Sophos XG (Home Edition) - Unable to define LAN Gateway IP Address - To route to internal subnets.

Question

Hello All, 
 I have Sophos XG 'Home' edition setup in a home environment. I have retained the same default internal LAN IP address 172.16.16.16/24. From devices connected to this this subnet, I can successfully route out to the Internet. 
 However, I also desire to access the Internet from other connected subnets accessible via the LAN Interface. From the Sophos LAN Interface I'm assuming that I need to specify the 'Gateway IP' so that I may route to these other subnets. 
 However, I can't add a default gateway IP. Please see screenshot. This field is not editable. Is this a restriction with the 'Home' Edition? Any help would be much appreciated.

lferrara · Accepted Answer

Peter, 
 the XG receives the packet from the remote networks that it does not kwow and forward the reply traffic to internet. In order to inform the XG of these networks, you have to add static routing inside Routing Menu > Unicast Routing where you add the destination network, the gateway that knows that network and the XG port used (in your case port1). 
 Regards,

lferrara · Answer

Peter, 
 Send me a pm and I will have a look. 
 Regards

varunparikh · Answer

Hello Peter, 
 In addition to what Luk has suggested, you can also bind an Alias IP to the LAN Interface if you do not want to create static routes. 
 In my setup, I have taken one IP from the other subnets connected to my LAN interface and created a LAN - LAN rule (for Desitnation subnet) with MASQ set to on, please see the screenshot below.

Regards,

varunparikh · Answer

Hello again Peter, 
 As I understand, PCs and the routers are connected to the same Interface (Sophos LAN Interface), through a switch? Are the routers and the PCs connected to same switch or different ones? 
 I can see an asymmetric routing issue if they are on the same switch, as when a PC in 192.168.20.0 subnet initiates traffic, it will send to its gateway (20.254), which if in the same switch, does not reach the Sophos LAN interface because they are in the same broadcast domain. 
 Also, the static routing you have configured on the Sophos Firewall is destination based static route, which means when any traffic received by the Sophos firewall (destination 192.168.20.0) will be routed as you have specified, but to participate in routing, Sophos firewall needs to be a gateway. 
 Hope this clears a bit of confusion. It would be nice if you could share a small diagram. 
 Regards,