How do allow Sophos XG itself failover to a backup ISP (SD-WAN policy routing)

Question

I currently have Sophos XG installed on a Qotom Q335G4 box with two ISPs, a primary and a backup for just a few devices. I have an SD-WAN policy route setup that allows this:

Everything works as expected but I also have email notifications setup in Sophos XG so I'll get an email when one of the ISP interfaces is down. However, when my primary ISP is down, I don't seem to get any emails until it comes back up. I'm assuming it's because Sophos XG itself is only using the primary ISP. Is there a way to allow the Sophos XG device itself to fail over to the backup ISP as well?

LuCar Toni · Answer

There is a switch for system-generated traffic on the CLI for SD_WAN. 
 https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/RoutingSDWANPolicyRouting.html 
 If you activate this, it will consider a SD-WAN Rule as well. 
 PS: This SD-WAN rule seems rather easy. So actually you do not need SD-WAN for this case. You could use WAN Link manager instead (Active-Backup)

LuCar Toni · Answer

Beside i would recommend to use Central for Notification and Backups, this looks odd to me. You are using the Smarthost option i guess, not the MTA (own SMTP service). This service should consider the SD-WAN PBR table. What you can do: 
 Perform a conntrack -E | grep 465 
 Then send a Email (test?) to the gateway. 
 There should be some entries. In those entries you see a pbrid_dir0=0 pbrid_dir1=0 Both entries shows the selected PBR routes.

How do allow Sophos XG itself failover to a backup ISP (SD-WAN policy routing)

Top Replies