Only use a second gateway (i.e. backup ISP) for a specific device?

Hi shred,

Thank you for reaching out to Sophos Community.

You need to set up 2 SD-WAN policies, one with source & destination as ANY, and select Primary gateway as 'Primary ISP' & Backup gateway as 'None'.

On top of that, you need to add a new policy with required source machines and select Primary gateway as 'Primary ISP' & Backup gateway as 'cellular ISP'.

Click here to know more information on "SD-WAN Policy Based Routing".

So I'm sure I'm screwing something up but when I setup one SD-WAN policy (I don't have my backup ISP yet, but just trying to set up the first SD-WAN policy routing rule) with the settings in the screenshot below, I'm having issue with traffic between my VLANs (subnets). Any ideas what might be the issue?

Have you added static routes to communicate with your VLAN networks or VLAN interfaces are configured on Sophos Firewall?

Yes, my VLAN interface and firewall rules are setup - I’ve been using this setup for a couple years now. It’s just once I added that SD-WAN policy, nothing seems to work across VLANs. Again, I’m sure I’m missing something with how SD-WAN policies work.

Can you please check the route precedence in CLI?

Login to SSH > 4. Device Console

console> system route_precedence show

This is what’s shown:

1. SD-WAN policy routes

2. VPN routes

3. Static routes

Please change 'Static routes' precedence on top of 'SD-WAN policy routes' and check whether VLAN communication works with the SD-WAN policy route or not.

console> system route_precedence set static sdwan_policyroute vpn

Thanks , everything seems to be working normally after that change. However, I guess I’m confused why that made a difference as I don’t have any static routes defined? Edit: I think this article explains why. Basically all I’m trying to achieve is:

1) All devices on my networks on all VLANs/subsets can only use my primary ISP.

2) Certain devices on my network can use my primary ISP, but also my backup ISP when the primary ISP is down.

I’m hoping the SD-WAN policies can achieve this.

Thanks , everything seems to be working normally after that change. However, I guess I’m confused why that made a difference as I don’t have any static routes defined? Edit: I think this article explains why. Basically all I’m trying to achieve is:

1) All devices on my networks on all VLANs/subsets can only use my primary ISP.

2) Certain devices on my network can use my primary ISP, but also my backup ISP when the primary ISP is down.

I’m hoping the SD-WAN policies can achieve this.