A route provides the device with the information it needs to forward a packet to a particular destination. A static route causes packets to be forwarded to a destination other than the configured default gateway.

By specifying through which interface the packet will leave and to which device the packet should be routed, static routes control the traffic exiting the device.

Sophos XG Firewall | Configure | 259

IP Multicast

Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes. IP multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers.

Applications like videoconferencing, corporate communications, distance learning, and distribution of software, stock quotes, and news use IP multicasting.

If IP multicast is not used, the source is required to send more than one copy of a packet or individual copy to each receiver. In such case, high-bandwidth applications like video or stock where data is to be send more frequently and simultaneously, uses large portion of the available bandwidth. In these applications, the only efficient way of sending information to more than one receiver simultaneously is by using IP multicast.

Multicast Group

Multicast is based on the concept of a group. An arbitrary group of receivers expresses an interest in receiving a particular data stream. This group does not have any physical or geographical boundaries - the hosts can be located anywhere on the Internet. Hosts that are interested in receiving data flowing to a particular group must join the group.

Hosts must be a member of the group to receive the data stream.

IP Multicast Addresses

Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group.

IP Class D Addresses

The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses. Multicast addresses fall in class D address space ranging from 224.0.0.0 to 239.255.255.255.

This address range is only for the group address or destination address of IP multicast traffic. The source address for multicast datagram is always the unicast source address.

Multicast forwarding

With multicast forwarding, a router forwards multicast traffic to networks where other multicast devices are listening.

Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening.

For multicast forwarding to work across inter-networks, nodes and routers must be multicast-capable.

A multicast-capable node must be able to:

Sophos XG Firewall | Configure | 260

• Send and receive multicast packets.

• Register the multicast addresses being listened to by the node with local routers, so that multicast packets can be forwarded to the network of the node.

IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address. IP multicasting applications that receive multicast traffic must inform the TCP/

IP protocol that they are listening for all traffic to a specified IP multicast address.

Manage Static Routes

Static Routing menu allows configuring a unicast route and a multicast route. This page describes the available elements.

IPv4 Unicast Route

The IPv4 Unicast Route section displays a list of all the configured IPv4 unicast routes. You can filter the list based on

IP address, gateway, or interface. The page also provides the option to Add a route, update the route configuration and

Delete the route.

IPv6 Unicast Route

The IPv6 Unicast Route section displays a list of all the configured IPv6 unicast routes. You can filter the list based on

IP address, gateway, or interface. The page also provides the option to Add a route, update the route configuration and

Delete the route.

Multicast Forwarding Setting

Enable Multicast Forwarding

Enable/disable multicast forwarding. Enable and click Apply to allow the router to forward packets to other networks where other multicast devices are active and listening.

Manage Multicast Route

The Manage Multicast Route section displays a list of all the configured multicast routes. You can filter the list based on source IP, multicast IP, source interface and destination interface. The page also provides the option to Add a route, update the route configuration and Delete the route.

Add Unicast Route

1. For an IPv4 unicast route, go to Configure > Routing > Static Routing and click Add under IPv4 Unicast

Route. For an IPv6 unicast route, click Add under IPv6 Unicast Route.

2. Enter unicast route details.

Destination IP/Prefix

Specify the destination IPv4 or IPv6 address and select the prefix of subnet mask from the dropdown list.

Gateway

Specify the gateway IPv4 or IPv6 address. The gateway address specifies the next-hop router to which traffic will be routed.

Interface

Select an interface from the drop-down list.

Distance

Specify the distance for routing.

For IPv4

For IPv6

Default: 0

Acceptable Range: 0 to 255

Default: 1

Acceptable Range: 1 to 255

Sophos XG Firewall | Configure | 261

Figure 215: IPv4 Unicast Route

Figure 216: IPv6 Unicast Route

3. Click Save.

The unicast route has been created and appears on the Static Routing page.

Add Multicast Route

1. Go to Configure > Routing > Static Routing and click Add under Manage Multicast Route.

2. Enter multicast route details.

Source IPv4 Address

Specify the source IPv4 address.

Source Interface

Select the source interface from the drop-down list.

Multicast IPv4 Address

Specify the multicast IPv4 address. For example, (224.0.2.0 - 239.255.255.255)

Destination Interface

Select destination interface(s) from the available options. You can select more than one destination interface.

Figure 217: Add Multicast Route

3. Click Save.

Sophos XG Firewall | Configure | 262

Policy Routing

Routers generally forward packets to the destination addresses based on the information available in their routing tables. With Policy Routing, you can make routing decisions based on the policies configured by the administrator.

You can selectively forward the packets based on different criteria such as source network, destination network, services and so on. If the packet matches the criteria defined in the policy routing then the packet will be forwarded to the gateway configured in the policy.

Firewall Rule can still override policy route decision, if primary and/or backup gateway is configured.

Benefits of Policy Routing include:

• Packets originating from different source networks and having same destination can be routed to different networks.

• You can distribute traffic requiring high bandwidth to use different Internet connection.

• You can implement policies to achieve failover/failback. For example: If you have two links MPLS and VPN link and if MPLS link fails then you can route your traffic that matches the policy to VPN link. When the MPLS link comes up, then traffic can be failed back to MPLS link.

