Information Systems:Dual WAN with Sophos UTM

uniPHARM utilizes two WAN connections. These connections are managed by the Sophos UTM firewall/gateway. This page discusses the technical implementation of dual WAN using the Sophos platform.

Background

uniPHARM uses two internet connections, but primarily for segregating traffic (as opposed to redundancy). Rather than maintain two physical networks, VLANs have been created to separate LANs logically. The Sophos UTM does network routing. With regards to managing multiple WANs, the Sophos UTM platform has two proprietary features that accommodate such a setup - Uplink Balancing and Multipath.

Uplink Balancing

Uplink Balancing is a feature balances traffic passing through uplink interfaces (in most situations, these uplink interfaces are essentially default gateways). This feature is the recommended way of implementing multiple WAN connections on Sophos UTM. There are two ways to use Uplink Balancing given a situation where there are 2 WAN connections - either both WAN interfaces are marked as Active, or if one is put into Standby. The manual for UTM explains Uplink Balancing in detail. The current setup uses Shaw and Telus in an Active/Active configuration.

The default behavior for Uplink Balancing is to balance traffic equally (round-robin and by source IP) across 'Active' interfaces, which is not suitable when the WAN connections are not equal (one is managed with a higher SLA as well as symmetric, the other is unmanaged and asymmetric). Multipath rules must therefore be used to route traffic accordingly.