Podcast
Questions and Answers
What is a consequence of a packet being marked for RTG?
What is a consequence of a packet being marked for RTG?
Which routing table is given the highest precedence when marking with fwmark?
Which routing table is given the highest precedence when marking with fwmark?
How are routing policies defined in the routing table based on fwmark?
How are routing policies defined in the routing table based on fwmark?
What command would you use to view the routing table associated with a specific gateway?
What command would you use to view the routing table associated with a specific gateway?
Signup and view all the answers
What metric is associated with the prohibit default route in the routing table?
What metric is associated with the prohibit default route in the routing table?
Signup and view all the answers
What does a jitter measurement of five milliseconds indicate in terms of network latency?
What does a jitter measurement of five milliseconds indicate in terms of network latency?
Signup and view all the answers
Which of the following is NOT a criterion that can be included in a custom SLA configuration?
Which of the following is NOT a criterion that can be included in a custom SLA configuration?
Signup and view all the answers
What must be entered when configuring TCP as a probe target in health checks?
What must be entered when configuring TCP as a probe target in health checks?
Signup and view all the answers
How can you define the recommended SLA values for different traffic types?
How can you define the recommended SLA values for different traffic types?
Signup and view all the answers
What determines the first SLA verdict in SD-WAN monitoring?
What determines the first SLA verdict in SD-WAN monitoring?
Signup and view all the answers
What happens when an SLA is enabled for an SD-WAN profile?
What happens when an SLA is enabled for an SD-WAN profile?
Signup and view all the answers
What is the default SLA sample size for determining link performance in SD-WAN?
What is the default SLA sample size for determining link performance in SD-WAN?
Signup and view all the answers
How many consecutive responses are required for the firewall to determine that a link is up again?
How many consecutive responses are required for the firewall to determine that a link is up again?
Signup and view all the answers
Which of the following metrics is NOT monitored by the SD-WAN performance graphs?
Which of the following metrics is NOT monitored by the SD-WAN performance graphs?
Signup and view all the answers
What does the SD-WAN log viewer include for each log entry?
What does the SD-WAN log viewer include for each log entry?
Signup and view all the answers
What occurs after a packet arrives at the Sophos Firewall if it matches an SD-WAN route?
What occurs after a packet arrives at the Sophos Firewall if it matches an SD-WAN route?
Signup and view all the answers
In which scenario does the Sophos Firewall mark a packet for Multi Link Management (MLM)?
In which scenario does the Sophos Firewall mark a packet for Multi Link Management (MLM)?
Signup and view all the answers
What is the role of NAT lookup in the packet processing flow within the Sophos Firewall?
What is the role of NAT lookup in the packet processing flow within the Sophos Firewall?
Signup and view all the answers
Which of the following is NOT indicated as a method for matching a route through a gateway in the Sophos Firewall?
Which of the following is NOT indicated as a method for matching a route through a gateway in the Sophos Firewall?
Signup and view all the answers
What determines the order in which a packet is processed in the routing precedence of the Sophos Firewall?
What determines the order in which a packet is processed in the routing precedence of the Sophos Firewall?
Signup and view all the answers
Study Notes
Sophos Firewall Version 19.0v1
- Sophos Firewall version 19.0v1 is a product.
- This version includes April 2022 updates.
Copyright and Use Restrictions
- Copyright 2022 Sophos Limited. All rights reserved.
- No parts of this document can be used without Sophos's prior consent.
- Sophos and the Sophos logo are registered trademarks of Sophos Limited.
- Other mentioned trademarks and logos may belong to other Sophos entities or their respective owners.
Document Disclaimer
- Sophos has taken reasonable care in preparing this document.
- Sophos makes no explicit or implicit warranties, or representations about content completeness or accuracy.
- Changes to the document are possible at any time.
- Sophos Limited is registered in England with number 2096520.
- The registered office is at The Pentagon, Abingdon Science Park, Abingdon, Oxfordshire, OX14 3YP.
