V17 to V18 Migration - Specific Gateway

Question

Hello, 
 
 I tested the V18 this weekend during hours, and I'm sure I'm missing something for my actual rules from V17 to be the same on V18... 
 
 I watched the videos of NAT explained in V18, and read the KB, but I must be dumb I don't know... and I can't figure out to have the same thing on V18... Here are screenshots of my V17 rules First, this is the rule #1, with specific VLANs to access the Internet with specific services from specific gateway " WAN link load balance" 
 
 Second, this is the rule #15 with VLAN100 accessing the internet with all ports and all destinations, with specific gateway "ADSL"

Then, we can see that the #15 rule is on the top and will be asked first by the firewall rules, and the #1 is bottom.

I tested to do the same on V18, and tried to tweak the SD-WAN thing to use specific gateway, but it routes all the traffic even if this is not internet ( Ie VLAN 1 to VLAN 10 RDP are routed to default internet gateway which is dumb because this is internal traffic...)

So can someone explain me the exact way to have the 2 same rules I had in v17 for V18?

Thank you.

Regards.

LuCar Toni · Accepted Answer

Sorry, didnt add the way this precedence. 
 https://community.sophos.com/kb/en-us/123610 
 console> system route_precedence set static vpn sdwan_policyroute console> system route_precedence show Routing Precedence: 1. Static routes 2. VPN routes 3. SD-WAN policy routes 
 Will add this to the answer above.

LuCar Toni · Answer

Change the Routing Precedence to Static - VPN - SD-WAN, will resolve your issues. 
 https://community.sophos.com/kb/en-us/123610 
 console> system route_precedence set static vpn sdwan_policyroute console> system route_precedence show Routing Precedence: 1. Static routes 2. VPN routes 3. SD-WAN policy routes 
 
 Let me put some more context into this answer. 
 (The online help gets some updates about this as well). 
 
 There are basically three different routing modules, which can take place. Static Routing (Static route, OSPF, BGP,), VPN Routing (Policy Based IPsec), SD-WAN Routing. 
 If you current settings are "PBR, Static, VPN", XG will use the matching PBR and route the traffic no matter what. 
 Because you are using ANY in certain scenarios, this could lead to issues. 
 For example, You want to route all Internet Traffic of Host A to Gateway 1. You will choose ANY for Destination. 
 This route will be applied for ANY Destination Traffic, even internal Traffic. 
 
 This can be resolved by using Static Routing as the first selector. Static Routing will cover the internal traffic and everything internal will be applied as usual. 
 If the Host A will now reach something, which cannot be resolved by static routing, PBR routing will be asked to look for a route. 
 Therefore PBR will be used for ANY. 
 
 This kind of information is currently in development for the Online Help to give a smooth transmission. 
 
 Hope it helps.