Sophos UTM and BT HSRP

Hi All,
We have two sites linked via BT routers and each site has its own UTM and fail over simple diagram below.

WAN                                         WAN
  |                                              |
Router                                     Router
  |                                               |
UTM                                         UTM
  |                                               |
Lan - Router -WAN - Router - LAN

So we have a site link and two sites with Primary/DR with fail over routers

The primary site UTM has IP : 194.72.126.66 GW : 194.72.126.65
The primary sites internet works fine

The secondary DR site UTm has IP : 194.74.139.67 GW : 194.72.126.65
I cannot get out to the internet from this UTM

BT have said there is no issue with the routers and the failover is working on the routers.   Below is the information BT have provided me concerning the IP address allocation.

I have recently taken over this position and I'm under the impression this has never worked any ideas why the second UTM at the DR site cannot get  onto the internet?

Regards

John H

194.72.126.64 255.255.255.224
194.72.126.74<<used on primary router
194.72.126.75<<used on V1 router
194.72.126.65<< HSRP standby address and the gateway for you to point to from both devices
 
194.74.139.64 255.255.255.240
194.74.139.66<<< used on primary
194.74.139.67<<used on V1
194.74.139.65<<< HSRP standby address and the gateway for you to point to from both devices
phditAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dirk KotteSECommented:
some clarification ...
- booth UTM#s are stand allone systems (no cluster)?
- looks like every site has it's own HSRP (and a pair of routers) from ISP to access the internet?
- don't understand:"... and the gateway for you to point to from both devices"
    do you have two UTM devices at every site?
- how do you switch from ISP-link1 to ISP-Link2 (UTM1 to UTM2)?

if you never see the IP from range "194.74.139.x" while accessing the internet, pull the cable and test with a PC/Notebook
0
phditAuthor Commented:
UTM's are stand alone
I believe the HSRP is only for the external WAN links not the site to site link I believe that's acting as the heartbeat
don't understand:"... and the gateway for you to point to from both devices" me either but the BT chap I spoke to was adement I needed both Gateways on the UTM's
There is one UTM at each site
how do you switch from ISP-link1 to ISP-Link2 (UTM1 to UTM2)? the routers are supposed to fail over automatically and the UTM will just need a few changes to take over so its not seemless

if you never see the IP from range "194.74.139.x" while accessing the internet, pull the cable and test with a PC/Notebook

What do you mean plug straight into the router?
0
Craig BeckCommented:
So you have a two WAN circuits at each site with HSRP between them, then a circuit between the sites??  If so, the two sites should be independent from each other.  Site 1 should be able to use its local WAN and site 2 should be able to use its local WAN.

The local HSRP address is the default gateway for the UTM at each site.  You don't need to do anything else.  HSRP will deal with the failover from the BT side.  They will be doing BGP to sort routing on the external side of the WAN routers in the event of a failover.

If both circuits at one site die you can use dynamic routing to pop a route into the failed site which pushes the default route over the site-to-site link.  You would need to configure uplink monitoring on the UTM to drop the default route that it pushes back into the network.  This would depend on what's here though...

Lan - Router -WAN - Router - LAN

If you have a dedicated MPLS between the sites, for example, you can do what you need.  If it's a pure internet circuit between the sites you would need an IPSec VPN to be nailed up between the sites.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ArneLoviusCommented:
To follow on from Craig Beck. As there are different address ranges at each site, there is no failover between the sites, there is only failover at each site between the two BT routers at each site.

If you had failover between the two sites, the secondary site would have no access unless the connection was failed over (by BT)
0
Dirk KotteSECommented:
Hints should answer the question.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.