[RED] A split network may never be in the same network as the uplink on the RED side.

Disclaimer: This information is posted as-is and the content should be referenced at your own risk

In order to avoid conflicting routing issues resulting malfunctioning of RED connection problems between Sophos XG or UTM Sophos recommends always avoid have the RED uplink network overlaps with any split network part of the configuration.

E.g: RED uplink router has the network range, then one of the internals split network has the same network.

Is very common that some ISP provide the routes/modem preset DHCP configuration to their devices on the range, which means that the RED WAN link will pull one IP of this range.

In a scenario where the conflict is existent, is possible to see on the syslog.log pulled out from the RED log, some fallback calls, which is used whenever there might be a configuration/setup problem with the RED.

2019:08:01-11:40:10 hq-1 red_server[6922]: A3501F4A4555555: command '\{"data":
{"message":"Received device configuration from UTM using network fallback mode successfully"},"type":"DISCONNECT"}'

NOTE: In some circumstances having the RED uplink network overlapping with one of the split networks,
will not affect the tunnel connectivity, but those events having this configuration will not be guaranteed since this is not a supported setup.

What are the options or recommended approaches?

  1. Change the internal network of that split network being advertised
  2. Change the modem's private IP range it uses to not be in the split network range (easiest and recommended)
  3. Change to full tunnel
  4. Put the ISP modem into bridge mode and have the public IP on the WAN interface of the RED. This will not work if its a PPPoE connection (most difficult and not many modems and ISPs support this)

Cleaned the formatting
[edited by: Yashraj at 11:15 AM (GMT -8) on 12 Nov 2020]