Information Systems:Dual WAN with Sophos UTM

From uniWIKI
Jump to navigation Jump to search

uniPHARM utilizes two WAN connections. These connections are managed by the Sophos UTM firewall/gateway. This page discusses the technical implementation of dual WAN using the Sophos platform.

Background

uniPHARM uses two internet connections, but primarily for segregating traffic (as opposed to redundancy i.e. having one connection be redundant for the other). Rather than maintain two physical networks, VLANs have been created to separate LANs logically, with the Sophos UTM being used for network routing. With regards to managing multiple WANs, the Sophos UTM platform has two proprietary features that accommodate such a setup - Uplink Balancing and Multipath.

Uplink Balancing

Uplink Balancing is a feature that balances traffic passing through uplink interfaces (in most situations, these uplink interfaces are essentially default gateways). This feature is the recommended way of implementing multiple WAN connections on Sophos UTM. There are two ways to use Uplink Balancing (assuming a situation where there are 2 WAN connections) - either both WAN interfaces are marked as Active, or if one is marked Active and other as Standby. The manual for UTM explains Uplink Balancing in detail. The current setup uses Shaw and Telus in an Active/Active configuration.

The default behavior for Uplink Balancing is to balance traffic equally (round-robin and by source IP) across 'Active' interfaces, which is not suitable when the WAN connections are not of equal quality (one is managed with a higher SLA, and also has symmetric upload/download, while the other is unmanaged and asymmetric). Multipath rules must therefore be used to route different types of traffic through a specific WAN connection.

Multipath

The Multipath feature is a set of rules that enforce routing of traffic by policy (by source IP, by destination IP etc.). Traditionally this type of routing is done through multiple routing tables and firewall rules, but Sophos uses this feature in accordance with Uplink Balancing to achieve the same effect. The desired outcome of routing the guest LAN through Shaw and hosting traffic (web, email) through Telus.

Implementation notes

These are major points regarding the Uplink Balancing and Multipath implementation at uniPHARM, including the type of configuration (in brackets). Analyze the configuration using WebAdmin for a deeper understanding of the setup.

  • (Uplink Balancing) The Shaw and Telus WAN interfaces are marked as Active. The interface weighting has been left at the default (50/50), since the multipath rules supersede this.
  • (Multipath rule) Traffic from the Trusted LAN destined for the internet routes out the Telus connection.
  • (Multipath rule) Traffic from the Guest LAN destined for the internet routes out the Shaw connection. Loomis and Purolator computers are in this LAN.
  • (Multipath rule) A catch-all rule routes all traffic out the Telus line.
  • (NAT) The Trusted LAN is masqueraded out the Telus WAN. The Guest LAN is masqueraded out the Shaw LAN.
  • (NAT) uniPHARM servers and services that are exposed to the internet have DNAT rules to Telus WAN IPs. They will not be reachable via the Shaw WAN.
  • (Firewall rule) Outbound traffic is restricted unless explicitly allowed for the Trusted LAN.
  • (Firewall rule) Outbound traffic is allowed for the Guest VLAN.
  • (Firewall rule) Hosts in the Trusted LAN can access the Guest LAN.
  • (Firewall rule) Hosts in the Guest LAN cannot access the Trusted LAN.
  • (Switch configuration) Switches have L3 presence (i.e. have an IP address) in the Trusted LAN only. This is because VLAN switching is done in layer 2 (by port/MAC), and the switches don't otherwise provide services to or need to be accessible from the Guest LAN.
  • (AP configuration) The APs have two virtual interfaces (present in two VLANs) - one in the Trusted LAN, the other in the Guest LAN. The Guest LAN interface on the controller AP hosts the captive portal web server accessed by devices for authentication.
Retrieved from "https://owl.unipharm.com/mediawiki/index.php?title=Information_Systems:Dual_WAN_with_Sophos_UTM&oldid=12209"