How to use two gateways on the one router XG 310?

Hi Vlascheslav,

Thank you for reaching out to Sophos Community.

Can you paste your screenshot here?

Also, I agree with your plan. Don’t forget to create a backup plan for rollback.

• First, create a new interface for the secondary WAN
• Separation of Groups for Policy
• Creation of SD-WAN and pointing to desired gateways and Firewall rules

Hi Erick,

Thank you for reply. My network looks like this

1. First, I created a new interface

2. Secondly, I separated the local and remote IP addresses into groups

3. I also plan to create the following rules in SD-WAN Routes to send network traffic through various gateways

 Erick Jan  Am I right or have I forgotten something?

Hi Viacheslav,

You may use this Techvid for reference on the steps for separating traffic.

https://techvids.sophos.com/watch/wa9zCk2gTKVmiekmybyux7

Following the instructions in the video, I created rules in Sophos, but I do not see network traffic in Log Viewer by selecting the "SD-WAN" filter. The list is completely empty. Do routing rules work at all? How to check? I haven't turned on the WAN2 interface yet, but I think something should have appeared in the event log because WAN1 is working, right? The counters in SD-WAN routes say that something is happening.

Hi Viacheslav,

To check this further, I recommend doing a packet capture while probing. 

• Packet capture

Thank you, Erick, for advice. When I enable the rule in SD-WAN, the API stops working on one of the servers because the reply-dst header in redirected packets changes from 192.168.2.2 to 81.82.43.202. How can I fix it?

Hi Viacheslav,

Kindly check your Firewall Rule/NAT/DNAT settings.

I've already done it. The only thing I noticed is that after enabling the rule in SD-WAN, the firewall rule ID for the described packets changes from 22 to 14.NAT rule ID is still #40. But I still don't understand why this happens and what should be changed in the configuration.

Even if you change the firewall rule so that the appropriate rule applies to these packets, the API still does not work.  

And one more thing. When I enabling the rule in SD-WAN the devout value in the packet headers changes to Port2 (WAN1), while without SD-WAN enabled we have devout=Port1 (LAN). I already tried changing SNAT to 192.168.2.2 (which changed the dst-reply value in the packet headers) and Outbound Interface to Port1 in NAT rule #40, but it didn't work. The counter generally does not change and the packets do not travel.

I've already done it. The only thing I noticed is that after enabling the rule in SD-WAN, the firewall rule ID for the described packets changes from 22 to 14.NAT rule ID is still #40. But I still don't understand why this happens and what should be changed in the configuration.

Even if you change the firewall rule so that the appropriate rule applies to these packets, the API still does not work.  

And one more thing. When I enabling the rule in SD-WAN the devout value in the packet headers changes to Port2 (WAN1), while without SD-WAN enabled we have devout=Port1 (LAN). I already tried changing SNAT to 192.168.2.2 (which changed the dst-reply value in the packet headers) and Outbound Interface to Port1 in NAT rule #40, but it didn't work. The counter generally does not change and the packets do not travel.

Hi,

Have you tried to set the route precedence to SD-WAN?

console> system route_precedence show
console> system route_precedence set sdwan_policyroute static vpn

console> system route_precedence show
Routing Precedence:
1.  SD-WAN policy routes
2.  Static routes
3.  VPN routes

You may refer to the following KB

• SDWAN Troubleshooting
• Sophos Firewall: How to Choose The Gateway For A Firewall Rule v19

If it remains unresolved, I suggest opening a support case to review the logs and settings further, fixing it, and sharing the case ID here for reference.

Hi Erick,

The article describing possible troubles helped me. It was enough to improve the existing SD-WAN rule by adding the "Internet IPv4 group" group in the "Destination" column instead of "Any" and changing the routing priority through the console. Thank you very much for help.

Hi Viacheslav,

That is great to hear, and thank you for the update.