UTM explains Uplink Balancing in detail. The current setup uses Shaw and Telus in an Active/Active configuration.
		+
		+	The default behavior for Uplink Balancing is to balance traffic equally (round-robin and by source IP) across 'Active' interfaces, which is not suitable when the WAN connections are not equal (one is managed with a higher SLA as well as symmetric, the other is unmanaged and asymmetric). Multipath rules must therefore be used to route traffic accordingly.
		+
		+	===Multipath===
		+
		+
		⚫	[[Category: Networking]]

← Older revision		Revision as of 19:34, 30 June 2016
Line 2:		Line 2:

	[[Category: Firewall]]		[[Category: Firewall]]
−	[[Category: ~~Networking~~ Projects]]	+	[[Category: I.T. Projects and Ideas]]