Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/21.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=CLI-system-routing

routing

You can configure routing parameters for multicast group limits, policy-based IPsec VPN, source base route for aliases, and WAN load balancing.

Command

set routing

Syntax

set routing
multicast-group-limit <number>`
policy-based-ipsec-vpn system-generate-traffic [enable | disable]`
multicast-decrement-ttl [enable | disable]
sd-wan-policy-route [system-generate-traffic] [reply-packet] [enable | disable]
source-base-route-for-alias [enable | disable]
wan-load-balancing [session-persistence | weighted-round-robin] [connection-based | destination-only | source-and-destination | source-only] [ip-family] [all | ipv4 | ipv6]

Options

multicast-group-limit <number>

Applies the multicast group limit. Range: 20 to 4096. Default: 250.

policy-based-ipsec-vpn system-generate-traffic [enable | disable]

Turn on or off policy-based IPsec VPN routes for system-generated traffic. Default: enable.

Warning

This will restart all IPsec tunnels. Plan your downtime accordingly.

multicast-decrement-ttl [enable | disable]

Turn on or turn off TTL decrementing for multicast traffic.

sd-wan-policy-route [system-generate-traffic] [reply-packet] [enable | disable]

Turn policy routes on or off for system-generated traffic and reply packets. Make sure you turn routing on for each of them independently. Policies are configured in the web admin console.

source-base-route-for-alias [enable | disable]

Applies or removes source-based routes for alias addresses. You must turn this option on when you have multiple WAN interfaces and want to use alias addresses for IPSec connections.

wan-load-balancing [session-persistence | weighted-round-robin] [connection-based | destination-only | source-and-destination | source-only] [ip-family] [all | ipv4 | ipv6]

Configures WAN load balancing to balance traffic between multiple WAN interfaces.

Session persistence sends traffic for the same session over a specific interface. Weighted round robin passes traffic over different interfaces depending on the load that each interface experiences.

When you're using session persistence, you can define balance traffic in the following ways:

  • Connection-based: Sends all traffic related to the same connection over the same interface.
  • Destination-only: Sends all traffic to a specific source over the same interface.
  • Source-and-destination: Sends all traffic between the same source and destination over the same interface.
  • Source-only: Sends all traffic from a specific source over the same interface.

Furthermore, you can choose to balance just IPv4, IPv6, or all traffic.