Note: When device firmware is upgraded to SF-OS v16, source routes will be migrated as policy routes.

Manage Policy Route

This page displays a list of all the configured IPv4 and IPv6 policy routes.

You can also reorder the policy routes. To change the processing order, you can reorder policy routes by drag and drop action. Policy routes are evaluated top down in the order they appear on the Manage page until first match is made, after which subsequent policy routes are not evaluated.

The page also displays the status Up or Down for the gateways configured in the policy route.

Add Policy Route

1. Go to Configure > Routing > Policy Routing and click Add under IPv4/IPv6 Policy Route section.

2. Specify the Policy Route details.

Name

Specify a name for policy route.

Description

Specify a description for policy route.

Figure 218: About this Policy Route

3. Specify the Traffic Selector details.

Incoming Interface

Select the incoming interface receiving the packet.

Note: Deleting the incoming interface will also delete the policy route defined for the interface.

Source Networks

Sophos XG Firewall | Configure | 263

Destination Networks

Select the destination network(s) of the packet to be routed. A new network host can be created directly from this page itself or from System > Hosts and Services.

Services

Select the source network(s) of the packet to be routed. A new network host can be created directly from this page itself or from System > Hosts and Services.

Select the services(s) of the packet to be routed. These services allow you to specify precisely which kind of traffic should be processed. A new service/service group can be created directly from this page itself or from System > Hosts and Services.

DSCP Marking

Select the type of DSCP Marking to match the packets marked with the given DSCP value.

For available options, refer to

DSCP Values

Figure 219: Traffic Selector

4. Specify the Routing details.

Gateway

Select the gateway to which you want to forward the packet if the packet meets the configured matching criteria.

Note:

• Deleting the gateway will also delete the policy route defined for the gateway.

• Policy route is not applied when gateway goes down. As soon as the gateway comes up again, traffic is routed through the gateway automatically.

Sophos XG Firewall | Configure | 264

Figure 220: Routing

5. Click Save.

Gateways

The Gateway page displays a list of configured IPv4 and IPv6 gateways. The page also displays the status Up or Down for each gateway. You can add/delete/clone gateway, change the gateway parameters/status and enable health check for the gateway.

Add a Gateway

1. Go to Configure > Routing > Gateways and click Add.

2. Enter Gateway details.

Name

Enter the name of the gateway.

Gateway IP

Enter the IP address of the gateway.

Interface

Select the Out interface for the gateway.

Default NAT Policy

Select the default NAT policy to be used for the gateway.

Select None, if NAT policy should not be applied on the gateway.

Figure 221: Gateway Host

3. Enter Health Check details

Health Check

Click to enable health check for monitoring the gateway and specify the parameters based on the description shown below.

Interval (in seconds)

Specify the time interval in seconds after which the health should be monitored.

Acceptable Range: 5 to 65535 seconds

Default: 60 seconds

Sophos XG Firewall | Configure | 265

Timeout (in seconds)

Specify the time interval in seconds within which the gateway must respond.

Acceptable Range: 1 to 10 seconds

Default: 2 seconds

Retries

Specify the number of tries to probe the health of the gateway, after which the gateway will be declared unreachable.

Acceptable Range: 1 to 10

Default: 3

Mail Notification

Enable to receive an Email notification if there is a change in gateway status.

Note: You need to configure

Mail Server

for the device to send and receive alert

Emails.

Monitoring Condition

Protocol:From the drop-down list, select the communication protocol, such as TCP or PING

(ICMP). Select the protocol depending on the service to be tested for the gateway's health.

Port: For TCP communication, specify the port number for communication.

IP Address: Specify the IP address of the computer or the network device which is permanently running or most reliable.

Operator:

• AND - All the conditions must be satisfied for the gateway to be considered alive.

• OR - At least one condition must be satisfied for the gateway to be considered alive.

A protocol request is sent to the given IP address. If the IP address does not respond to the request within the timeout interval then given number of retries are attempted. If it still does not respond then the device considers the IP address as unreachable.

Figure 222: Health Check

BGP

This page allows you to manage BGP routes.

Sophos XG Firewall | Configure | 266

Border Gateway Protocol (BGP) is a path vector protocol that contains path information, enabling the routers to share routing information between autonomous systems (AS) so that loop-free routes can be created. This protocol is generally used by ISPs.

An AS is a connected group of networks or routers under the control of single administrative entity and share common routing policies. A unique AS number is assigned to each AS to uniquely identify them. AS number enables information exchange between neighboring autonomous systems. You should use private AS numbers if you don't require a unique AS number. BGP private AS-numbers range from 64512 to 65535.

BGP selects a single path from the multiple advertisements received from multiple sources for the same route. When the path is selected, BGP puts it in the IP routing table and passes the path to its neighbor.

Global Configuration

Router ID

Specify router ID for BGP.

Example: 12.34.5.66.

Local AS

Specify Local Autonomous System (AS) number.

Acceptable Range: 1 to 4294967295

Figure 223: Global Configuration

Neighbors

Neighbors are the routers between which a TCP connection is established. In this section, you can

add

, update, or delete neighbors.

