making new gateway for DMZ traffic

Question

hi all, 
 want to make WIFI traffic go out a new WAN interface, i think im going to do it like this, what you think 
 network > interfaces network zone WAN, add ipv4 details and give it a gateway ip rules and policies > nat rules "default SNAT IPv4" change "outbound interface" from WAN1 to WAN1 and WAN2 or ANY? routing > sd wan routes shall i create 2 
 main one ANY "source networks" and "primary gateway" will be WAN1 
 for DMZ add the WIFI subnet to "source networks" and "primary gateway" will be WAN2 
 
 thanks, 
 rob

Vishal_R · Answer

Hi , Sophos User1175 Thank you for reaching out to the Sophos community team. The above action or steps are fine and below is also another possible way. If this new WAN gateway is only for DMZ and WiFi then when you are adding it on XG you may set that is in the backup gateway type in place of an active gateway which will in the later part eliminate 2 SD-WAN routes creation activity. i.e. with this new gateway as in backup 1st SD-WAN rule to route any source via WAN1 will not be required. if you will set this new WAN as in backup gateway. (NAT rule changes will required in both the scenario to have NAT action in place).

Vivek Jagad · Answer

In that case SD-WAN can help, please refer the recommended read - Sophos Firewall v19: How to Choose The Gateway For A Firewall Rule Configure SD-WAN routes