{"id":161460,"date":"2024-09-03T10:02:45","date_gmt":"2024-09-03T09:02:45","guid":{"rendered":"https:\/\/www.avanet.com\/kb\/sophos-firewall-sd-wan-routing-reply-packet-system-traffic\/"},"modified":"2024-09-03T10:07:59","modified_gmt":"2024-09-03T09:07:59","slug":"sophos-firewall-sd-wan-routing-reply-packet-system-traffic","status":"publish","type":"kb","link":"https:\/\/www.avanet.com\/en\/kb\/sophos-firewall-sd-wan-routing-reply-packet-system-traffic\/","title":{"rendered":"Sophos Firewall &#8211; SD-WAN Routing Reply-Packet &amp; System Traffic"},"content":{"rendered":"\n<p><br\/>There are various options for managing Sophos Firewalls in order to efficiently control and route data traffic.\nAn important component here is the Software-Defined WAN (SD-WAN).\nSD-WAN makes it possible to make network infrastructures more intelligent through an additional software layer, especially when controlling traffic between different networks and across different WAN connections.  <\/p>\n\n<p>For optimal functionality, it may be necessary to manually enable SD-WAN settings via the command line (CLI), as some of these settings may be disabled.\nThis post provides an overview of two specific SD-WAN settings that can be customized via SSH: <strong>reply-packet<\/strong> and <strong>system-generate-traffic<\/strong>.\nThese settings are particularly relevant if you notice that certain traffic routings are not working as expected.  <\/p>\n\n<h2 class=\"wp-block-heading\">Activate Reply-Packet<\/h2>\n\n<p><br\/><strong>Reply packets<\/strong> refer to the reply packets that belong to an outgoing data traffic.\nBy default, Sophos Firewall enforces symmetric routing for reply packets over WAN interfaces.\nHowever, there may be situations where asymmetric routing is required, e.g. for traffic between LAN and DMZ.  <\/p>\n\n<p><br\/><strong>How to check the current setting<\/strong><\/p>\n\n<pre class=\"wp-block-code\"><code>show routing sd-wan-policy-route reply-packet<\/code><\/pre>\n\n<p><br\/><strong>To activate the reply packet option<\/strong><\/p>\n\n<pre class=\"wp-block-code\"><code>set routing sd-wan-policy-route reply-packet enable<\/code><\/pre>\n\n<p><br\/>If this option is activated, response packets can be sent via a different interface than the one originally used, which can be helpful in certain network scenarios.<\/p>\n\n<h2 class=\"wp-block-heading\">Activate system-generated traffic<\/h2>\n\n<p><br\/><strong>System-generated traffic<\/strong> refers to traffic that is generated by the Sophos Firewall itself, for example for management services or monitoring protocols.\nIn certain scenarios, it may be necessary to route this traffic via a specific route instead of using the default route. <\/p>\n\n<p><br\/><strong>How to check the current setting<\/strong><\/p>\n\n<pre class=\"wp-block-code\"><code>show routing sd-wan-policy-route system-generate-traffic&nbsp;<\/code><\/pre>\n\n<p><br\/><strong>To activate the System Generate Traffic option<\/strong><\/p>\n\n<pre class=\"wp-block-code\"><code>set routing sd-wan-policy-route system-generate-traffic enable<\/code><\/pre>\n\n<p><br\/>Activating this option ensures that the system-generated traffic is routed correctly via the SD-WAN policies, which is particularly advantageous for complex network infrastructures.<\/p>\n\n<h2 class=\"wp-block-heading\">When are these adjustments necessary?<\/h2>\n\n<p>It may happen that certain network requirements are no longer met if the default route settings of the firewall are not sufficient.\nThis can occur, for example, if: <\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>response packets<\/strong> are incorrectly routed via the wrong interface.<\/li>\n\n\n\n<li><strong>System-generated traffic<\/strong> is not routed through the network as expected.<\/li>\n<\/ul>\n\n<p>In such cases, it makes sense to check the settings described above via the CLI and activate them if necessary.\nThis ensures precise control and adjustment of the network routes and helps to avoid potential network problems. <\/p>\n\n<p>By activating these functions manually, you can ensure that your network runs more efficiently and stably, especially in more complex environments where specific routes are required.<\/p>\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n<p>Customizing the SD-WAN settings via the CLI is a valuable tool for optimally controlling network traffic within the Sophos Firewall.\nBy enabling the <strong>reply-packet<\/strong> and <strong>system-generate-traffic<\/strong> options, you can ensure that specific network requirements are met and that routing works efficiently and reliably. <\/p>\n\n<p><strong>Note:<\/strong> These changes should only be made by experienced administrators who understand the impact on the entire network.<\/p>\n\n<h3 class=\"wp-block-heading\">Further information<\/h3>\n\n<p>For detailed information and further configuration options for SD-WAN Policy Routing on Sophos Firewall, see the following documentation:<\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>SD-WAN Policy Routing Behavior:<\/strong> Comprehensive overview of SD-WAN route behavior, including specific details on system-generated traffic and response packets, can be found here. <a href=\"https:\/\/docs.sophos.com\/nsg\/sophos-firewall\/18.5\/Help\/en-us\/webhelp\/onlinehelp\/AdministratorHelp\/Routing\/SDWANPolicyRouting\/RoutingSDWANPolicyBehavior\/index.html\" target=\"_blank\" rel=\"noopener\">Sophos Knowledge Base on SD-WAN Policy Routing Behavior<\/a>.<\/li>\n<\/ul>\n\n<ul class=\"wp-block-list\">\n<li><strong>SD-WAN Policy Routing:<\/strong> This article describes the basic configuration and management of SD-WAN routes.\nIdeal for a deeper understanding of the functionality and configuration options. <a href=\"https:\/\/docs.sophos.com\/nsg\/sophos-firewall\/18.5\/Help\/en-us\/webhelp\/onlinehelp\/AdministratorHelp\/Routing\/SDWANPolicyRouting\/index.html#actions\" target=\"_blank\" rel=\"noopener\">Sophos Knowledge Base on SD-WAN Policy Routing<\/a>. <\/li>\n<\/ul>\n","protected":false},"author":1,"featured_media":0,"parent":0,"template":"","format":"standard","kb_kategorie":[382],"class_list":["post-161460","kb","type-kb","status-publish","format-standard","hentry","kb_kategorie-sophos-firewall"],"blocksy_meta":[],"acf":[],"_links":{"self":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/kb\/161460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/kb"}],"about":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/types\/kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/users\/1"}],"wp:attachment":[{"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/media?parent=161460"}],"wp:term":[{"taxonomy":"kb_kategorie","embeddable":true,"href":"https:\/\/www.avanet.com\/en\/wp-json\/wp\/v2\/kb_kategorie?post=161460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}