Advanced Routing Configuration
- Sophos Firewall routes traffic, manages gateways, and configures SD-WAN profiles and routes.
Recommended Knowledge and Experience
- Configuring static routes
- Creating gateways and SD-WAN routes
Duration
- 27 minutes
Routing
- Sophos Firewall supports multiple methods for controlling routing:
- Static routes
- SD-WAN routes
- VPN routes
- Health check routes
- Default route
Packet Routing
- Packet routing procedure on Sophos Firewall.
- Steps include checks for SD-WAN routes, applying full routing precedence, NAT lookup, and destination zone update
Packet Routing (continued)
- Firewall rule matching is done on the post-NAT zone and pre-NAT IP.
- SD-WAN routes created from gateways in firewall rules (v17.5 onward) will be migrated.
Packet Routing (continued 2)
- If WAN traffic does not match PBR or RTG, it is marked for MLM (multi-link management).
- MLM is based on load balancing across active gateways.
- Packets then traverse full routing based on precedence.
- Finally, a NAT lookup occurs.
Routing Table Example
- Routing table example on Sophos Firewall, showcasing source and fwmark used to lookup gateways.
Routing Policies
- Using
ip rule listandip route list tablecommands for navigating routing table tree to identify traffic routes.
Setting Routing Precedence
- By default, static routing has highest priority within the system.
- System route_precedence command can modify priority if necessary.
Gateway Management
- Two tools for gateway management: WAN Link Manager and Gateway Manager.
- WAN Link Manager: Configures pre-existing WAN gateways. It does not allow the creation of new WAN links.
- Gateway Manager: Creates gateways to forward traffic to other networks. WAN gateways usually automatically create upon WAN link interface creation.
WAN Link Manager
- Minimizes the chance of service disruptions ensures connectivity to the Internet using active-backup configuration.
- Identifies the health of dead links and reroutes traffic once restored.
- Optimizes connectivity using load balancing by distributing traffic among various links.
- Active-active configuration is possible for load balancing.
Backup Gateway
- Backup gateways can be activated manually or automatically if the primary gateway fails.
- The backup gateway can inherit the active gateway weight, or use a configured weight.
- It is possible to specify whether new connections use the restored gateway or force all connections, including prior ones, through the restored gateway.
WAN Link Manager Failover Rules
- Configure failover rules to test gateway availability (PING or TCP connections).
- Multiple rules can be used for failover tests.
SD-WAN Profiles
- SD-WAN Profiles are configured to use in various circumstances to route, such as for best quality routing.
- They ensure optimized network performance.
SD-WAN Profile Settings
- Define performance criteria for SD-WAN (latency, jitter, packet loss).
- Allow for customizing the SLA (Service Level Agreement).
SD-WAN Profiles and Diagnostics
- Monitor SD-WAN performance using monitored graphs of latency, jitter, and packet loss for gateways.
- Graph views can be configured to show data over time intervals
SD-WAN Logging
- Sophos Firewall logs provide SD-WAN specific details, including the rule ID and name, for both the route request and reply. .
SD-WAN Routes
- Support for various routing scenarios.
- Use next-hop and interface-based gateways.
- Configure using gateway hosts and routes rules.
- Apply criteria such as user, group, application for traffic selection.
- SD-WAN profiles to select the gateway based on link quality.
SD-WAN Route Configuration
- Defining source, destination, and services for SD-WAN to be routed consistently.
Matching Reply Packets
- SD-WAN route behaviour can differ in new and upgraded Sophos Firewall installations.
Zones for Custom Gateways
- Creation of virtual WAN zones on custom gateways is useful (e.g. for AWS or Azure environments).
- They can accommodate multiple custom gateways.
- Specific security rules can be applied to traffic accordingly.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Description
This quiz covers the features and updates of Sophos Firewall version 19.0v1, including information on copyright, use restrictions, and advanced routing configuration. It provides insights into the product's legal disclaimers and operational specifics. Perfect for IT professionals looking to understand this firewall version better.
