Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/23.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=routing-SD-WAN-routes-failover-failback

SD-WAN routing failover and failback

To specify how Sophos Firewall selects gateways in an SD-WAN route, you can select Primary and backup gateways or Select SD-WAN profile. Learn how failover and failback work in different failure scenarios when you use Primary and backup gateways.

If you use Select SD-WAN profile, see SD-WAN profiles.

How Sophos Firewall detects when a gateway is unavailable

Sophos Firewall continuously monitors gateway availability using the health-check mechanism configured in Network > WAN link manager. If the primary gateway doesn't respond within the configured Gateway failover timeout, the firewall considers it unavailable and fails over all SD-WAN routes that use it as their primary gateway to their configured backup gateways.

Service-level Agreement (SLA) monitoring doesn't apply if you use Primary and backup gateways. Failover is based only on gateway availability, not SLA metrics such as latency, jitter, or packet loss. For SLA-based failover, use an SD-WAN profile.

Tip

To control how long the firewall waits before failing over to the backup gateway, set the Gateway failover timeout in Network > WAN link manager.

Failover behavior

When the primary gateway becomes unreachable, the firewall fails over as follows:

  • New connections matching the SD-WAN route are routed through the backup gateway.

  • Existing connections that were already flowing through the primary gateway are handled depending on whether the connections use source NAT (SNAT).

    Connection type Behavior
    No SNAT The firewall reroutes existing connections through the backup gateway without interruption.
    SNAT The firewall drops active connections. Clients immediately reconnect through the backup gateway.

You can turn on rerouting for SNAT connections using the CLI. See Reroute SNAT connections. However, rerouting SNAT connections only works if the gateways or links used for rerouting use the same source IP address. This is rarely the case because each WAN link or gateway typically has its own IP address. The option is turned off by default and doesn't apply to most deployments.

Failback behavior

When the primary gateway starts responding again, the firewall marks it as alive and resumes using it as follows:

  • New connections are routed through the restored primary gateway.
  • Existing connections already established on the backup gateway continue using the backup. They are not moved or interrupted.

Connection rerouting doesn't apply during failback. The firewall doesn't use rerouting to move existing backup sessions back to the primary. Those connections run to completion on the backup. This is intentional and ensures active connections are never interrupted during recovery.

Note

For SD-WAN routes that use Primary and backup gateways as the link selection setting, failback only applies to new connections. The Action on failback setting in the WAN link manager, which offers Serve new connections through restored gateway or Serve all connections through restored gateway, applies only to the default WAN gateway. It doesn't affect SD-WAN route failback behavior.

When both gateways are unavailable

The behavior depends on whether you've selected Route traffic only through the specified gateways in the SD-WAN route:

Route traffic only through the specified gateways Behavior
Turned on Traffic matching the SD-WAN route is dropped. No alternative path is used.
Turned off Sophos Firewall evaluates the remaining SD-WAN routes in order. If no other SD-WAN route matches, traffic falls back to the default route as configured in Network > WAN link manager.

When both gateways are unavailable, connection rerouting has no effect regardless of how it's configured. There is no available path to reroute traffic to, so all active connections are dropped.