Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Replies 7 replies
  • Subscribers 40 subscribers
  • Views 279 views
  • Users 0 members are here
Options
Suggested

XGS 3300 wrong Gateway

Bart van der Horst

Hi, I've got the following case:

HA XGS3300

Three WAN connectinons

P2 ISP 1

P4 ISP 1

P6 ISP 2

P2 and P4 are BGP.

P6 is stand alone.

All internet connections are working.

When configuring SNAT and or SD-WAN all traffic for WAN is over port 4, none is going to port 6.

Checking the logs it selects the correct FW and NAT policy, then the requested GW is correct but port OUT is P4.

We have the same setup with an other customer reviewed everything, with the other customer it is working fine, always the correct nat policy an correct gateway.

Only difference we can find is this:

Advanced CLI:

route -n

 

There is a default route 0.0.0.0 to port4, we don't have them anywhere on any of our other customers FW's.

It's not in the Gui anywhere and not on the normal console.

Don't know where this default route is coming from or how to get rid of.

Kind regards,



Edited TAGs
[edited by: Raphael Alganes at 11:31 AM (GMT -8) on 7 Nov 2024]
Parents Reply
  • 0 in reply to Bart van der Horst

    So basically, BGP is a static route in principle of routing stack.  Sophos Firewall: Routing in Sophos Firewall with SD-WAN PBR If you generate a SD-WAN Route, it will not hit, as your routing precedance is: static - sd-wan. 
    That means, the default route from BGP will be always applied. 

    You can change it to SD-wan - static, but then the SD-WAN to WAN route will always hit.  

    You should be very careful about the usage of SD-WAN Routes with Destination Network ANY.

    ANY means, it will be applied to ANY packet. You can also influence internal network traffic. I would rather recommend to move from ANY to Internetv4. 

    __________________________________________________________________________________________________________________

Children
No Data
Unfiltered HTML