RED device - Change metric

Salut Olivier and welcome to the UTM Community!

Please show a picture of the Edit of the RED server for reds1.

Cheers - Bob

Hi Bob !

Thanks for your answer, you know, I'm an old user of the "astaro.org" forum ;)

Below a printscreen :

I tried to change the operation mode to "transparent/split" and put "Internet ipV4" as network but it doesn't help :(

Regards,

Olivier

Hi Bob,

Take a look at this KBA: 

https://community.sophos.com/kb/en-us/131806

Base License includes VPN: IPsec RAS / S2S, SSL VPN RAS / S2S. 

RED, HTML5 is in network protection.

You can purchase a enhanced subscription - but you do not have to. The KBA explains the warranty status. 

Hi Bob,

Je vais continuer en anglais pour la communauté, je ne savais pas que tu étais parfaitement bilingue :)

Actually, with this topology, it works but in case of Internet or box failure (in front of the RED), users lose access to the datacenter...

As I tried to explain, default route of the entire MPLS network is pointing to another firewall with no Internet access for this remote network.

@Toni, correct me if I'm wrong but with a SG/XG box with IPSEC tunel, it will be the same ? Tunel have the highest priority in terms of metric and it's by design

Olivier

You would have to configure some kind of backup.

https://community.sophos.com/kb/en-us/123323

This should be the same setup in XG, isnt it? 

With IPsec in the UTM, you can bind the IPsec Connection to a specific interface, Olivier, and then make Static Interface Routes with the metrics you want.  I don't think that can be done with the XG, but maybe Toni will correct me.

Cheers - Bob

XG cannot do it as simple as bind it to the Interface, but you can also build such setups in XG aswell. 

Like mentioned in the KBA. 

So, the only way to do it in XG is with changes at the command line.  Will those changes survive a reboot?  All upgrades?  Is there a document I could have read to answer my own question?

Cheers - Bob

Thank you Toni, it's good to know !

But, in my case, it means I need to replace my main Sophos with a XG model... It's not for tomorrow.

Anyway, thank you very much Toni and Bob for your time !

Olivier

You dont have to replace the Main SG with XG. 

XG uses IPsec to connect to SG without problems. 

Toni,

In the KB you mentionned, there's a command line to change the default behaviour of routing/metric : in my case, it's useful in the main Sophos, not in the remote site.

Even if I put a XG box in the remote site with a IPSEC tunel, I'll face the same situation :(

You wouldn't have the RED problem with IPsec, Olivier.  I think I mentioned this before.  In the SG in the main office, you can use Static Routes with metrics with an IPsec Connection that's bound to the interface.

Cheers - Bob

You wouldn't have the RED problem with IPsec, Olivier.  I think I mentioned this before.  In the SG in the main office, you can use Static Routes with metrics with an IPsec Connection that's bound to the interface.

Cheers - Bob