Assistant with setting up MPLS

We have set this up sucessfully. With a) internet breakout at the MPLS Provider and b) with dedicated internet breakout. And c) with default route 0.0.0.0 and breakout on another site. On the central site basically like the setup on the picture: Terminating MPLS on a router/switch that is connected to the firewall.

You need to set the proper static routes. You need also to define the policies (setting up explicit deny rules on both sides + putting on logging and traceroute from both sides should help).

You also need to be sure that the local networks are actually transmitted through the MPLS (ask your provider).

We have set this up sucessfully. With a) internet breakout at the MPLS Provider and b) with dedicated internet breakout. And c) with default route 0.0.0.0 and breakout on another site. On the central site basically like the setup on the picture: Terminating MPLS on a router/switch that is connected to the firewall.

You need to set the proper static routes. You need also to define the policies (setting up explicit deny rules on both sides + putting on logging and traceroute from both sides should help).

You also need to be sure that the local networks are actually transmitted through the MPLS (ask your provider).

Thank you for the response. Would you say putting the following routes in place are correct in my setup above (with only 2 sites)

SITEA: 

Destination: 10.0.1.0/24

gateway: 172.16.11.1

interface: 172.16.11.2

SITEB:

Destination: 10.0.0.0/24

gateway: 172.16.10.1

interface: 172.16.10.2

Then have a LAN to LAN firewall rule for the local subnets 10.0.0.0/24 and 10.0.1.0/24?

Do I need to do any specific NAT rule or MASQ?

Hi notapplemaxwindows1,

Check out the following Community thread for a more detailed explanation: https://community.sophos.com/xg-firewall/f/discussions/74536/routing-with-mpls

Thanks,

Thanks Harsh, I think my next steps will be try another route. I am going to create a new MPLS Zone and assign that to my MPLS port. I will then use SD-WAN policy route to route my traffic over the MPLS (will do the same on both ends) I will enable reply packet's for this and put the necessary rules in place. What are your thought on this method? I will then create a gateway for IPSEC and add that as the secondary.