Static route from CLI being removed

Question

Hey there, 
 
 My DHCP IP address from my carrier is 203.xx.xx.xx/16 but the gateway is in a different subnet 100.xx.xx.01.. wacky system, but not one I was really expecting.. 
 
 The issue I'm running in to is that I'm trying to establish a backup IPSec tunnel for this service and so I want the remote site to be specifically routed out of this interface.. I've attempted to set this in the GUI as follows but it the traffic just doesn't head out that interface.. I've tried SD-WAN routes too.. but again, it stubbornly refuses to go out this gateway..

What does work however is setting a static route via the CLI.. 
 
 XG115_XN02_SFOS 19.0.1 MR-1-Build365# ip route add 202.xxx.xxx.xxx/32 dev Port2 
 XG115_XN02_SFOS 19.0.1 MR-1-Build365# 
 
 This works really well and the failover configuration is fantastic.. until at midnight a day or two later the static route is removed.. 
 
 Any help would be greatly appreciated..

LuCar Toni · Accepted Answer

So you want to control, which Interface / route is being used for IPsec, is this your goal? 
 Static routing is likely not the correct approach here. 
 Try the following: 
 Add an SD-WAN route for your traffic (your destination for example). 
 https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Routing/SDWANRoutes/RoutingSDWANRoutesAdd/index.html 
 
 Then check if the SD-WAN Routes are applied for System generated traffic: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Routing/SDWANRoutes/RoutingSDWANRoutesBehavior/index.html#reply-packets

LuCar Toni · Answer

ip route commands on advanced shell are not officially supported and will be replaced after a while (or reboot). 
 You should configure the route via Webadmin. If you do it via Webadmin, the route should work - If not, you should look into the packet capture and check the route precedence.

LuCar Toni · Answer

Generally speaking, Ipsec will set own routes via Policy based VPN. So there are routes between Local and remote subnet. 
 You can manually set a route as well: support.sophos.com/.../KB-000035839

Static route from CLI being removed

Top Replies