Adding WAN interface removes active WAN interface from Default SNAT rule, taking network down

Default NAT should only include all WAN interfaces. 
So you are saying, by adding another WAN interface (two) it removed the old Port2 from Default NAT? 
what about the WAN link manager?

Yes, Port2 was automatically removed from the Default SNAT policy.

Port2 in WAN Link Manager as Failover.  Port3 in WAN Link Manager as primary but was down so should have failed over and set Port2 as primary as it showed green in WAN Link Manager.

Like this?

Because in my example, it is still in there:

Yes, like that.  Except the new one is red, not green because it's not plugged in yet. Existing connection is then setup as backup and to take the weight of the original when it becomes active.

I've had reports for other internal staff about this happening and they are manually fixing the Default SNAT policy to fix it.  It's not consistent, but then it's not often that we are adding a second ISP with Sophos firewalls.

Setup the same in my firewall (XGS126 v20) and it worked just fine.  

Started here.

Added 2nd ISP

Setup Gateways the exact same way as I did on the customer firewall

And this was as it should be.

It's an inconsistent issue.  Maybe reproducible if I were on v19.5.3. I don't know.

I saw this same issue too, but in my case, the simple act of clicking the update interface button would remove all other WAN interfaces and leave only the updated one in the default SNAT rule. And I have to manually readd them.

We have experienced this issue as well.  But it's not a reproducible issue so we just work past it. You never know which firewall it will happen with so how do you ever engage support? The basic support folks will just add the interface back to the NAT policy and say it's fixed without ever digging down to the root cause.

If this happens, could we collect the logs of the firewall? Get applog.log and csc.log and tell us the time, you change it. 

The final fix for me was to disable/remove the "Default SNAT IPv4" which has a description of "Updated automatically with WAN interface changes." which sounds like a promise to break things and ruin your day, and create an identical NAT rule (I have it at the bottom of my NAT rules list) having the Outbound interface set to "Any" only this time updating interfaces won't change the Outbound interface in the manually created rule.

Setting Outbound interfaces to Any will cause problems for VPN traffic in my experience.  Unless you setup a NAT rule above the final SNAT policy for that VPN traffic.

Funny thing is, it's the opposite in my environment because setting the interfaces to only the WAN interfaces by hand would cause VPN issues as it won't translate requests for the hidden tun0 interface and only setting it to Any would make VPN usable.