VPN Failback Issues with Backup ISP

Hello there,

Good day and thanks for reaching out to Sophos Community and hope you are well.

To confirm, is Sophos on Branch and has dynamic IP? Cisco does not support wildcard remote gateways, you need to configure Sophos Firewall's WAN IP address on Cisco ASA.

Could you use  DDNS as remote/destination address configuration on ASA? then try configure HO ASA to connect to Sophos Firewall on branch via DDNS as Remote ID Type https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/VPN/SiteToSiteVPN/VPNCreateRouteBasedVPN/index.html#create-a-route-based-vpn-tunnel-ho

Hope this helps. Kindly let us know how it goes. Have a nice day and thank you for choosing Sophos

Cheers,

I considered DDNS, but I can't justify purchasing another domain name since our current DNS provider doesn't support DDNS, and because I expect this to just work as intended. I know policy-based VPNs have a lot of inherit downsides, but are there any other settings I can look at to resolve this?

Hello there,

Unfortunately, as you cannot do wildcards on ASA and on setting up RBVPNs (VTI), next viable option is DDNS configuration for another option aside from using wildcard entries. 

Many thanks for your time and patience and thank you for choosing Sophos

Cheers,

Hello there,

Unfortunately, as you cannot do wildcards on ASA and on setting up RBVPNs (VTI), next viable option is DDNS configuration for another option aside from using wildcard entries. 

Many thanks for your time and patience and thank you for choosing Sophos

Cheers,