Configure and test Sophos Firewall WAN failover

A second internet connection does not automatically become a backup link on Sophos Firewall. A newly created WAN gateway is Active by default and therefore participates in load balancing. For a conventional primary/backup design, change the second gateway to Backup in the WAN link manager.

The quick approach for one primary and one backup connection:

Fully configure both WAN interfaces under Network > Interfaces and test each one separately.
Under Network > WAN link manager, set the primary gateway to Active and the backup gateway to Backup.
For the backup gateway, select Activate this gateway: If active gateway fails: ANY.
Configure reliable Failover rules for both gateways.
Test failover and failback—the return to the primary connection—with real DNS, HTTPS and application traffic.

This simple default internet failover does not require a separate SD-WAN route. SD-WAN is required when specific traffic must use selected paths or when path selection must be based on latency, jitter and packet loss.

Understand Active, Backup and load balancing

The gateway type determines whether a connection normally carries internet traffic:

Active: When several active gateways are available, the firewall distributes new sessions according to the configured weights.
Backup: The gateway takes over only when its activation condition is met.

At least one WAN gateway must remain Active. If all gateways are marked only as backup, there is no normal default WAN path; traffic generated by the firewall in particular can then no longer be forwarded.

The Weight does not represent bandwidth. In weighted round-robin mode, a ratio of 2 to 1 means that the firewall assigns two new sessions to the first gateway and the next session to the second gateway. This does not split an individual download across both connections, and the volume of data transferred can differ considerably from this ratio.

Sophos Firewall uses Session Persistence by default. This keeps more than a single existing connection on the same WAN link: Depending on the persistence factor, for example, additional sessions from the same source IP can also be assigned to that link. After signing in, the current method can be viewed under Option 4: Device Console with this read-only command:

show routing wan-load-balancing

The command changes nothing. It shows whether Session Persistence or weighted round-robin is active and therefore helps explain unexpected path distribution. For a pure active/backup design, the method is usually of secondary importance because only one intended path is available in either the normal or failure state.

WAN failover is not the same as HA failover. The WAN link manager changes the internet path on the same firewall. A Sophos Firewall HA cluster, by contrast, takes over when an appliance or monitored port fails.

Prepare WAN failover

Both provider connections must work independently first. The fundamentals of the WAN zone, IP assignment and gateways are covered in Plan Sophos Firewall zones and interfaces.

A simple example looks like this:

WAN1 Fiber: primary connection, gateway gw-fiber, Type: Active, Weight: 1
WAN2 DSL: backup connection, gateway gw-dsl, Type: Backup
Backup activation: If active gateway fails: ANY
Action on activation: Inherit weight of the failed active gateway
Action on return: Serve new connections through restored gateway

The names can be chosen freely and should clearly identify the connection. The gateway type and actions, however, are functional settings. Before failover, the backup gateway should already have a green status and real client traffic should have been tested successfully over the connection.

A safe return path for administration is also required. If the firewall is being changed remotely, WebAdmin should not be reachable only through the connection that will be disconnected during the test. A current configuration backup, a maintenance window and either someone on site or an independent management path prevent a simple failover test from becoming a prolonged outage.

Beforehand, also record all services that are tied to a public IP address. These include DNAT publications, IPsec peers, Remote Access, provider allowlists, mail servers and external monitoring systems. Outbound internet access may already work while these services remain unreachable or unauthorised through the new public address.

Configure primary/backup

Check WAN interfaces and gateway status

Under Network > Interfaces, configure both WAN ports with the static, DHCP or PPPoE settings supplied by the provider. When the interface is saved, its physical WAN gateway is created automatically in the WAN link manager.

A new gateway is initially Active. After adding a pure backup connection, change its type immediately so that production traffic is not unintentionally distributed across both providers.

Custom gateways from Routing > Gateways, for example for XFRM, RED or MPLS, do not appear in the WAN link manager. They belong to a different routing design and are not treated as physical ISP gateways for this simple scenario.

Configure the backup gateway

Under Network > WAN link manager, edit the gateway for the backup connection and set the following values:

Type: Backup
Activate this gateway: If active gateway fails
With one primary connection: ANY
Action on activation: Inherit weight of the failed active gateway
Action on failback: Serve new connections through restored gateway
Save the settings and check the gateway status.

With exactly one active gateway, ANY and ALL have practically the same effect. The distinction becomes important with several active connections:

ANY: The backup is activated as soon as one of the active gateways fails. This is appropriate when lost capacity should be replaced immediately.
ALL: The backup is activated only after all active gateways have failed. This is more suitable for a slow or expensive emergency connection.

Action on activation determines the weight of the backup gateway when it becomes active alongside other available gateways. Inherit weight of the failed active gateway is intuitive for a straightforward replacement scenario. Use configured weight is useful when the backup has deliberately lower or higher capacity and operates alongside remaining active connections.

For failback, Serve new connections through restored gateway is the less disruptive operational choice. New sessions use the primary connection again, while existing sessions remain on the backup path until they time out or disconnect. Serve all connections through restored gateway re-establishes existing connections and can interrupt them. For SD-WAN routes, this action applies only when WAN link load balance is selected as the Primary Gateway. When an individual active WAN link is selected as the Primary Gateway, only new connections use the restored gateway.