Networks

This section list all available BGP networks togegher with their corresponding netmasks. You can

add

, update, or

delete networks.

Add BGP Network

This page allows you to specify IPv4 address network and subnet mask.

1. Go to Configure > Routing > BGP and click Add in the section Networks.

2. Enter the IPv4 address of the network and select a subnet mask from the dropdown list.

Figure 224: Add BGP Network

3. Click Save.

Add Neighbor

This page allows you to add a BGP neighbor and specify an IPv4 address of the neighbor router and AS number.

1. Go to Configure > Routing > BGP and click Add in the section Neighbors.

2. Specify the IPv4 address of the neighbor router.

3. Specify the remote autonomous system (AS) number of the neighbor.

Sophos XG Firewall | Configure | 267

Acceptable Range: 1 to 4294967295

Figure 225: Add BGP Neighbor

4. Click Save.

OSPF

This page allows you to manage OSPF routes. You can also add, update, or delete the areas/networks/interfacespecific configuration from this page.

Open Shortest Path First (OSPF) is an interior gateway protocol that multicasts the routing information to all the hosts within a single network. It sends routing information to all the routers in the network by calculating the shortest path to each router on the basis of the structure built up by each router.

OSPF allows sets of networks to be grouped together into what is known as areas. Area is a logical division of a network. Each area maintains a separate database whose information may be summarized by the connecting router.

Hence, the topology of an area is not known to the outside world. There are three types of areas:

Backbone Area

Backbone area also known as area 0, distributes information between non-backbone areas. All other areas in the network are connected to it and the routing between areas takes place using routers which are connected to the backbone area as well as to their respective areas.

Stub Area

A stub area is an area that do not receive route advertisements external to the Autonomous System (AS), which is a collection of networks under a common network operator that share same routing policy.

NSSA

A Not-so-stubby-area (NSSA) is a type of stub area that can import AS external routes in a limited amount.

Area Border Router

An Area Border Router (ABR) is a router that connects areas to the backbone network and maintains separate routing information for each area that it is connected to. It has interfaces in more than one area with at least one interface in the backbone area.

Global Configuration

Router ID

Specify a unique router ID.

Example: 12.34.5.66.

Figure 226: Global Configuration

Advanced Settings

Default Metric

Specify the default metric value to be used for redistributed routes.

Metric is a property that contains a value used by a routing protocol to decide whether a particular route should be taken or not.

Sophos XG Firewall | Configure | 268

Default: 1

Acceptable Range: 1 to 16777214

ABR Type

Select the type of Area Border Router (ABR).

Available Options:

• Standard

• CISCO

• IBM

• Shortcut

Auto cost reference bandwidth (Mbits/s)

Specify the cost reference to calculate the OSPF interface cost based on bandwidth.

Default: 100 Mbits/s

Acceptable Range: 1 to 4294967

Default Information Originate

Select an option to control the distribution of the default route.

Available Options:

• Never

• Regular – On selecting Regular provide the metric and select the metric type.

• Always – On selecting Always provide the metric and select the metric type.

The default setting is Never.

Redistribute Connected

Click to enable the redistribution of connected routes into the OSPF routing table.

Specify the metric and the metric type for redistributing connected routes.

Acceptable Range: 0 to 16777214

Metric Type: External Type 1 or External Type 2.

Redistribute Static

Click to enable the redistribution of static routes into the OSPF routing table.

Specify the metric and the metric type for redistributing static routes.

Acceptable Range: 0 to 16777214

Metric Type: External Type 1 or External Type 2.

Redistribute RIP

Click to enable the redistribution of OSPF routes into OSPF routing table.

Specify the metric and the metric type for redistributing RIP routes.

Acceptable Range: 0 to 16777214

Metric Type: External Type 1 or External Type 2.

Redistribute BGP

Click to enable the redistribution of BGP routes into the OSPF routing table.

Specify the metric and the metric type for redistributing BGP routes.

Acceptable Range: 0 to 16777214

Metric Type: External Type 1 or External Type 2.

Sophos XG Firewall | Configure | 269

Figure 227: Advanced Settings

Click Apply.

Networks and Areas

Networks

This section lists all available OSPF networks together with the corresponding netmasks and the area they belong to.

Areas

This section lists all available OSPF areas, specifies their types and authentication type, the area cost and, if available, virtual links.

Override Interface Configuration

You can manage the interface configuration from this section.

Add OSPF Areas

1. Go to Configure > Routing > OSPF and click Add in the Areas section.

2. Enter OSPF area details.

Area

Specify an IP address for the area.

Type

Select the type of OSPF area from the options available.

Available Options: NormalStub Stub No-SummaryNSSANSSA No-Summary

Virtual Links (Available only if Normal area type is selected)

Specify a virtual link for an area that does not have a physical connection to connect to the backbone area.

Use Add icon and Remove icon to add and remove virtual links.

Authentication

Select the type of authentication from the options available.

Available Options: TextMD5

Area Cost (Not Available for Normal area type)

Specify the area cost.

