Skip to content
Avanet

Configure and test a static route on Sophos Firewall

Sophos Firewall

A static route tells Sophos Firewall which fixed next hop or tunnel interface to use to reach a specific destination. It is suitable when the path is fixed and no selection by source, service, application or link quality is required.

Short answer

Create an IPv4 route here:

Routing > Static routes > IPv4 unicast route > Add

For a destination network 10.20.0.0/24 that is reachable through router 192.0.2.2 on Port4, enter:

  • Destination IP / Netmask: 10.20.0.0/24
  • Gateway IP: 192.0.2.2
  • Interface: Port4
  • Administrative distance: 1
  • Metric: 10
  • Description: Branch_10.20_via_Core

The destination network, gateway and interface must match your environment. Do not reuse the Administrative Distance and Metric until you have checked existing routes to the same destination; 1 and 10 are only example values.

Then check destination 10.20.0.10 under Diagnostics > Tools > Route lookup. If the result shows Port4, the routing decision is correct. The change is only fully validated when a real client connection works and the reply returns.

For the traffic to work, you also need a matching firewall rule and a return route on the remote router. A static route does not allow traffic or apply NAT automatically.

Understand the example

The example uses the following topology:

  • The client network behind Sophos Firewall is 10.10.0.0/24.
  • The test client in this network is 10.10.0.10.
  • Firewall interface Port4 has transit IP address 192.0.2.1/30.
  • The next router has IP address 192.0.2.2 on this network.
  • The destination network 10.20.0.0/24 is behind this router.
  • The test system is 10.20.0.10.

The Destination is always the remote destination, not the next router. Gateway IP is the directly reachable next hop that forwards the packet. Interface is the port or tunnel interface through which this next hop is reached.

Enter the address directly under Gateway IP; you do not need a gateway object under Routing > Gateways. For your own environment, replace the destination network, gateway and interface together. If you change only one example address, the route may be saved but point to the wrong network or an unreachable router. The gateway IP must belong to the network of the selected interface.

If the path instead needs its own Health Check or must be selectable in an SD-WAN Route, follow the separate guide to Custom gateways on Sophos Firewall.

Configure Sophos Firewall zones and interfaces explains the fundamentals of ports, zones and interface IP addresses.

When a static route is suitable

This article covers unicast destination networks. If a sender must reach a multicast group through multiple interfaces, use the dedicated procedure to configure multicast with a static multicast route.

A static route is useful when a network is always reachable through the same next hop, for example:

  • a branch network behind an internal core router
  • a server network behind a Layer 3 switch
  • a network behind a RED tunnel
  • a remote network through the XFRM interface of a route-based IPsec tunnel

If the firewall must also decide by source, service or application, or switch paths based on latency, jitter and packet loss, an SD-WAN route is usually more suitable. In small or existing routing domains, RIPv2 can automatically exchange simple networks. In larger networks that change frequently, OSPF or BGP reduces the manual maintenance required.

Configure an IPv4 route

Before making the change, document the destination network, next hop, outbound interface, expected zone, return path and a reachable test host. Then:

  1. Open Routing > Static routes.
  2. Under IPv4 unicast route, click Add.
  3. Enter 10.20.0.0/24 under Destination IP / Netmask.
  4. Enter the next router 192.0.2.2 under Gateway IP.
  5. Select Port4 as the Interface.
  6. Set Administrative distance to 1.
  7. Enter 10 under Metric.
  8. Add a unique Description, such as Branch_10.20_via_Core.
  9. Click Save.

For this route, Sophos Firewall first considers the selected interface and then the gateway. If either field is incorrect, the intended next hop cannot be reached. In the IPv4 route list, you can filter by IP address, Gateway IP, Interface or Description, and edit, clone, delete, enable or disable routes. The IPv6 list supports filtering by IP address, Gateway IP or Interface, and adding, editing or deleting routes.

Administrative Distance and Metric

Administrative Distance evaluates competing routing sources. A lower value takes precedence: a route with 1 is preferred over a route with 5.

If several static routes to the same destination have the same Administrative Distance, Metric decides between them. The lower value is also preferred here.

The global Route Precedence between Static, SD-WAN and VPN is a different layer from Administrative Distance and Metric. Do not change it hastily for a single new route.

The example values 1 and 10 are simple starting values for a single route, not a general product recommendation. Before using them, compare existing routes to the same destination. For Primary/Backup or ECMP, choose Administrative Distance and Metric deliberately according to the required priority.

Two routes with different Administrative Distance values can describe a preferred path and a secondary path. Administrative Distance and Metric do not, however, monitor the next hop themselves. For an availability check, use a monitored gateway in an SD-WAN route. To select a path by latency, jitter or packet loss, the route also needs an SD-WAN Profile using Best quality or Custom SLA.

Make route-based IPsec resilient with two internet connections provides a complete example with two providers and two any-to-any XFRM tunnels. It validates gateways, mirrored routes, Route Precedence, failover, and failback together.

