Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 2 replies
  • Answers 1 answer
  • Subscribers 39 subscribers
  • Views 1447 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Site to Site SSL VPN: How to choose/force a gateway for multi-WAN client?

Ibrahim Al Sayed

Hello,

I have the following SSL VPN (site-to-site) connections:

I've 2 WAN interfaces (configured as Active/Active with a 50% balance - which is exactly what I want):

As a client firewall, I'd simply like to force the SSL VPN (site-to-site) connections to go through a specific WAN, and even if this WAN was down it should not go through the other one.

I'd be glad to get your help.

Thanks



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for reaching out to Sophos Community.

    Setup Source NAT policy at client firewall end to route/force the SSL VPN (site-to-site) connection traffic from a specific WAN.

    Sophos XG Firewall: How to NAT Sophos Firewall generated traffic

    Here is the command for your reference.

    console> set advanced-firewall sys-traffic-nat add destination <Server_FW_Public_IP> interface <Client_FW_WAN_Interface> snatip <Client_FW_WAN_Interface_IP>

    console> set advanced-firewall sys-traffic-nat add destination 16.xx.xx.15 interface Port5 snatip 12.xx.xx.13

    ==> To check NAT policy:

    console> show advanced-firewall

    Ibrahim Al Sayed said:
    even if this WAN was down it should not go through the other one.

    Additionally for this, you'll need to set up an SD-WAN policy(Under Routing) as shown below.

Reply
  • FormerMember
    0 FormerMember

    Hi ,

    Thank you for reaching out to Sophos Community.

    Setup Source NAT policy at client firewall end to route/force the SSL VPN (site-to-site) connection traffic from a specific WAN.

    Sophos XG Firewall: How to NAT Sophos Firewall generated traffic

    Here is the command for your reference.

    console> set advanced-firewall sys-traffic-nat add destination <Server_FW_Public_IP> interface <Client_FW_WAN_Interface> snatip <Client_FW_WAN_Interface_IP>

    console> set advanced-firewall sys-traffic-nat add destination 16.xx.xx.15 interface Port5 snatip 12.xx.xx.13

    ==> To check NAT policy:

    console> show advanced-firewall

    Ibrahim Al Sayed said:
    even if this WAN was down it should not go through the other one.

    Additionally for this, you'll need to set up an SD-WAN policy(Under Routing) as shown below.

Children
Unfiltered HTML