Choose the right Sophos RED operation mode

The operation mode of a Sophos SD-RED is not a minor detail. It determines who provides DHCP and the gateway at the remote site, which traffic uses the RED tunnel, whether internet access is inspected centrally, and what continues to work if the tunnel fails. A Site-to-Site RED tunnel between two Sophos Firewalls is a different design and does not use these four operation modes.

For new, centrally managed branches, Standard/Unified is usually the clearest starting point. Standard/Split saves tunnel bandwidth but removes local internet traffic from central control. Transparent/Split integrates the RED into an existing network. Manual/Split is a special cabling and routing design for local internet autonomy, not an ordinary quick mode.

Decide on the operation mode before configuring DHCP, VLANs, firewall rules, and the rollout. Changing it later alters the traffic path and requires a maintenance window with controlled functional tests.

The four RED operation modes at a glance

This summary helps with the initial choice, but it does not replace a review of failure behavior, VLANs, and security. In particular, Split does not automatically mean fail-open, and Transparent does not automatically mean that VLAN tags are passed through.

Standard/Unified: Everything through the central site

In Standard/Unified, Sophos Firewall provides DHCP and the default gateway through the RED interface. The SD-RED forwards all traffic through the encrypted tunnel, including the branch’s internet traffic.

This provides the highest level of central control. Firewall rules, web policies, IPS, Application Control, reporting, and central internet access can be implemented consistently at the head office. At the same time, the tunnel and the central WAN connection must handle more traffic because ordinary branch internet traffic also traverses the site path twice.

If the RED tunnel fails, clients lose more than access to internal networks. Because their gateway is located on Sophos Firewall across the tunnel, internet access normally fails as well. Standard/Unified is therefore suitable when central security is more important than local internet availability during a tunnel outage.

When Standard/Unified fits

• All site traffic must be inspected and logged centrally.
• DHCP, DNS forwarding, rules, and internet access should converge on Sophos Firewall.
• The central WAN capacity is sufficient for the branch’s additional internet traffic.
• A tunnel failure may deliberately take the site offline, or a tested second RED uplink exists.
• VLANs must be transported through an SD-RED 60.

Standard/Split: Central networks through the tunnel

With Standard/Split, Sophos Firewall remains the DHCP server and default gateway for the network provided by the RED. Only the destination networks entered under Split networks use the tunnel. Other destinations, typically the internet, leave the site through the RED’s local WAN connection.

This relieves the tunnel and the central internet connection. The trade-off is a clear security boundary: Sophos masks the local internet traffic at the RED, but the central firewall cannot inspect it with its firewall, web, or IPS rules. From the central firewall’s perspective, this traffic path is not ordinary forwarded internet traffic.

Split networks accepts IP networks. FQDN host objects are not supported here. VLAN-tagged frames are also not the correct traffic path in Standard/Split. Only the DHCP network provided directly by the RED receives local internet access through this mode.

Standard/Split is not a general fail-open design either. If the tunnel fails, Sophos documentation states that clients on the network provided by the firewall lose both central destinations and internet access. A design that requires local internet operation independently of the tunnel must be planned and tested differently.

When Standard/Split fits

• The branch needs only a few clearly defined networks at the central site.
• Local internet breakout is intentional and may remain outside central Sophos policies.
• Sophos Firewall can manage the remote network through DHCP.
• VLAN tagging through the RED tunnel is not required.
• The failure path has been tested and is not confused with Manual/Split.

Transparent/Split: RED in the existing network

Transparent/Split suits remote sites where the router, DHCP, DNS, and default gateway already exist and must remain in place. The RED operates transparently in the existing Layer 2 network. Only the configured split networks or split domains are routed through the tunnel to the central site.

This mode avoids changing the gateway for clients. Troubleshooting is more demanding, however: DHCP, DNS, and the normal internet path remain part of the local network, while selected destinations are redirected through the RED. Testing must therefore show separately which path stays local and which one actually enters the tunnel.

Transparent/Split does not transport VLAN-tagged frames. A 3G/4G failover uplink is also unavailable in this mode. For a wireless module, the remote DHCP server needs the Sophos-documented DHCP option 234 so that the RED address is passed to the access point.

When Transparent/Split fits

• The existing router must continue to provide DHCP, DNS, and the default gateway.
• Only selected central networks or domains should be reachable through the RED.
• The RED can be integrated cleanly inline in the existing network.
• The site does not need VLAN tags across this RED traffic path.
• Local and tunneled traffic can be tested separately with Packet Capture and real destination tests.

Manual/Split: Local gateway with static routes

For an SD-RED, Manual/Split primarily describes a deliberately manual network design. The WAN and LAN sides of the RED are integrated into the existing site infrastructure so that the existing router remains the default gateway. That router receives static routes to the RED for the central networks.

