Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 26 subscribers
  • Views 1402 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Internal gateway failover

ce13

Hi, I have an internal gateway IP which is SSLVPN site-to-site. I have already setup to route some domain/URLs to that internal gateway and it is working fine. I would like to know how to setup failover to WAN if the internal gateway IP is failed to ping.

I have setup the internal IP gateway in "Routing - Gateways", and I have tested the health check is not for the failover usage.

 

Gateway

Name: VPN

Gateway IP: 192.168.20.253

..

..

Health check enabled

Interval: 60

Timeout: 2

Retried: 10

Monitoring condition: PING 192.168.20.253

 

Firewall already setup Primary gateway: VPN and Backup gateway: WAN



This thread was automatically locked due to age.
  • 0

    Hi  

    As per the information provided you have entered Monitoring Condition IP same as Gateway IP, You have to configure different IP which can satisfy the condition to trigger a failover mechanism

    Is the "VPN" gateway configured as a WAN interface on the XG firewall?

    Please refer to the article- https://community.sophos.com/kb/en-us/132792

  • 0 in reply to Keyur

    As per the information provided you have entered Monitoring Condition IP same as Gateway IP, You have to configure different IP which can satisfy the condition to trigger a failover mechanism

    -> Not really understand how it works with different IP.

     

    Is the "VPN" gateway configured as a WAN interface on the XG firewall?

    -> No, it is not WAN interface.

     

    I have below interface:

    WAN: DHCP from ISP

    LAN: 192.168.20.1/24

     

    192.168.20.253 is my PfSense gateway, which has SSLVPN site-to-site connect to my another site. In Sophos XG, I have setup firewall rule for routing specific FQDN to 192.168.20.253 (primary) and WAN (Backup). This is working fine for the FQDN routing but I found failover is not working. I would like to setup if 192.168.20.253 is not able to ping within xx tries, then fail over will be triggered to WAN. I understand there is WAN Link Failover Feature, but in my case my gateway is on LAN interface.

  • 0 in reply to ce13

    Hi  

    Unfortunately, there is no failover mechanism available for LAN interfaces as per your requirement. I will confirm and update if there is an alternative configuration available.