Disallow some clients on LAN to use backup gateways

Question

Hello everyone. 
 I am running Sophos Firewall SFVH (SFOS 19.5.3 MR-3-Build652) I have a primary fiber internet connection and a 4G connection as a backup gateway. This is set to enable when the primary connection fails. 
 I want to disallow Internet connection to some clients on the LAN side through the 4G gateway, to save bandwidth. 
 How can this be achieved?

Alejandro Sanchez · Answer

I solved it using SD-WAN profiles and SD-WAN routes SD-WAN Profiles: 
 Create two profiles, one for the main gateways and one for the backup gateways. In my case, using load balancing. 
 SD-WAN Routes 
 I used this approach: block everything and let some clients pass. You can choose the other way around, depending on your needs. 
 Create a SD-WAN Route using the LAN as incoming interface. In Source Networks, Add the definitions for the computers allowed to use all gateways. Check "Select SD-WAN Profile" in the "Link selection settings". As a SD-WAN Profile, select the main gateway profile created earlier. 
 For the block everything route, create a new SD-WAN Route using the LAN as incoming interface, and "Select SD-WAN Profile" in the "Link selection settings". As a SD-WAN Profile, select the main gateway profile created earlier, and be sure to check "Route only through specified gateways". This way, when the main gateways are offline and the backup gateways took over, the computers in the LAN will not connect to internet. 
 In my case, I have servers in the DMZ zone that will use the default gateways in Routing / Gateways

Disallow some clients on LAN to use backup gateways

Top Replies