Help routing specific device traffic across layer 2 connection

Hi Sam Mroe,

You can check this guide if applicable

Route all Branch Office internet traffic through the Head Office ISP gateway: https://soph.so/8YUFlK

But instead of the whole Branch network, just change the following

Step 2. B Change the Source Network to :10.5.15.20 ( For allowing WAN on Site A)

Services to: HTTP/HTTPS or desired Services

Change the VPN to your L2 MAN

Step 3. Change the Source Network to:10.5.15.20  (Blocking WAN for Site B)

So that, only 10.5.15.20 will be affected

*Make Sure you change the Any to only 10.5.15.20 so that no other settings will be affected.

Hi Erick,

Thanks for the reply and sorry for the delay in response.

I attempted to follow your link and recommended changes, unfortunately I don't think this will work. Replacing the VPN with my L2 MAN doesn't build the required routes for internet traffic, nothing ends up hitting the NAT translation rule.

Since the L2 MAN doesn't have any gateways/routes, I guess a simpler explanation is to think of the L2 MAN as a L2 switch or just a direct connection from sophos to sophos. How would I route traffic from that specific 10.5.15.20 device across that direct connection for internet access without it being system wide (static route) or requiring a gateway (SD-WAN policy routes) as the default DMZ/LAN Zone types aren't routing that traffic correctly.

Any recommendations are greatly appreciated, thanks!

Hi Erick,

Thanks for the reply and sorry for the delay in response.

I attempted to follow your link and recommended changes, unfortunately I don't think this will work. Replacing the VPN with my L2 MAN doesn't build the required routes for internet traffic, nothing ends up hitting the NAT translation rule.

Since the L2 MAN doesn't have any gateways/routes, I guess a simpler explanation is to think of the L2 MAN as a L2 switch or just a direct connection from sophos to sophos. How would I route traffic from that specific 10.5.15.20 device across that direct connection for internet access without it being system wide (static route) or requiring a gateway (SD-WAN policy routes) as the default DMZ/LAN Zone types aren't routing that traffic correctly.

Any recommendations are greatly appreciated, thanks!

Hi Sam Mroe,

I'm sorry to hear that, I would recommend you to reach out to your Sales Engineer and or Account Manager so they can assist you with this and provide all the resources you might need for implementation

Hi  Sam Mroe

I have tried your network scenario to route 10.5.15.20 with Site A ISP1 and it worked in my LAB with the Source link: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/121408/routing-in-xgv18-with-sd-wan-pbr 

Below are steps taken to achieve your requirement : 

1. Checked Ping connectivity with DMZ Zone at Site A and Site B 

Site A 

Site B 

2. Created Gateway by ADD under Configure -->Network -->Routing -->Gateways at Site B.

3. Created an SD-WAN rule to route the traffic of 10.5.15.20 with DMZ Gateway at Site B.

4. Created a Firewall rule from LAN-DMZ at Site B : 

5. Created static route for 10.5.15.0/24 at Site A : 

6. Created a Firewall rule from DMZ-WAN at Site A : 

7. Created SD-WAN rule to route 10.5.15.20 system traffic with ISP1 at Site A

Trace route result from 10.5.15.20 system at site B

Packet capture from Site B

Packet Capture from Site A : 

At Site A, for the rest of the LAN network, I have used the feature of SD-WAN to route the networks with ISP2 and ISP1 respectively 

Thanks and Regards

Sorry for the delay, but yes great answer and I appreciate you building this out and sharing it on the forum. Hopefully it helps future Sophos users if they run across a similar use case.

This is exactly the solution I ended up building a month ago with a bit of guidance from support (they recommended SD-WAN at site B and static route at site A and I figured out the rest through trial and error). It's working well and we've actually expanded this to 4 distinct sites with similar connectivity.

Thanks again!