Change Sophos XG Routing Priority/Precedence

Hi, a quick one today.

We have a customer with a Sophos XG 230, a lot of Site-2-Site VPNs and different Policy-based routes, mainly for the 3 different ISPs they have.

The default “route precedence” the Sophos XG uses is as follows.:

1. Static routes

2. SD-WAN policy routes

3. VPN routes

This caused issues with the VPN traffic because the firewall used the policy-based routing for a few paths rather than the VPN tunnels. I don’t remember the exact problem, but I do remember that I needed to change the priority.

Here is how to change it. SSH into the device and select “Device Console”.

fedora-kde :: ~ » ssh admin@172.16.16.16
Sophos Firmware Version SFOS 18.0.5 MR-5-Build586 

Main Menu 

   AA.  Device Activation 
    1. Network  Configuration
    2. System   Configuration
    3. Route    Configuration 
    4. Device Console 
    5. Device Management
    6. VPN Management
    7. Shutdown/Reboot Device
    0. Exit 

    Select Menu Number [0-7]: 4

To show the current precedence.

console> system route_precedence show
 Routing Precedence:
1. Static routes
2. SD-WAN policy routes
3. VPN routes

Change the priority.

console> system route_precedence set static vpn sdwan_policyroute

Another check.

console> system route_precedence show
Routing Precedence:
1. Static routes
2. VPN routes
3. SD-WAN policy routes

Short one today.

Till next time.