Skip to content
Avanet

Configure and test a static route on Sophos Firewall

Sophos Firewall

A static route tells Sophos Firewall which fixed next hop or tunnel interface to use to reach a specific destination. It is suitable when the path is fixed and no selection by source, service, application or link quality is required.

Short answer

Create an IPv4 route here:

Routing > Static routes > IPv4 unicast route > Add

For a destination network 10.20.0.0/24 that is reachable through router 192.0.2.2 on Port4, enter:

  • Destination IP / Netmask: 10.20.0.0/24
  • Gateway IP: 192.0.2.2
  • Interface: Port4
  • Administrative distance: 1
  • Metric: 10
  • Description: Branch_10.20_via_Core

Then check destination 10.20.0.10 under Diagnostics > Tools > Route lookup. The expected interface is Port4.

For the traffic to work, you also need a matching firewall rule and a return route on the remote router. A static route does not allow traffic or apply NAT automatically.

Understand the example

The example uses the following topology:

  • The client network behind Sophos Firewall is 10.10.0.0/24.
  • The test client in this network is 10.10.0.10.
  • Firewall interface Port4 has transit IP address 192.0.2.1/30.
  • The next router has IP address 192.0.2.2 on this network.
  • The destination network 10.20.0.0/24 is behind this router.
  • The test system is 10.20.0.10.

The Destination is always the remote destination, not the next router. Gateway IP is the directly reachable next hop that forwards the packet. Interface is the port or tunnel interface through which this next hop is reached.

Enter the address directly under Gateway IP; you do not need a gateway object under Routing > Gateways. For your own environment, replace the destination network, gateway and interface together. If you change only one example address, the route may be saved but point to the wrong network or an unreachable router. The gateway IP must belong to the network of the selected interface.

Configure Sophos Firewall zones and interfaces explains the fundamentals of ports, zones and interface IP addresses.

When a static route is suitable

A static route is useful when a network is always reachable through the same next hop, for example:

  • a branch network behind an internal core router
  • a server network behind a Layer 3 switch
  • a network behind a RED tunnel
  • a remote network through the XFRM interface of a route-based IPsec tunnel

If the firewall must also decide by source, service or application, or switch paths based on latency, jitter and packet loss, an SD-WAN route is usually more suitable. In larger networks that change frequently, OSPF or BGP reduces the manual maintenance required.

Configure an IPv4 route

Before making the change, document the destination network, next hop, outbound interface, expected zone, return path and a reachable test host. Then:

  1. Open Routing > Static routes.
  2. Under IPv4 unicast route, click Add.
  3. Enter 10.20.0.0/24 under Destination IP / Netmask.
  4. Enter the next router 192.0.2.2 under Gateway IP.
  5. Select Port4 as the Interface.
  6. Set Administrative distance to 1.
  7. Enter 10 under Metric.
  8. Add a unique Description, such as Branch_10.20_via_Core.
  9. Click Save.

For this route, Sophos Firewall first considers the selected interface and then the gateway. If either field is incorrect, the intended next hop cannot be reached.

Administrative Distance and Metric

Administrative Distance evaluates competing routing sources. A lower value takes precedence: a route with 1 is preferred over a route with 5.

If several static routes to the same destination have the same Administrative Distance, Metric decides between them. The lower value is also preferred here.

The global Route Precedence between Static, SD-WAN and VPN is a different layer from Administrative Distance and Metric. Do not change it hastily for a single new route.

The example values 1 and 10 are simple starting values for a single route, not a general product recommendation. Before using them, compare existing routes to the same destination. For Primary/Backup or ECMP, choose Administrative Distance and Metric deliberately according to the required priority.

Two routes with different Administrative Distance values can describe a preferred path and a secondary path. Administrative Distance and Metric do not, however, monitor the next hop themselves. For simple reachability failover, you can use monitored gateway objects with static routes and different Administrative Distance values. To select a path by latency, jitter or packet loss, use an SD-WAN Profile and an SD-WAN route.

For IPv4 ECMP, create several routes to the same destination with the same Administrative Distance and Metric but different next hops. This distributes traffic; it does not provide a quality-based Primary/Backup path.

Use Blackhole deliberately

With Blackhole, the firewall discards traffic to the specified destination without replying to the source. This can be useful for intentionally blocked or summarised networks, but it is not a substitute for a normal next hop.

If you redistribute static routes through RIP, OSPF or BGP, filter Blackhole routes deliberately. Otherwise, the firewall may also advertise this blocking route to other routers.

IPv6 and tunnel-specific cases

Under IPv6 unicast route, enter the destination address with prefix, Gateway IP, Interface and Metric. Sophos does not document an Administrative Distance, Blackhole option, description, Clone function or enable/disable function for the IPv6 form. Do not therefore apply IPv4 settings to IPv6 without checking them first.