For IPv4 ECMP, create several routes to the same destination with the same Administrative Distance and Metric but different next hops. Connections can then be distributed across equal-cost next hops; this does not provide a quality-based Primary/Backup path.

Use Blackhole deliberately

With Blackhole, the firewall discards traffic to the specified destination without replying to the source. This can be useful for intentionally blocked or summarised networks, but it is not a substitute for a normal next hop.

If you redistribute static routes through RIP, OSPF or BGP, filter Blackhole routes deliberately. Otherwise, the firewall may also advertise this blocking route to other routers.

IPv6 and tunnel-specific cases

Under IPv6 unicast route, enter the destination address with prefix, Gateway IP, Interface and Metric. Sophos does not document an Administrative Distance, Blackhole option, description, Clone function or enable/disable function for the IPv6 form. Do not therefore apply IPv4 settings to IPv6 without checking them first.

For a route-based IPsec tunnel with Any-to-Any Subnets, the route can point directly to the XFRM interface without a separate gateway. If the tunnel uses specific Traffic Selectors, SFOS creates the route automatically; in that case, do not configure separate IP addresses or additional routes on the XFRM interface. An XFRM route is also different from the version-dependent ipsec_route CLI special case; Create an IPsec route on Sophos Firewall explains the distinction.

For a network behind the peer interface of a Site-to-Site RED tunnel between Sophos Firewalls, another exception applies: enter the IP address of the peer RED interface as the gateway, but do not select an interface. This allows the firewall to determine the reachable interface using ARP. Set up Site-to-Site RED between two Sophos Firewalls explains the complete server and client design.

Firewall rule, NAT and return path

Routing determines the path. The firewall rule decides whether the packet may pass, and NAT changes its addresses when required. Configure these three tasks separately.

For this example, you need a rule from client network 10.10.0.0/24 to destination network 10.20.0.0/24. The destination zone is the zone assigned to Port4. Restrict the rule to the services that are actually required and enable logging for the test.

SNAT is usually not desirable for a normally routed site network because the remote side should see the real client IP address. Router 192.0.2.2 then needs this return route:

Destination network: 10.10.0.0/24
Next Hop: 192.0.2.1

If you cannot configure a return route on the remote side, SNAT may provide a technical workaround. It hides the original client IP address, however, and should remain a deliberate design decision. Understanding NAT on Sophos Firewall explains how these elements interact.

Check the route

A saved route is only validated once a real client can reach the remote system and the return path works.

  1. Enter 10.20.0.10 under Diagnostics > Tools > Route lookup. The output must show Port4.

  2. In the Device Console, check the configured IPv4 or IPv6 routes and, where SD-WAN or VPN competes with the route, Route Precedence:

    show static-route
show static-route6
system route_precedence show

  3. Start a real connection from client 10.10.0.10 to 10.20.0.10, such as ping or TCP 443, matching the firewall rule.

  4. In the Log viewer, check the source, destination, service, Firewall Rule ID and any NAT Rule ID.

  5. Under Diagnostics > Packet capture, use host 10.20.0.10 to check whether requests leave through Port4 and replies return.

If Route Lookup shows the correct path but no traffic flows, the cause is usually the firewall rule, NAT, return route or destination system. The complete packet-flow test is covered in Test a Sophos Firewall rule with Log Viewer and Packet Capture.

For deeper routing problems, check the latest entries in the unicast and kernel logs from the Device Console:

show logs staticd.log lines 50
show logs zebra.log lines 50

staticd.log covers static unicast routes; zebra.log shows the installation of static IPv4 unicast routes in the kernel. Sophos Firewall service and log files maps further log files to their responsible services.

After an interface or tunnel restart, a gateway-only route may initially be missing from the routing table. It appears once matching traffic matches the destination and gateway and the firewall selects the interface. A missing entry immediately after the restart does not therefore prove a fault.

Troubleshoot and roll back

Route Lookup shows the wrong interface

  • Check the destination address and prefix; a typing error may match another network.
  • The gateway must be directly reachable through the selected interface.
  • Compare competing static routes as well as Administrative Distance and Metric.
  • For SD-WAN or VPN, check the current order with system route_precedence show. Change Route Precedence safely explains the global change.

Request leaves, but no reply returns

  • Check the return route on the next router and on the destination system.
  • Check the firewall rule for the initiating direction and any NAT rules. A rule in the opposite direction is required only if the remote side initiates new connections itself.
  • Use Packet Capture to determine whether the reply returns on Port4.
  • Check the local firewall and default gateway on the destination system.

Safe rollback

Disable a new IPv4 route first instead of deleting it. Then check Route Lookup, a new client connection and the previous path again. Only after confirming the original state should you remove the route and any rules or NAT objects created solely for this change.

Sophos does not document an enable/disable function for IPv6. Record the previous values in advance and edit or remove the new route during a rollback. In an HA cluster, repeat the end-to-end test on the new Primary after failover.