This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Use Site to Site VPN as backup route to OSPF routes

Carlos Eduardo de Morais Leal over 6 years ago

Hello Sophos Community

We received a rather unusual request from our client. So, they have Lan to Lan (similar to MPLS) links between their 6 offices (4 of them are located in the same city and 2 of them are located in 2 different cities) and they all have Sophos XG Firewalls. We configured OSPF in this Lan to Lan infrastructure so that all offices can reach one another. The reason why we chose to use OSPF over static routes is that they have two different kinds of Lan to Lan setups (I will post a network diagram of their infrastructure down below). One of them is a direct fiber cable between those 4 offices in the same city. The other one connects all 6 offices, but they go through a bunch of other routers from their service provider.

As you can see (let me know if the image is clear), Offices 1, 2, 5 and 6 have at least two routes to reach other offices, but Offices 3 and 4 only have the green one. So, they asked us if we could make Site to Site VPNs between those two and 1, 2, 5 and 6 and configure the VPNs as backup routes to the green ones (so it would only act if the green routes fail).

Is there any way to do this in XG Firewall?

Thanks in advance.

This thread was automatically locked due to age.

0 LuCar Toni over 6 years ago

I am not quite sure right now, which Route Precedence Dynamic Routing has in case of "Route Selection".

https://community.sophos.com/kb/en-us/123323

But you could do another approach.

Instead of IPsec, use Sophos RED Site to Site.

https://community.sophos.com/kb/en-us/125101

In that case, you will get a Layer 2 Tunnel, so OSPF is be used to advertise the new route.
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Eduardo de Morais Leal over 6 years ago in reply to LuCar Toni

Thanks for your reply, LuCar Toni.

I didn't find that first article you posted here and I think it will solve my client's problem.

I'll update this post as soon as we do some testing.

Thank you once more.
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Eduardo de Morais Leal over 6 years ago in reply to LuCar Toni

One question, though: how is OSPF route compared to Static Route? If I change the route precedence and put Static Route on top, does that mean that the OSPF route configured in my client's Firewall will be on top as well?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 6 years ago in reply to Carlos Eduardo de Morais Leal

Your Client Firewall?

You would only change the Precedence on your XG, not on the attached Routers.
Cancel
Vote Up 0 Vote Down

Cancel