Is your Failover working?

Its a weird thing....

External access back inbound is fine, pinging to outside from CLI is fine, but ping outside to the world behind a device on the local lan interface based on IPV4 (No DNS required) or red interface doesn’t work, trace routes stop at the XG and don’t pass onto the PPPOE default gateway, almost as if the Sophos XG doesn’t know how to handle the route table for external, even then adding in a manual Unicast route table for 8.8.8.8 out of the WAN port still doesn’t enable local devices to ping out to that ip… Either the XG is bugging out the backup interface weight size or bugging out the source natting behind the natted interface. I imagine this would be quite easy to replicate in-house on a virtual Sophos XG for replicating the issue.

Simply start to perform Dumps and check, what is actually going on on this interface.

You have the option to write the dumps into a file.

https://community.sophos.com/products/community-chat/f/knowledge-base-article-suggestions/105811/how-to-tcpdump-on-xg

PS: Actually both interfaces should be up and running in XG, not like SG (Backup interfaces are actually Down and will boot after master interface fails). 

So start two dumps on both interfaces and write them into file. Perform your testing again and download the files. 

Check in wireshark what is going on. 

Could be couple of different issues (NAT is applied, but wrong IP, XG tries wrong interface, etc.etc.)

Hello

this is my DNS. the last one is of ISP

no rule in Firewall for DNS

Yes, both lines from same provider

For LAN I have an internal DNS server with local IP which is not configured in Firewall anywhere..and i think its normal

Thanks 

My issue is that the Firewall won't allow traffic from LAN - WAN

Its not DNS based as even pinging IP on the net fails and the firewall Logs just show FW=0 VIOLATION

My DNS points to an internal IP for my DNS server with one pointing to 8.8.8.8

The issue is with Global Support now and still going no where fast.

Where does you internal DNS get its updates from?

Also I would check the response speed of your DNS settings gs in the XG, I gave up on the google DNS as being too slow.

Ian

Hello All,

now the internet issue is resolved... i updated DNS settings in my local DNS server.

but the issue remains with RED. RED goes offline when one ISP line goes down, it doesn't reconnect on secondary line automatically 

Thanks 

Shrikant

do you configure booth external IP's within RED-Config?

So after many weeks, several levels of engineers and many updates, logins, tests, trial failovers, logs and repeat I am none the wiser.

Sophos Support have gone dark and now don't respond to email. Seems they are unable to work out why my XG won't fail over.

So Enterprise solution with home user support?

Can you share your Case ID with us? 

#8928860

Hi M8ey 

Sorry for the inconvenience caused! I would check the details for the provided service request number and ask them to contact you further at earliest.

Can we please have an update on this issue as it is effecting our client firewalls as well...ready to jump on the watchguard boat

Can we please have an update on this issue as it is effecting our client firewalls as well...ready to jump on the watchguard boat

My last contact was Support asking me to try the failover again since going to MR-8

I Haven't had a chance to try as yet but as the issue was there since 17.5 and nothing in the release notes about it for MR-8 I don't hold much hope