How do allow Sophos XG itself failover to a backup ISP (SD-WAN policy routing)

There is a switch for system-generated traffic on the CLI for SD_WAN.

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/RoutingSDWANPolicyRouting.html

If you activate this, it will consider a SD-WAN Rule as well. 

PS: This SD-WAN rule seems rather easy. So actually you do not need SD-WAN for this case. You could use WAN Link manager instead (Active-Backup)

Thanks LuCar Toni. I couldn’t find a way to use the WAN link manager to allow only certain devices on my network to utilize the backup ISP in the event of the primary ISP going down. Is there a way to do this? It looks like the only thing you can do with the WAN link manager is failover everything to the backup ISP, not specific devices or networks.

Thats correct - My assumption was, this is your only rule and if you use only one rule in SD-WAN you can switch to WAN link manager.

But if you want to route certain devices etc. you should use the CLI switch and create a own rule. 

The Rule for the own traffic with the switch needs to have source "ANY" but destination can be: https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/DefaultAddressesAndPorts.html

Ah sorry, I’m kind of mixing two questions here. Just to make sure I understand the answer to the original question correctly - if I want to allow system generated traffic (from Sophos XG) to failover to a backup ISP, I need to go into the console and use:

set routing sd-wan-policy-route system-generate-traffic enable

Now, since I’m using an SD-WAN policy to failover only specific devices on my network, do I need to add anything here to the “Source Destination” section? Or does the command I entered above in the console essentially create a separate SD-WAN policy routing for the system generated traffic (Sophos XG) itself that I just can’t see in the GUI?

Let me enhance this setup a little bit. Currently, if this option is not enable, System own traffic will use the default gateway configuration (WAN link manager). For your other traffic, the appliance will use all applicable Sd-WAN PBR rules. 

If you enable this option, the appliance will start to look for SD-WAN PBR rules as well. If there are none, it will fallback to the default gateway.

To get the SD-WAN PBR routes applicable to your system own traffic, you need to specify a rule, which matches the own traffic. As the system generate this traffic, the traffic is generated by "ANY". This will on the other hand also hit for all devices. Therefore you need to find a way to match the traffic to something else. As it is known, which hosts the appliance try to reach, you can create a rule with ANY as Source and Destination the Sophos own services. This rule will start to match for the system own traffic.

That is some busy work right now, to create all those objects. Thinking about this, i made this back in the day but are not able to find the XML anymore... But i will do this later and create a recommend read to create those objects with a XML (Import/export). 

Ah okay - that makes sense. It’s unfortunate there’s no way to specify only traffic from the system (Sophos XG) itself. However, I only need the ability for Sophos XG email notifications to go out (really just to know if my primary ISP is down) which I have configured using a Gmail account via SMTPS. So what I’ve done is created a second SD-WAN policy with a Source Network of “Any” and set the Destinations Networks to “smtp.gmail.com” and Services to “465” (SMTPS port used by Gmail). I’ll have to test this out later just to make sure it works as intended. Appreciate the help LuCar Toni!

See: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/129430/xml-import-for-sfos-default-objects

Unfortunately this doesn't appear to work. The email notification that my primary ISP is down only goes out once the primary ISP is back up. What I'm trying to achieve is if the primary ISP goes down, Sophos XG sends the email using the backup ISP.

After applying this rule, check the packet capture on the Firewall, which interface, firewall rule and which NAT rule is applied. It should work directly. 

Unfortunately I'm not too familiar with packet capture. Is there perhaps an article somewhere that explains how to use it for just packets leaving the firewall itself?

Unfortunately I'm not too familiar with packet capture. Is there perhaps an article somewhere that explains how to use it for just packets leaving the firewall itself?

Just to be sure: The SMTPS Service and the destination IP is correct? 

If you connect from your PC to this, does it work and use the correct interface? Because it should also affect the clients behind XG. 

Yes. When my primary ISP is down, I am able to successfully send emails out from my computer using Gmail just fine. As soon as I reconnect the primary ISP, I get the email from Sophos XG that my primary ISP was down. It seems like the email notifications from Sophos XG do not even attempt to use the backup ISP, despite the SD-WAN policy rule.

Beside i would recommend to use Central for Notification and Backups, this looks odd to me. You are using the Smarthost option i guess, not the MTA (own SMTP service). This service should consider the SD-WAN PBR table. What you can do: 

Perform a conntrack -E | grep 465  

Then send a Email (test?) to the gateway. 

There should be some entries. In those entries you see a pbrid_dir0=0 pbrid_dir1=0  Both entries shows the selected PBR routes.