Acceptable Range: 0 to 16777215

Sophos XG Firewall | Configure | 270

Figure 228: Add OSPF Area

3. Click Save.

Add OSPF Network

1. Go to Configure > Routing > OSPF and click Add in the Networks section.

2. Enter the IPv4 address of the network and select a subnet mask from the dropdown list.

3. Enter an OSPF area.

Figure 229: Add OSPF Network

4. Click Save.

Override Interface Configuration

You can override default interface configurations of OSPF from this page.

1. Go to Configure > Routing > OSPF and click Select Interface in the Override Interface Configuration section.

2. Enter interface configuration details.

Interface

Select the interface to be configured for OSPF.

Hello Interval

Specify the time interval after which the interface sends hello packet to the neighbor router.

Default: 10 seconds

Acceptable Range: 1 to 65353 seconds

Dead Interval

Specify the time interval after which the interface is declared as dead.

Default: 40 seconds

Acceptable Range: 1 to 65353 seconds

Sophos XG Firewall | Configure | 271

Retransmit Interval

Specify the time interval for retransmitting the link state advertisements (LSA) to the interface’s neighbor.

Default: 5 seconds

Acceptable Range: 3 to 65353 seconds

Transmit Delay

Specify the time in seconds needed to transmit a link state update packet to the interface.

Default: 1 second

Acceptable Range: 1 to 65353 seconds

Interface Cost

Specify the interface cost.

You can either provide the interface cost automatically by selecting Auto or specify it manually.

Acceptable Range: 1 to 65353 seconds

Authentication

Select the type of authentication for authenticating the OSPF packets.

Available Options: Text - If Text is selected, provide a password for authentication. MD5 - If MD5 is selected, provide a key ID and a key. Key ID can be from 0 to 255.

Router Priority

Specify priority for a router.

Default: 1

Acceptable Range: 0 to 255

Figure 230: Override Interface Configuration

3. Click Save.

Information

Sophos XG Firewall | Configure | 272

Administrator can view various information and status of any dynamic routes configured using RIP, OSPF, BGP and

PIM-SM protocols. This overview of the dynamic route information will be useful for further configurations and/or debugging.

RIP

Routes

Displays the entire routing configuration information and the routing table for an interface configured using the RIP protocol.

Codes and Sub-codes

Codes

Sub-codes

Network

Next Hop

Metric

From

Shows how the destination routing information is obtained.

R – RIP, C – connected, S – Static, O – OSPF, B

– BGP, K – Kernel route.

(n) – normal, (s) – static, (d) – default, (r) – redistribute, (i) – interface

Specifies the IP address and subnet mask of the destination.

Specifies an IP address of the next hop routing device.

Specifies the number of routing devices (hop count) a packet must pass through to reach the final destination.

Indicates the router (router IP address) from which the metric is calculated to reach the destination.

If it is directly connected it will show self.

Tag

Indicates the method used for distinguishing between internal routes (learned by RIP) and external routes learned from External Gateway

Protocol (ERP) protocols.

0 indicates no tag is attached to the route.

Time

Indicates the elapsed time after which the routing entry will be flushed from the RIP table.

Status

Displays the RIP routing protocol process parameters and statistics.

Routing Protocol is "rip"

Sending updates

Next due

Timeout after

Garbage collect

Indicates the routing protocol used.

Indicates the time between sending updates.

Specifies when the next update is due to be sent.

Indicates the timeout interval for RIP route after which it is declared invalid and removed from the routing table until the garbage-collect time expires.

Indicates the time period during which the route metric is set to 16. If no updates are received for the route before the expiry of the garbage-

Outgoing update

Incoming update

Default redistribution metric

Redistributing

Default version control

Interface

Send

Recv

Key-chain

Routing for Network

Routing Information Sources

Sophos XG Firewall | Configure | 273 collect timer, a route with metric 16 is deleted from the routing table.

Indicates whether the outgoing filtering list has been set.

Indicates whether the incoming filtering list has been set.

Metric of routes that are redistributed from other routes.

Indicates the information about redistribution of other protocols.

Indicates the version of RIP packet that are sent and received.

Shows a RIP-enabled routing interface

Displays the version of RIP packets sent out to the routing interface. The version is one of the following: RIP1, RIP2

Displays the version of RIP packets accepted on the routing interface. The version is one of the following: RIP1, RIP2 , Both

Displayed the authentication key-chain name for the interface, if it is configured.

Indicates the networks for which the routing process is currently injecting routes.

Indicates the routing sources used to build the routing table. For each source, the following information is displayed.

Gateway

Indicates an IP address of the next hop routing device.

Bad Packets

Indicates the number of bad packets received by the router.

Bad Routes

Distance Last Update Indicates the time when the administrative distance was last updated.

Distance

Indicates the number of invalid routes from the router.

Indicates the administrative distance. The distance displayed by default is

120

Sophos XG Firewall | Configure | 274

OSPF

Border Routers

Displays the information about the internal OSPF routing table entries to an Area Border Router

(ABR) and Autonomous System Boundary Router (ASBR).

Network IP Address

Metric

Area

Next Hop

Outgoing Interface

Indicates that the information for the route is provided to a particular border router.

Indicates the router ID of the destination.

Specifies the cost to reach the final destination.

Indicates the area identifier of the outgoing interface.

Specifies the management IP address of the next hop routing device.

