Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 39 subscribers
  • Views 2654 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Firewall red to red connection does not switch back to primary internet

Ralph Smith1

Sophos Firewall version 19.5.1

Main office has XGS 3300

Branch offices have XGS 136 devices

Branch offices have primary cable internet on port 2, and 4G/LTE cellular backup internet with a Netgear cellular modem connected on port 3.

Cable on port 2 is set to Active in Wan link manager, cellular on port 3 is set to Backup.

Branch offices are connected to the main office via RED to RED: Main office is set as "Firewall RED Server", branch offices are set as "Firewall RED client".

When the cable internet goes down at a branch, the backup cellular internet kicks in as expected, and when this happens the RED tunnel reconnects using the cellular network, as expected.

However, when the cable internet is restored, the web traffic switches back to it as expected, but the RED tunnel remains on the Cellular backup connection.

The cellular is very slow compared to the cable, and for users at the branch office, logging in (there is no domain controller at the branch) and accessing files over the WAN is very slow when the tunnel is on the cellular connection.

Is there any way to force the RED tunnel to reconnect using the cable connection when it comes back online?

Thanks.



This thread was automatically locked due to age.
Parents
  • 0

    Another Idea: Try to move to Ipsec route based. This would mean, both tunnels keep on existing at the same time but you can build SD-WAN Route on top on each route. 

    __________________________________________________________________________________________________________________

Reply
  • 0

    Another Idea: Try to move to Ipsec route based. This would mean, both tunnels keep on existing at the same time but you can build SD-WAN Route on top on each route. 

    __________________________________________________________________________________________________________________

Children
Unfiltered HTML