Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=firewall-SDWAN-group

SD-WAN Connection Groups

You can configure a VPN orchestrated SD-WAN network.

A VPN orchestrated SD-WAN network allows you to connect VPN tunnels between multiple Sophos Firewall devices. To do this, you create SD-WAN connection groups. Then add managed firewalls and the network resources you want users to access to the groups. Sophos Fusion automatically creates the firewall rules and VPN tunnels.

Warning

If you deregister a Sophos Firewall device from Sophos Fusion, the SD-WAN connection group associated with that firewall is deleted, along with all its VPN tunnels.

For details of how to create and manage your connection groups, see the following:

You can create SD-WAN profiles on the firewalls in your SD-WAN connection groups. See SD-WAN profiles.

You can see any changes you make to your connection groups and the firewalls in your groups in Tasks Queue. See Tasks Queue.

SD-WAN connection group size recommendations

For planning and deployment, the following limits are recommended:

  • New SD-WAN group: Add up to 30 firewalls at a time when creating a new group.
  • Existing SD-WAN group: Add up to 5 additional firewalls at a time to an existing group.
  • Maximum group size: A single SD-WAN group can contain a maximum of 150 firewalls.

Large-scale deployments: For deployments involving a large number of firewalls, particularly those approaching or exceeding the recommended batch sizes, contact your Sophos Sales Engineer (SE) and Sophos Support team before rollout. They can help with deployment planning and validation.

Initiator and responder scenarios

Sophos Fusion decides which firewalls in the SD-WAN groups are initiators and which are responders based on the network topology.

  • In a hub-and-spoke network, the firewall sharing the resource is the responder.
  • In a full mesh network, if the firewalls share resources, Sophos Fusion uses their hostnames. It checks their hostnames and allocates the responder role using alphabetical order. For example, if firewall one's hostname is AA_OFFICE and firewall two's hostname is BB_OFFICE, then firewall one is the responder.
  • In networks with multiple hubs, such as full mesh or multi-hub, if both firewalls share resources and have the same hostname, Sophos Fusion uses their firewall IDs. It checks their firewall IDs and allocates the responder role using alphabetical order. For example, if firewall one's ID is ffb8870c-d04e-4a9f-b3c2-b0d277ba7c26 and firewall two's ID is cca74541-ab8b-4e00-b009-17f7101d4861, then firewall two is the responder.
  • In a route-based VPN tunnel, if you've configured a wildcard (*) address in Public IP or FQDN for selected WAN link, the firewall using the wildcard address as the remote gateway address is the responder.