For a route-based IPsec tunnel with Any-to-Any Subnets, the route can point directly to the XFRM interface without a separate gateway. If the tunnel uses specific Traffic Selectors, SFOS creates the route automatically; in that case, do not configure separate IP addresses or additional routes on the XFRM interface. An XFRM route is also different from the version-dependent ipsec_route CLI special case; Create an IPsec route on Sophos Firewall explains the distinction.

For a network behind the peer interface of a Site-to-Site RED tunnel between Sophos Firewalls, another exception applies: enter the IP address of the peer RED interface as the gateway, but do not select an interface. This allows the firewall to determine the reachable interface using ARP. This does not apply to the legacy RED server/client tunnels to Sophos UTM that were removed in SFOS 22.

Firewall rule, NAT and return path

Routing determines the path. The firewall rule decides whether the packet may pass, and NAT changes its addresses when required. Configure these three tasks separately.

For this example, you need a rule from client network 10.10.0.0/24 to destination network 10.20.0.0/24. The destination zone is the zone assigned to Port4. Restrict the rule to the services that are actually required and enable logging for the test.

SNAT is usually not desirable for a normally routed site network because the remote side should see the real client IP address. Router 192.0.2.2 then needs this return route:

Zielnetz: 10.10.0.0/24
Next Hop: 192.0.2.1

If you cannot configure a return route on the remote side, SNAT may provide a technical workaround. It hides the original client IP address, however, and should remain a deliberate design decision. Understanding NAT on Sophos Firewall explains how these elements interact.

Check the route

A saved route is only validated once a real client can reach the remote system and the return path works.

  1. Enter 10.20.0.10 under Diagnostics > Tools > Route lookup. The output must show Port4.

  2. In the Device Console, check the configured IPv4 or IPv6 routes and, where SD-WAN or VPN competes with the route, Route Precedence:

    show static-route
show static-route6
system route_precedence show

  3. Start a real connection from client 10.10.0.10 to 10.20.0.10, such as ping or TCP 443, matching the firewall rule.

  4. In the Log viewer, check the source, destination, service, Firewall Rule ID and any NAT Rule ID.

  5. Under Diagnostics > Packet capture, use host 10.20.0.10 to check whether requests leave through Port4 and replies return.

If Route Lookup shows the correct path but no traffic flows, the cause is usually the firewall rule, NAT, return route or destination system. The complete packet-flow test is covered in Test a Sophos Firewall rule with Log Viewer and Packet Capture.

For deeper routing problems, check the latest entries in the unicast and kernel logs from the Device Console:

show logs staticd.log lines 50
show logs zebra.log lines 50

staticd.log covers static unicast routes; zebra.log shows the installation of static IPv4 unicast routes in the kernel. Sophos Firewall service and log files maps further log files to their responsible services.

After an interface or tunnel restart, a gateway-only route may initially be missing from the routing table. It appears once matching traffic matches the destination and gateway and the firewall selects the interface. A missing entry immediately after the restart does not therefore prove a fault.

Troubleshoot and roll back

Route Lookup shows the wrong interface

  • Check the destination address and prefix; a typing error may match another network.
  • The gateway must be directly reachable through the selected interface.
  • Compare competing static routes as well as Administrative Distance and Metric.
  • For SD-WAN or VPN, check the current order with system route_precedence show. Change Route Precedence safely explains the global change.

Request leaves, but no reply returns

  • Check the return route on the next router and on the destination system.
  • Check the firewall rule for the initiating direction and any NAT rules. A rule in the opposite direction is required only if the remote side initiates new connections itself.
  • Use Packet Capture to determine whether the reply returns on Port4.
  • Check the local firewall and default gateway on the destination system.

Safe rollback

Disable a new IPv4 route first instead of deleting it. Then check Route Lookup, a new client connection and the previous path again. Only after confirming the original state should you remove the route and any rules or NAT objects created solely for this change.

Sophos does not document an enable/disable function for IPv6. Record the previous values in advance and edit or remove the new route during a rollback. In an HA cluster, repeat the test on the new Primary after failover; logs are not synchronised between the appliances.

Frequently asked questions

Must I always specify the gateway and interface together?

For a normal Ethernet route, generally yes. Route-based IPsec can use only the XFRM interface; in the RED special case described above, enter only the peer RED IP address as the gateway.

Why does the connection fail despite correct Route Lookup output?

Route Lookup confirms only the selected path. Common causes are a missing firewall rule, return path, suitable NAT decision or access on the destination system.

Does a static route monitor the gateway automatically?

Administrative Distance and Metric do not monitor the gateway. Simple reachability failover is possible with monitored gateway objects and prioritised static routes; for quality criteria such as latency, jitter or packet loss, use SD-WAN.