Indicates the name and IP address of the outgoing interface to reach the destination.

Routes

Displays the information about the internal OSPF routing table entries.

Network IP Address

Metric

Area

Next Hop

Directly attached

Outgoing Interface

Indicates that the information is provided for a network.

Indicates the router ID of the destination.

Specifies the cost to reach the final destination.

Indicates the area identifier of the outgoing interface.

Specifies the management IP address of the next hop routing device.

Indicates a network is directly connected to the interface.

Indicates the name and IP address of the outgoing interface to reach the destination.

Database

Database shows the list of information related to the OSPF database summary for a specific router.

Each link-state database includes link-state an advertisement from throughout the areas to which the router is attached.

Link ID

ADV Router

Indicates the ID of the link-state advertisement using which a router learns the route. In other words, while a link-state advertisement describes a router, the link-state ID router’s

OSPF router ID.

The link-state advertisement describing a network can have one of the following two formats of link-state ID: the network's IP address or an address generated using the linkstate ID.

Indicates the advertising router ID of the destination.

Sophos XG Firewall | Configure | 275

Age

Seq#

CkSum

Link count

Net Link States

Router Link States

Summary Net Link States

Indicates the time, in seconds, since the LSA was generated.

Link state sequence number (detects old or duplicate link-state advertisements).

Checksum of the complete content of the linkstate advertisement.

Number of interfaces detected for the router.

Gives information about network LSA originated by DR (designated router)

Gives information about router LSA originated by every router.

Indicates the information about summary LSA originated by ABR’s.

Neighbors (ARP - NDP)

Provides neighbor information based on peer-interface relation.

Neighbor ID

Pri

State

Indicates the neighbor router’s ID.

Indicates the router priority assigned to that neighbor.

Displays the conversation between router and neighbor since the neighbor was created. It can have one of the following values:

Down

Attempt

Init

Indicates the initial state of a neighbor conversation, that is, there has been no recent information received from the neighbor.

Valid only for neighbors attached to non-broadcast networks. Indicates that there has been no recent information received from the neighbor.

Indicates a hello packet has been received recently from a neighbor although the adjacency is not two-way, that is, a bi-directional communication has not yet been established with neighbor.

2-Way

ExStart

Exchange

Loading

Full

Backup

Dead time

Sophos XG Firewall | Configure | 276

Indicates that a bi-directional communication is established between the routers and the neighbor has included the router ID in its

Hello message. The

DR and BDR are elected from the set of neighbors in 2-way state or higher.

Indicates that the two routers are going to synchronize and determine which router will be master and which the slave.

Indicates that the two routers are describing their respective linkstate database by sending database description packets.

Indicates that link-state request packets are sent to the neighbor, requesting for more advertisements that have been discovered but are not yet received in Exchange state.

Indicates that both routers have accomplished the exchange of all the relevant advertisements and can now appear in router-link and neighbor-link advertisements.

Indicates that the neighbor is a backup designated router

The waiting time in seconds to receive a hello message from

OSPF neighbor before assuming the neighbor is dead.

Interface

Displays OSPF interface information.

Interface Value

IfIndex

MTU

Internet Address

Network Type/IP Address

Area

MTU mismatch detection

Router ID

Network Type

Address

Interface

RXmtL

RqstL

DBsmL

Sophos XG Firewall | Configure | 277

Specifies the IP address of the router’s interface with the neighbor.

Indicates the IP address of neighbor interface

Indicates the link-state retransmit count.

Indicates the link-state request count.

Indicates the link-state summary count.

Indicates the status of the physical interface, that is, whether the interface is up or down.

Indicates the value of interface index (IfIndex).

It is an identification unique number associated with an interface.

Indicates the Maximum Transmission Unit

(MTU) value of the interface.

MTU is the largest physical packet size, in bytes, that a network can transmit. This parameter becomes an issue when networks are interconnected and the networks have different

MTU sizes. Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent.

Indicates the bandwidth of the interface.

Displays the IP address of the interface.

Indicates the type of the network along with the

IP address.

Indicates the IP address of the area identifier.

Indicates whether the MTU mismatch detection is enabled or disabled. If it is enabled, it would match the MTU of both the interfaces participating in neighborship establishment.

Indicates the identification number of the

OSPF router selected at the start of the OSPF process. The router ID is unique within the

OSPF domain and does not change unless OSPF restarts or is manually modified.

Indicates the type of network to which the OSPF interface is connected. A network can be one of the following types:

Cost

Transmit delay

State

Sophos XG Firewall | Configure | 278

Point-to-point

Point-to-Multipoint

(non-broadcast)

Broadcast

Non Broadcast

Multiple Access

(NBMA)

Displays the OSPF metric. It is calculated using formula: 10

[bps]) where

/ bandwidth (in bits per seconds

• 10

: is the reference bandwidth

• bandwidth: is the bandwidth of the interface in bps

Indicates the time in seconds which the OSPF router waits before flooding a link-state advertisement (LSA) over the link. The link state age is incremented by this value, before transmitting an LSA.

The default value of transmit delay is 1 second.

Indicates the current state of the specified interface. The state can be one of the following:

BDR

DROTHER

The router is a designated router

(DR) on the network.

