HOW TO SELECT SPECIFIC GATEWAY

Question

Hi, 
 I am new to Sophos Firewall XG. 
 I have two ISP with different gateways: 1.1.1.1 and 2.2.2.2 (not real gateways) 
 Now I want end users who are using internet to be connected to gateway 1.1.1.1 
 and for VPN users connected to gateway 2.2.2.2. 
 How do I do this? 
 Thank you.

FormerMember · Accepted Answer

For the traffic that is going out to the internet, You need to enable Masquerading (NAT) in the Firewall rule (all the rules that allow traffic from LAN to WAN) and keep the outbound address as your required IP address. 
 
 You will have to make an IP address host inside a NAT host so don't get confused while adding Outbound host. 
 This will MASQ the outgoing traffic with the selected IP address. For SSL VPN, You can use the "Override hostname" option and add your second IP there to force users to connect to that specific IP. ==> Navigate to VPN > Show VPN settings 
 You will need to re-download configurations in the machines if SSL VPN is already configured. Also you won't be able to perform failover for SSL VPN if you have or will have more than one ISPs with "Override hostname" enabled.

FormerMember · Answer

NAT rule is mandatory. You can skip the SD WAN policy route if you only have one ISP configured on XG. 
 If you're skipping the SD WAN rule then ensure to select the outbound interface in the NAT rule, otherwise XG will NAT all the outgoing traffic with that specific MASQ IP and that will be problematic in multiple gateway load balancing scenario.

HOW TO SELECT SPECIFIC GATEWAY

Top Replies