Safely change route precedence on Sophos Firewall

Route precedence globally determines whether Sophos Firewall evaluates Static Routes, SD-WAN Policy Routes or VPN routes first. The order is read from left to right: The first matching routing type wins.

Why route precedence is needed

Sophos Firewall does not keep Static, SD-WAN and VPN in one common routing list. They are separate categories, and more than one category can contain a matching path to the same destination. Route precedence determines which category is searched first for a matching route.

A typical example: A LAN client must reach the remote network 10.20.0.0/16 through a policy-based IPsec tunnel. At the same time, an SD-WAN route with the destination Any also matches this traffic.

• With static sdwan_policyroute vpn, the firewall checks Static first. If no matching path exists there, the broad SD-WAN route matches next, and the traffic may go to the WAN gateway instead of the VPN tunnel.
• With static vpn sdwan_policyroute, the firewall checks VPN routes immediately after Static. The route to the remote network therefore takes priority over the general SD-WAN route.

Replace the example network 10.20.0.0/16 with the actual remote network. The important question is not which order sounds generally “better”, but which routing type must win for the specific packet flow.

Route precedence orders only the categories. It does not change the order of individual Static Routes or SD-WAN Routes within their category. Before changing it, answer three questions:

1. Which specific traffic currently takes the wrong path?
2. Which of the three categories contain a matching route?
3. Which category should take priority for this traffic?

If only one category matches, changing route precedence will not solve the problem. The affected route, SD-WAN policy, VPN configuration, NAT rule or return path must be corrected instead.

View and change route precedence directly

Run the commands in the Device Console, not in the Advanced Shell. After signing in through SSH, select menu option 4. If access has not been configured yet, see Connect to Sophos Firewall using SSH.

The following example sets Static first, VPN second and SD-WAN last:

system route_precedence show
system route_precedence set static vpn sdwan_policyroute
system route_precedence show

The first command displays the current order, the second changes it and the third confirms the result. A set command always contains all three values. The order is determined by the position of the values, not by adding numbers.

⚠️ Important: The change takes effect immediately and globally. Before running the set command, record the complete original order and verify an independent management path. An incorrect order can affect production traffic as well as WebAdmin and SSH access.

Restore the Sophos default order with:

system route_precedence set static sdwan_policyroute vpn

WebAdmin also shows the current order under Routing > SD-WAN routes, but it can only be changed through the Device Console.

What Static, SD-WAN and VPN mean

The three values represent routing categories rather than individual routes:

• static includes directly connected networks, Unicast Routes, Dynamic Routes and SSL VPN.
• sdwan_policyroute includes the policy routes configured under Routing > SD-WAN routes.
• vpn includes automatically generated policy-based IPsec routes. On SFOS 22.0, it also includes routes defined with ipsec_route.

The SFOS version matters for ipsec_route: On SFOS 21.5 it belongs to the static category, while on SFOS 22.0 it belongs to vpn. The Sophos Firewall IPsec route guide explains the complete classification.

SSL VPN always belongs to static, not to vpn. Route-based IPsec through XFRM interfaces is controlled by the configured static, dynamic or SD-WAN route. The XFRM interface, route and its administrative distance are decisive in that case, not only the position of vpn.

Static, SD-WAN, VPN

system route_precedence set static sdwan_policyroute vpn

This is the default order and the right starting point for many environments. It prevents broad SD-WAN routes from overriding directly connected networks, LAN, DMZ, VLAN and SSL VPN.

Static, VPN, SD-WAN

system route_precedence set static vpn sdwan_policyroute

This order keeps Static first, evaluates VPN routes next and uses SD-WAN last. It is useful when static and directly connected paths must retain priority while a competing policy-based VPN route must be checked before SD-WAN. Sophos also uses this order in documented scenarios for route-based VPN failover and MTA with multiple WAN connections.

SD-WAN, Static, VPN

system route_precedence set sdwan_policyroute static vpn

Use this variant only when policy routing must deliberately take priority over static routes. Take particular care with an SD-WAN route whose destination is Any: It may also capture internal networks or management access and send this traffic toward the WAN gateway. A standard SD-WAN route should therefore use the most specific practical destinations and be tested.

VPN, Static, SD-WAN

system route_precedence set vpn static sdwan_policyroute

Putting VPN first is a targeted exception, not a general fix for IPsec problems. Sophos requires this order for L2TP remote access, for example. However, vpn before static prioritizes VPN over Static only when the competing static route points to the WAN zone. For destinations in other zones, the firewall continues to use the static or local route.

Change route precedence safely

Before a production change, prepare both the command and the affected packet flow:

1. Save the complete current order with system route_precedence show and use it to prepare the rollback command.
2. Identify the source, destination, service, zone and interfaces involved. Check Static Routes, SD-WAN Routes, VPN routes and XFRM interfaces for competing destinations.
3. Test an independent path back to the firewall, such as a local console, separate management interface or unaffected administrative path.
4. Change only route precedence. Do not modify NAT, firewall, VPN and SD-WAN rules at the same time, so cause and effect remain clear.

If SD-WAN is involved, also check whether SD-WAN is enabled for system-generated traffic or reply packets:

show routing sd-wan-policy-route system-generate-traffic
show routing sd-wan-policy-route reply-packet

These options are not part of route precedence, but they can amplify its effect. Check Sophos Firewall SD-WAN routing for reply packets and system traffic explains them in detail.

After the set command, first confirm the order again with system route_precedence show. Then test the specific use case:

• Test the application, TCP connection or ping to the destination.
• Check Route Lookup, Log Viewer and Packet Capture when needed.
• Check NAT and the remote system’s return path.
• Test WebAdmin and SSH from the relevant management networks.

A green VPN status or an existing route does not prove that the packet flow works. Practical checks are covered in Test Sophos Firewall rules with Log Viewer and Packet Capture and Use Packet Capture in Sophos Firewall WebAdmin.

Rollback

For rollback, set the exact original order recorded before the change:

system route_precedence set <first value> <second value> <third value>

Replace all three placeholders. The previous state cannot be inferred from the first value alone because six orders are possible. Then repeat system route_precedence show and the same functional and management tests.

If the change does not solve the problem

• Only one destination network is affected: A more specific static route, a narrower SD-WAN route or a corrected VPN configuration is usually more precise than a global change.
• The VPN tunnel is green but traffic takes the wrong path: For route-based IPsec, check the XFRM interface and route first. For policy-based IPsec, also check traffic selectors and the version-dependent handling of ipsec_route. Follow the IPsec VPN troubleshooting guide.
• The outbound path is correct but the return path is not: Routing determines the path, while NAT changes the source or destination address. Check the return route and the NAT configuration.
• A migrated firewall shows an unexpected order: The output of system route_precedence show is authoritative, not the current default. Migrated SD-WAN routes may also remain linked to their original firewall rule and disappear when that rule is deleted.
• WebAdmin or SSH is unavailable after an SD-WAN change: Three conditions often coincide: SD-WAN precedes Static, a matching SD-WAN route uses Any, and System Traffic or Reply Packets are enabled for SD-WAN. Restore the original order through the prepared management path and narrow the SD-WAN route.

FAQ