The router is a backup designated router (BDR) on the network.

The router is neither a DR nor a BDR on the network

A point-to-point network can connect only two routers.

A point-to-multipoint network connects one router to several other routers.

Indicates a network that supports broadcast. In a broadcast network a single packet sent

(broadcasted) by a router is received by all the routers within the network.

Indicates that the network does not have the capability to broadcast or multicast. It is used to accurate model

X.25 and framerelay environment in multiple-access network.

Priority

Designated Router ID

Backup Designated Router ID

Saved Network-LSA sequence number

Multicast group membership

Timer intervals configured

Sophos XG Firewall | Configure | 279

Waiting

and it establishes adjacencies only with the DR and the BDR.

The interface router is in waiting to announce the state of the link as

DR.

Note: This state is normal in case of non broadcast multi access network.

Point-to-Point

The interface in pointto-point state is fully functional and starts exchanging hello packets with all its neighbors.

Point-to-Multipoint

Indicates the interface to be point-to multipoint for OSPF.

Indicates the priority of the interface router.

It assists in electing the DR and BDR on the network to which the interface is connected.

Default: 1

Note: A router with priority value 0 can never be a DR/BDR.

Indicates the DR router ID for the respective network.

Indicates the BDR router ID for the respective network

Indicates the network's link-state sequence number. It is used to calculate shortest path first

(SPF).

Indicates the multicast group in which the router is a member.

Displays the value of following OSPF timers:

Hello

Dead

Wait

Time interval in seconds that a router sends a hello packet.

Indicates the waiting time in seconds before declaring a neighbor dead.

Displays the time interval that leads the

Sophos XG Firewall | Configure | 280

Retransmit

Hello Due In

Neighbor Count

Adjacent neighbor count

interface to terminate the waiting period and elect the DR on the network.

Displays the waiting time before retransmitting a database description

(DBD) packet if it has not been acknowledged earlier.

Specifies when the next hello packet is due to be sent.

Indicates the total number of discovered neighbors on the interface.

Indicates the total number of adjacent neighbors that are fully adjacent to the interface.

BGP

Neighbors (ARP - NDP)

Displays the information about the BGP and its peer connections and shows the number of routes advertised/neighbors to/from that peer.

BGP Neighbor

Remote AS

Local AS

Internal/External Link

BGP Version

Remote Router ID

BGP State

Last Read

Hold Time

Indicates the IP address of the BGP neighbor.

Indicates the AS number of the neighbor router.

Indicates the value of the configured local autonomous systems (AS).

Displays internal links for internal BGP (iBGP) neighbors and external link for external BGP

(eBGP).

Indicates BGP version used for communication with remote router.

Indicates router ID of the neighbor router.

Indicates the finite state machine (FSM) stage.

It describes what action should be taken by the BGP routing engine and when for session negotiation.

Displays the time, since BGP router last received a message from the neighbor. The time is displayed in HH:MM:SS format.

Displays the time in seconds, until which the

BGP will maintain the session with the neighbor without receiving any message from it.

Keepalive Interval

Message Statistics

Sophos XG Firewall | Configure | 281

Displays the time interval in seconds specifying how often the BGP router sends the keep-alive message to the neighbor.

Displays the statistics organized by message type.

InQ

OutQ

Sent

Received

Opens

Notifications

Updates

Keepalives

Route Refresh

Capability

Total

Indicates the number of messages that are in queue, pending to be processed from the neighbor.

Indicates the number of messages that are in queue, pending to be sent to the neighbor.

Indicates the number of messages sent to the neighbor.

Indicates the number of messages received from the neighbor.

Indicates the total number of open messages sent and received.

Indicates the total number of error notification messages sent and received.

Indicates the total number of update messages sent and received.

Indicates the total number of keep-alive messages sent and received.

Indicates the total number of route refresh messages sent and received.

Indicates the total number of BGP capabilities advertised and received from the neighbor.

Indicates the total number of messages sent and received.

Sophos XG Firewall | Configure | 282

Minimum Time between advertisement runs Displays the time in seconds between the sent advertisements.

For Address Family

Community attribute sent to this neighbor

Indicates the IP address family.

Indicates the numerical value of the BGP community.

This numerical value is assigned to a specific prefix and advertised to the neighbor, based on which it decides whether to filter or modify attributes.

Accepted Prefix

Indicates the number of accepted prefixes that can participate in a BGP peer session.

Connections established

Indicates the number of times a TCP and a BGP connection has been established successfully.

Dropped

Indicates the number of times a valid session failed or has been taken down.

Last reset

Displays the time since when the previously established session with the neighbor ended.

Local host and Local port

Displays the IP address and port number of the local BGP router.

Foreign host and Foreign port

Displays the IP address of neighbor and BGP destination port number.

Next hop

Indicates the management IP address of the next hop routing device.

Next connect timer due in

Specifies when the next hello packet is due to be sent to the BGP neighbor.

Read Thread

Write Thread

Indicates if the read thread is ON or Off.

Indicates if the write thread is ON or Off.

Routes

Displays the entire routing configuration information and the routing table for an interface configured using the BGP protocol.

