C170 management gateway vs email gateway?

[webabc123]

We plan to set up a new C170 (single appliance for entire domain) with email on port 2 and management on port 1.   

I noticed that the setup wizard only allows you to enter a single gateway, but management traffic and email traffic are not in the same IP range.  

I don't see how the web administration and quarantine interface will be remotely accessible with this setup.

How do you set up different gateways for each port or is there a different workaround?

[Mathew Huynh · Accepted solution]

You can configure static routes for the other interface if required a different gateway.

GUI > Network > Routing

This might help with the requirement you're looking for.

[webabc123]

I opened a TAC case about this issue and the representative advised us to NAT the email port's IP address so they both could use the same gateway.  When this was done, the ESA interface would not allow us to use both data ports with addresses on the same subnet. So, now we have both management and email on the same data data port and the other data port is unused.  

This setup allowed us to save this configuration, but I don't think this makes sense because it seems odd to use the same physical data port to access management and quarantine as the email is flowing through.  I didn't think of this while I was on the phone with TAC so I didn't ask at the time, but now I have second thoughts about this design.

I'm not sure if the volume of traffic going through would be an issue that would affect quarantine page and remote management access or not, but if this data port fails either on the device or the switch it's plugged into, both email and remote management access will go down at the same time while we have another data port sitting unused.

Did TAC give the wrong solution?

[Mathew Huynh]

I'm afraid I cannot comment on the 'wrong solution' that was provided as the other TAC engineer may have had greater depth into your design requirements.

But normally from my experience, if I needed to route emails out from a different interface than my defaulted which is in a different IP range thus requires a different gateway, i'd configure it with static routes on the ESA device where if the email is destined to a specific location, it'd use a different gateway.

Volume going through an interface 'should not' negatively impact your quarantine page or remote management access. However a very high volume threshold at all times may cause high CPU and memory usage which can eventually case a system slow down. (Like any other CPU if you put too much load it generally gets sluggish to an extent)

[Ken Stieers · Accepted solution]

Set your default gateway to be appropriate for your Outbound email.

Then create routes for the internal stuff, typically that ip space is much smaller...

This is a typical multi-homing issue, no matter what the OS...