Help routing specific device traffic across layer 2 connection

Question

Hello there, 
 I&rsquo;m trying and failing to route all internet traffic from device 10.5.15.20 at SITE B across the layer 2 MAN and out ISP1 WAN at SITE A. 
 I&rsquo;m trying not to impact any other traffic at SITE B with this configuration, only internet bound traffic from 10.5.15.20 should be routed in a way that it traverses the Layer 2 MAN and is routed to the internet via ISP1 WAN at SITE A. 
 This layer 2 MAN from the provider is not MPLS and has no provided gateway or routes, the interfaces at both sites can ping each other across the MAN connection. It's basically a Layer 2 switch connection. 
 Any recommendations? 
 Both firewalls at each site are running SFOS v19 MR1. 
 
 Any help is appreciated!

Bharat J · Accepted Answer

Hi Sam Mroe 
 I have tried your network scenario to route 10.5.15.20 with Site A ISP1 and it worked in my LAB with the Source link: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/121408/routing-in-xgv18-with-sd-wan-pbr 
 Below are steps taken to achieve your requirement : 
 1. Checked Ping connectivity with DMZ Zone at Site A and Site B 
 Site A 
 
 Site B

2. Created Gateway by ADD under Configure -->Network -->Routing -->Gateways at Site B.

3. Created an SD-WAN rule to route the traffic of 10.5.15.20 with DMZ Gateway at Site B. 
 
 4. Created a Firewall rule from LAN-DMZ at Site B : 
 
 5. Created static route for 10.5.15.0/24 at Site A : 
 
 6. Created a Firewall rule from DMZ-WAN at Site A : 
 
 7. Created SD-WAN rule to route 10.5.15.20 system traffic with ISP1 at Site A

Trace route result from 10.5.15.20 system at site B

Packet capture from Site B

Packet Capture from Site A :

At Site A, for the rest of the LAN network, I have used the feature of SD-WAN to route the networks with ISP2 and ISP1 respectively 
 Thanks and Regards

Erick Jan · Answer

Hi Sam Mroe, 
 You can check this guide if applicable 
 Route all Branch Office internet traffic through the Head Office ISP gateway : https://soph.so/8YUFlK 
 But instead of the whole Branch network, just change the following 
 
 Step 2. B Change the Source Network to :10.5.15.20 ( For allowing WAN on Site A) 
 Services to: HTTP/HTTPS or desired Services 
 Change the VPN to your L2 MAN 
 Step 3. Change the Source Network to:10.5.15.20 (Blocking WAN for Site B) 
 So that, only 10.5.15.20 will be affected 
 *Make Sure you change the Any to only 10.5.15.20 so that no other settings will be affected.

Help routing specific device traffic across layer 2 connection

Top Replies