BGP Table Version

Local Router ID

Status codes and Origin codes

Indicates the table version number. The version number is updated with any change in the BGP table.

Indicates the IP address of the router.

Shows how the destination routing information is obtained.

Status Codes: A Status code indicates the status of the table entry and is displayed at the beginning of each line in the table. Status code value can be one of the following: s – suppressed, d –damped, h – history, *

– valid, > – best, i – internal, r – Routing

Information Base (RIB)-failure, S – Stale, R –

Removed.

Origin codes: An Origin code indicates the origin of the entry and is displayed at the end of

Sophos XG Firewall | Configure | 283

Network

Next Hop

Metric

LocPrf

Weight

Path

Total number of prefixes

each line in the table. Origin code value can be one of the following: i – Interior Gateway Protocol (IGP), e – Exterior

Gateway Protocol (EGP), ? – incomplete/path not clear.

Indicates the IP address and subnet mask of the destination.

Indicates the management IP address of the next hop routing device.

0.0.0.0 indicates the router has noon-BGP routes to the network.

Indicates the value of inter autonomous system metric.

Indicates the local preference value.

Local preference is one of the methods to change the path taken by one autonomous system (AS) to reach to another AS.

Local preference value indicates to AS about the path that has local preference, and one with the highest preference being preferred.

Indicates the route weight as set via autonomous system filters. If more than one path exists to a particular IP address, then the path with the highest weight is selected.

Indicates the autonomous system path to the destination network.

Indicates the total number of prefixes/networks.

Summary

Displays the status of all the BGP connections details such as path, prefixes and attributes information about all the connections to BGP neighbors.

BGP Router Identifier

Local AS Number

RIB entries

Memory

Peer

Memory

Neighbor

LocPrf

Indicates the router ID of the BGP router

Indicates the local autonomous system number to which this router belongs.

Indicates the number of routing information entries in RIB

Indicates the memory used by RIB entry/ies.

Indicates the number of neighbors with which the connection is established.

Indicates the memory used by neighbor entries.

Indicates the IP address of the neighbor.

Indicates BGP version number provided to the neighbor.

Indicates local preference value.

Sophos XG Firewall | Configure | 284

MsgRcvd

MsgSent

TblVer

InQ

OutQ

Up/Down

State/PfxRcd

Total number of neighbors

Local preference is one of the methods to change the path taken by one autonomous system (AS) to reach to another AS.

Local preference value indicates to AS about the path that has local preference, and one with the highest preference being preferred.

Indicates the autonomous system number.

Indicates the number of messages received from the neighbor.

Indicates the number of messages sent to the neighbor.

Indicates the last version of the BGP database that was sent to the neighbor.

Indicates the number of messages that are in queue, pending to be processed from the neighbor.

Indicates the number of messages that are in queue, pending to be sent to the neighbor.

Indicates the total time of a BGP session to remain in established state, or gives the current status of BGP session, if it is not in established state.

Indicates the state of the neighbor and the number of prefixes received.

Indicates the total number of neighbors.

PIM-SM

Interface Table

Displays all the PIM enabled interfaces and the neighbor information of each interface.

Multicasting Routing Table

Displays the information of the multicast groups joined. The information includes the source address, multicast group address, the incoming interface from which packets are accepted, list of outgoing interfaces to which packets are sent, PIM timers, flag bits etc.

RP SET

Displays RP set information which is a collection of group-to-RP mappings. This information is used to determine the RP for a multicast group and is maintained by a PIM router.

Upstream Proxy

If your enterprise contains numerous internal branches, an upstream proxy can bundle the requests from the internal network before passing the traffic on to the external network/Internet.

This page allows you to configure an upstream proxy for IPv4/IPv6.

IPv4 Parent Proxy

Parent Proxy

Click to enable the parent proxy, if the web traffic is intercepted by an upstream gateway.

If enabled, the device forwards all the HTTP requests to the parent proxy server.

Domain Name/IPv4 Address

Specify a domain name or IPv4 address for the parent proxy.

Port

Specify the port number, which is to be used for the parent proxy.

Default: 3128

Username

Specify a username for authentication.

Password

Specify a password for authentication.

Sophos XG Firewall | Configure | 285

Figure 231: IPv4 Parent Proxy

Click Apply.

IPv6 Parent Proxy

Parent Proxy

Click to enable the parent proxy. if the web traffic is intercepted by an upstream gateway.

If enabled, the device forwards all the HTTP requests to the parent proxy.

Domain Name/IPv6 Address

Specify a domain name or IPv6 address for the parent proxy.

Port

Specify the port number to be used for the parent proxy.

Default: 3128

Username

Specify a username for authentication.

Password

Specify a password for authentication.

Sophos XG Firewall | Configure | 286

Figure 232: IPv6 Parent Proxy

Click Apply.

Multicast (PIM-SIM)

This page allows you to configure PIM.

Protocol Independent Multicast (PIM) is a protocol for routing IP packets efficiently to multicast groups that may span throughout the Internet. PIM provides dynamic multicast support on the device. With dynamic multicast support, a host can join/leave a multicast group dynamically and there is no need to manually add/delete multicast routing entries on the device.