Choose suitable failover rules

The Failover rules determine when a gateway is considered unreachable. The available settings are:

Testing method: Ping or TCP
IP address
for TCP, additionally Port
combine multiple failure conditions with AND or OR

A physical cable failure is already detected at the interface. The default ping check of the gateway IP additionally verifies whether the directly connected provider device or first provider hop is reachable. However, it can remain green even when internet access beyond the reachable provider router is no longer working. Sophos therefore recommends a known public IP target for WAN/ISP gateways, such as 8.8.8.8 or 8.8.4.4.

For IPv6, Sophos lists 2001:4860:4860::8888 as a public example. To check the upstream device, use the gateway’s IPv6 address rather than its link-local address.

A single target is not a complete health check either. For a more robust starting point, use two permanently reachable public IP addresses that are permitted by the organisation:

AND: Failover is triggered only when all linked checks fail. This reduces false failovers caused by a single unreachable target.
OR: A single failed check can trigger failover. This is more sensitive, but increases the risk of unnecessary switching.

8.8.8.8 and 8.8.4.4 are specific examples from Sophos, but they belong to the same operator and do not represent completely independent failure domains. In an important environment, two approved targets operated by different organisations are better. A ping target must answer ICMP reliably; for TCP, use a stable service whose port may be probed.

ANY/ALL on the backup gateway and AND/OR in the probe rules answer different questions. ANY/ALL determines how many active gateways must fail. AND/OR determines how several checks assess the failure of one gateway.

The global Gateway failover timeout value in the WAN link manager determines when the firewall treats an unresponsive link as failed. There is no universally correct value. A short timeout reacts faster, but packet loss or a brief issue with a probe target can cause unnecessary failover. Among other uses, the value also serves as the health-check interval for IPsec failover groups and should therefore not be changed in isolation for a single WAN link. Document the initial value, test it in a controlled manner and adjust it only afterwards based on the measured failover time.

Test failover and failback in a controlled manner

A cable test checks only for a local link failure. A provider outage behind a router that remains reachable becomes visible only when the configured public probe targets can no longer be reached. Ideally, test both cases separately.

Confirm the maintenance window, rollback plan and alternative administrator access.
Under Network > WAN link manager, document the status of the primary and backup gateways.
From a test client, check DNS, HTTPS and an important application. Also record the public outbound address currently in use.
For the link test, disconnect the primary WAN cable in a controlled manner. For the actual monitoring test, leave the firewall link up and interrupt the upstream connection beyond the provider device, where this can be done safely.
Wait longer than the configured Gateway failover timeout.
Check that the primary gateway is shown as failed and the backup gateway as active.
Start new DNS, HTTPS, VPN and application sessions. Check the firewall rule, NAT, destination reachability and new public outbound address.
Check gateway up/down events in Log viewer. For deeper analysis, dgd.log contains events related to WAN gateway management and link failover.
Restore the primary connection and test existing and new sessions separately. This shows whether the configured failback behaviour actually occurs.
Document the final status, applications and external reachability.

A successful ping proves only that the probe target responds. It confirms neither DNS nor NAT, VPN, published services or a business application. Packet Capture in Sophos Firewall WebAdmin helps verify the actual packet path; Sophos Firewall service logs explains dgd.log and other files.

Common errors and limitations

The backup connection already carries production traffic: The new gateway is still Active. For a pure backup, change it to Backup.
The backup does not become active when a connection fails: Check the gateway status, type, ANY/ALL, failover rules and Gateway failover timeout. With several active gateways, ALL can deliberately prevent activation while another active path remains available.
The gateway is green, but the internet does not work: The probe target is reachable while DNS, routing, the firewall rule, NAT or the application is failing. Check real traffic, Log Viewer and Packet Capture.
The firewall switches without a real provider outage: A single probe target is not responding, OR is too sensitive or the timeout is too short for the connection quality. Check the probe targets and measured packet loss.
Existing sessions break during the switch: The public source address or NAT state changes, so remote systems may reject the connection. WAN failover does not automatically provide zero downtime.
Outbound traffic works, but inbound services do not: The second provider requires suitable public reachability, DNS or Dynamic DNS, DNAT, firewall rules and, where applicable, certificates. DNAT for published servers and NAT fundamentals help isolate the issue.
VPN works only through the primary connection: The Remote Gateway, local listening address, FQDN, identities, tunnel configuration and return route must also match the backup path. Simple WAN failover does not create a second VPN connection.

If applications, user groups or destination networks should use different connections, or if latency, jitter and packet loss should govern path selection, put the decision in Sophos Firewall SD-WAN routes and profiles. A mobile backup also introduces considerations such as the SIM, APN, data volume, CGNAT and signal quality; these are covered in Cellular WAN and 4G/5G failover.

Operations

Send gateway status changes by email where required. First configure the mail server, sender and recipient under Administration > Notification settings. Then enable the global Email notifications switch under System services > Notification list and select the Gateway status event under System. Selecting an event row alone does not send an email.
Check the gateway status and dgd.log after unplanned failovers.
Test failover and failback at least quarterly and after provider, interface, NAT, routing or firmware changes.
Document public IP dependencies, VPN peers, allowlists and inbound services.
Assign responsibility for provider outages, escalation and the return to normal operation.
Review probe targets regularly; a permanently changed or unreachable target must not silently determine the failover logic.
With several active connections, assess weights and Session Persistence against actual usage, not only nominal bandwidth.