The benefit is local autonomy: normal internet access can continue even if the RED tunnel or the RED itself fails. The trade-off is additional planning. Return paths, static routes, ARP behavior, and physical cabling must be exact. An incorrect next hop can bypass the tunnel for central traffic or send it into a dead end during an outage.

Sophos describes a manual physical deployment for this purpose and a RED configuration based on the Standard/Unified scheme, while the existing gateway and static routes determine the split. The term should therefore not be treated as an independent, self-explanatory switch.

Manual/Split belongs only in a documented design with:

• an alternative local gateway
• static routes for every central destination network
• a verified return path from the central site
• independent management access
• tests with an active tunnel, a disconnected tunnel, and a powered-off RED

A second uplink and a second firewall are not operation modes

The RED configuration can additionally contain a second firewall endpoint and, depending on model and mode, a second uplink. These options complement the chosen traffic path; they do not replace it.

A second firewall endpoint can be used for failover or load balancing. A second uplink can protect tunnel establishment. When both uplinks use static addressing, Sophos recommends different DNS servers because the route to the first gateway can otherwise interfere with name resolution for the second uplink.

The tests must remain separate:

1. The selected RED mode must first work correctly through the primary uplink.
2. A controlled uplink failover is then tested.
3. RED status, DHCP, central destinations, and the internet path are checked again.
4. HA environments require a separate firewall failover test; the RED tunnel needs time to re-establish after the role change.

A green tunnel status alone proves neither the correct internet path nor functioning security policies.

VLANs and LAN port modes on SD-RED 60

The SD-RED 60 can transport VLANs through the tunnel, but only in Standard/Unified. Each LAN port additionally defines how the RED handles tagged and untagged frames.

• Tagged: Only the configured VLANs are forwarded with tags. Unconfigured VLANs and untagged frames are discarded. Up to 64 VLAN IDs can be entered per port.
• Untagged, drop tagged: Untagged frames are assigned to the configured VLAN; already tagged frames are discarded. This corresponds to a controlled access port.
• Disabled: The LAN port discards traffic.
• Untagged: This hybrid mode requires a real test with the deployed SFOS and RED firmware. The current Sophos help pages do not describe the treatment of already tagged frames consistently. It should therefore not be planned as a trunk replacement without Packet Capture.

Sophos Firewall needs a matching VLAN interface on the RED interface for every VLAN in use. VLAN ID, IP network, DHCP, RED port mode, and switch configuration must match exactly. The complete firewall workflow is described in Configure and test a VLAN on Sophos Firewall.

Plan wireless behavior separately

An optional wireless module for the SD-RED 20 or 60 can use three different traffic paths:

• Separate zone: Wireless traffic uses VXLAN to reach the firewall independently of the RED operation mode.
• Bridge to AP LAN: The wireless network is bridged to the access point’s local LAN.
• Bridge to VLAN: The wireless network is assigned to a VLAN; the exact behavior depends on the RED mode and VLAN configuration.

In Standard modes, DHCP must be configured appropriately on the RED interface. In Transparent/Split, DHCP comes from the remote network and option 234 must be correct. Wireless settings, LAN port mode, and RED operation mode should therefore be accepted as one design rather than three independent dropdowns.

Configure and safely test the operation mode

The RED is created or edited under Network > Interfaces > Add interface > Add RED. Before changing the mode, document the current configuration, DHCP ranges, static routes, split networks, firewall rules, and an independent management path.

The practical setup workflow, including provisioning, LEDs, rules, performance, and troubleshooting, is described in Set up and troubleshoot Sophos SD-RED. The operation mode additionally requires acceptance of the actual traffic path:

1. A client receives the expected IP address, DNS servers, and correct gateway.
2. A defined destination network at the central site is reachable.
3. Log Viewer or Packet Capture shows the expected Firewall Rule ID and RED path.
4. An internet test shows the expected public exit, central or local.
5. One allowed and one blocked application confirm where the security policy actually applies.
6. VLANs and wireless networks are tested individually rather than with only a general ping.
7. A planned tunnel or uplink failure confirms the documented failure behavior.

If the tunnel is green but the traffic path remains unclear, Use Packet Capture correctly on Sophos Firewall helps. On production sites, do not change the operation mode, DHCP, VLANs, and firewall rules simultaneously. Otherwise, a fault can hardly be assigned to one layer.

Common misconceptions

Split does not automatically mean internet during a tunnel outage

Standard/Split uses local internet breakout, but clients still depend on the RED network provided by the firewall. Sophos documents the loss of internet access there as well if the tunnel fails. Manual/Split is the separate design for an existing local gateway.

Transparent does not mean arbitrary Layer 2 passthrough

Transparent/Split integrates the RED into an existing network but does not transport VLAN-tagged frames through this path. DHCP, DNS, and wireless options must still be planned deliberately.

A green tunnel does not prove the correct operation mode

Tunnel status confirms the connection to the firewall. Only DHCP, routing, internet, rule, and failure tests show whether the selected operation mode matches the intended design.