Hello!
I need clarification:
If in SFOS the setting of route_precedence is: static, sd-wan, vpn it means that if I have no static routes present, the one that is set in sd-wan applies.
Does the gateway set at the interface (WAN) level fall into static routes? Thank you
I talked about this here: community.sophos.com/.../routing-in-xgv18-with-sd-wan-pbr
__________________________________________________________________________________________________________________
Hello Lucar,
returning to the document: community.sophos.com/.../routing-in-xgv18-with-sd-wan-pbr
Is it not appropriate to automatically insert in the table of static routes the directly connected networks ? (without giving way to delete them)
I mean they appear here
Basically there is no need to do this. If you go SD-WAN, it will be overwritten anyway. If you are in Static routing, most customer understand, that direct attached are there. For visibility, maybe - But it would be just a visibility feature.
__________________________________________________________________________________________________________________
For visibility OK or what command I need to use to see current route?
In Advanced Shell I use: ip route show table all
The problem is, SD-WAN will and can be used on packet level. It is a new concept and SFOS leaves the "old school routing world" you are looking at. Therefore a ip route shows you the entire "static stack" but will ignore the SD-WAN part. SD-WAN is a dynamic world. There is no "Tell me which route SFOS will take for this particular client". Because it could rely on "I can tell you the answer RIGHT NOW, but it could change by SLAs etc.".
So if you want to look at the old world (static) use the diagnostic tab in SFOS webadmin. It will show you the route. For SD-WAN, this is dynamic and depending on different factors.
__________________________________________________________________________________________________________________
The problem is, SD-WAN will and can be used on packet level. It is a new concept and SFOS leaves the "old school routing world" you are looking at. Therefore a ip route shows you the entire "static stack" but will ignore the SD-WAN part. SD-WAN is a dynamic world. There is no "Tell me which route SFOS will take for this particular client". Because it could rely on "I can tell you the answer RIGHT NOW, but it could change by SLAs etc.".
So if you want to look at the old world (static) use the diagnostic tab in SFOS webadmin. It will show you the route. For SD-WAN, this is dynamic and depending on different factors.
__________________________________________________________________________________________________________________
SD-WAN is a new concept, I agree with you, but it is a concept that intelligently identifies which route to select among those present, based on various parameters and the occurrence of a situation. Knowing the contents of the firewall routing table (even for diagnosis purposes only) is another matter that is missing!
I have 3 networks in my house but in a company there could also be 30 networks present. Having a place to see them would be appropriate.
Leaving aside that with the Home version we never have to deal with 30 networks, so there is no need to have the advanced shell, however, building a command in the console to display the routing table would help. We all know that Cisco's success has been such also because it gave powerful diagnostic tools in its hands.
I apologize if I went off-topic with respect to my initial problem which I repeat is the conversion of SDWAN rules between version 18 and 19, which I ask you to do further verification.
Thanks
What is missing? SD-Routing is the same concept in V18 vs V19. It simply has another layer of "What to do, if the route hits". A more dynamic part of Sd-WAN.
__________________________________________________________________________________________________________________
Simple: A place where I can see the firewall routing table. For example:
https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/372042/router-info-routing-table
That is the routing information of static. Which you could get from the advanced shell basically. The fortigate link does not contain the SD-WAN part. It only has the static involved.
__________________________________________________________________________________________________________________
Lucar, I said earlier that I went off topic with respect to the SD-WAN topic I started from. Sophos XG lacks a similar tool if you don't use the advanced shell; useful tool to carry out disgnosis to both home and professional users. I don't want to dwell any further: this is my vision (maybe limited)
Instead, I will report the problem of SD-WAN rules when upgrading from V18 to V19 on another thread.
Gabriele
There's a thread dedicated to things you need the Advanced Shell to do. It sounds like displaying the full static routing table is one of them:
It is kinda correct.
So basically the information is there, just spread across different screens. Network Interfaces for the direct attached networks and static routes. If you start to use BGP/OSPF, the information is there in the extra window for those both systems.
basically the network interfaces is not there.
__________________________________________________________________________________________________________________
