NAT or SD WAN Policy Routing

Hi nidz: Yes in order to utilize a specific ISP for some subnets you may add the SD-WAN rule.

Sophos XG Firewall v18: How to Choose the gateway for a firewall rule

community.sophos.com/.../sophos-xg-firewall-v18-how-to-choose-the-gateway-for-a-firewall-rule

The rest of the WAN Link you may define in the VPN settings and RED settings - so those will be used to handle those traffic.

Hi Vishal_R,

Thanks for the support. If i utilize the SDWAN so i need to specify the port like HTTP and HTTPS? Im thinking no just http and https but all. Doing ANY in the Services policy i lost the ping and remote Desktop to our branches which is connected via RED and VPN.

Thanks and Best Regards,

nidz

Hi nidz: It could be due to your current "route precedence" settings on XG and may be SD-WAN route has the 1st preference.

You may tweak the route precedence as per requirement and the below help section explanation will help here to get more information:

docs.sophos.com/.../index.html

Hi Vishal_R,

You were right.. This is the route precedence of my current firewall.

console> system route_precedence show
Routing Precedence:
1. SD-WAN policy routes
2. VPN routes
3. Static routes
console>

In my case i should change it to Static VPN and SDWAN? Sorry im just new to this. If i change the predence also my rules and policies will be affected?

Also i tried http and https in SDWAN result is i cannot also browse our internal webserver. Maybe related also to the SDWAN route precedence. Meaning all my http and https will be redirected to the internet.

Thanks and Best Regards,

Nidz

Hi Vishal_R,

You were right.. This is the route precedence of my current firewall.

console> system route_precedence show
Routing Precedence:
1. SD-WAN policy routes
2. VPN routes
3. Static routes
console>

In my case i should change it to Static VPN and SDWAN? Sorry im just new to this. If i change the predence also my rules and policies will be affected?

Also i tried http and https in SDWAN result is i cannot also browse our internal webserver. Maybe related also to the SDWAN route precedence. Meaning all my http and https will be redirected to the internet.

Thanks and Best Regards,

Nidz

Hi nidz: I would suggest on a safer side you should try these settings in the odd hours or when fewer users - so you may be able to validate the things with minimal impact (if there are any) due to these changes according to your configuration and setup.

Hi Vishal_R,

Thanks a lot for your suggestion. I will try this maybe tonight or this coming Friday.

Thanks and Best Regards,

Nidz