Note: The device supports PIM version2 and PIM-SM mode with Rendezvous Point (RP) selection method as BSR (Bootstrap Router)

PIM-SM Configuration

Enable PIM

Enable PIM to provide dynamic multicast support on the device.

PIM Enabled Interface

Select the physical interfaces on which PIM service needs to be enabled.

To enable PIM, at least one interface has to be selected.

Note:

• Only IPv4 bound interfaces can be selected.

• Alias, PPPoE and Cellular WAN interfaces are not supported.

Figure 233: PIM-SM Configuration

RP Settings

Enable to configure Static RP or Candidate RP.

Static RP

RIP IP

Multicast Group

Sophos XG Firewall | Configure | 287

Specify a unicast IP address for static RP. RPs can be added or deleted.

Maximum eight RP IP addresses per RP are allowed.

Specify Multicast Group IP address or network address separated by comma that will be served by given RP.

Maximum eight multicast group addresses per

RP are allowed

Use * in Multicast Group List to serve all the multicast groups by the defined RP.

Figure 234: Static RP Settings

Candidate RP

Candidate RP IP

Multicast Group List

Candidate RP Priority

Timer

Select interface IP that will be used as RP IP, if the router is selected as candidate RP.

Specify multicast group IP address or network address separated by a comma that will be served by given RP.

Maximum eight multicast group IP/network addresses are allowed.

Use * in Multicast Group List to serve all the multicast groups by the selected RP.

Specify the priority of the PIM router in the RP election process.

Default: 1

Acceptable Range: 1 to 255

Specify time in seconds after which at every specified time, RP candidate messages are generated.

Default: 60 seconds

Acceptable Range: 30 to 180 seconds

Sophos XG Firewall | Configure | 288

Figure 235: Candidate RP Settings

RIP

This page allows you to manage RIP routes. You can also add, update, or delete the networks/interface-specific configuration from this page.

Routing Information Protocol (RIP) is a widely used routing protocol that uses hop count to determine the best route to a destination.

RIP avoids routing loops from continuing indefinitely by limiting the number of hops permitted between the source and destination. The maximum number of hops supported is 15. Hence, if the hop count becomes 16, it is known as an infinite distance and is considered as unreachable.

With the help of the RIP protocol, the device sends routing update messages at regular intervals to the next router.

When the next router receives the changes, it updates them in the routing table and also increases the metric value for the path by 1. The sender of the message is considered as the next hop. The device maintains only the route with the least metric value to a destination.

Global Configuration

Default Metric

Specify the default metric value to be used for redistributed routes.

Metric is a property that contains a value used by a routing protocol to decide which route will be taken.

Default: 1

Acceptable Range: 1 to 16

Administrative Distance

Specify the administrative distance. It is a number used by the routers to find out the better route.

Default: 120

Acceptable Range: 1 to 255

RIP Version

Select the RIP version to be used for sending and receiving updates.

Available Options:

• Send V2 & Receive both

• V1

• V2

Timers

Update

Specify the time interval in seconds between two periodic routing updates.

Default: 30 seconds

Acceptable Range: 5 to 2147483647 seconds

Timeout

Sophos XG Firewall | Configure | 289

Specify the time in seconds after which the route becomes invalid.

Default: 180 seconds

Acceptable Range: 5 to 2147483647 seconds

Garbage

Specify the garbage time. It is amount of time that the device will advertise a route as being unreachable before deleting the route from the routing table.

Default: 120 seconds

Acceptable Range: 5 to 2147483647 seconds

Default Information Originate

Enable to control the distribution of the default route. It will generate and advertise a default route into the RIP-enabled networks.

The default setting is disabled.

Redistribute Connected

Click to enable the redistribution of connected routes into the RIP routing table.

Specify metric for redistributed connected routes.

Acceptable Range: 0 to 16

Redistribute Static

Click to enable the redistribution of static routes into the RIP routing table

Specify metric for redistributed static routes.

Acceptable Range: 0 to 16

Redistribute OSPF

Click to enable the redistribution of OSPF routes into the RIP routing table.

Specify metric for redistributed OSPF routes.

Acceptable Range: 0 to 16

Redistribute BGP

Click to enable the redistribution of BGP routes into RIP routing table.

Specify metric for redistributed BGP routes.

Acceptable Range: 0 to 16

Sophos XG Firewall | Configure | 290

Figure 236: Global Configuration

Click Apply.

RIP Networks

This section shows a list of available RIP networks including the corresponding netmasks.

Override Interface Configuration

You can manage interface configuration from this section.

Add RIP Network

1. Go to Configure > Routing > RIP and click Add in the RIP Networks section.

2. Enter the IPv4 address of the network and select a subnet mask from the dropdown list.

Figure 237: Add RIP Network

3. Click Save.

Override Interface Configuration

You can override default interface configurations of RIP from this page.

1. Go to Configure > Routing > RIP and click Select Interface under the Override Interface Configuration section.

2. Enter interface configuration details.

Interface

Select the interface for which you want to override the default configuration.

RIP Version

Send

Select the RIP version(s) to be used for sending the routing updates.

Annonce

Routing

Static Routing

Policy Routing

Gateways

BGP

OSPF

Information

Upstream Proxy

Multicast (PIM-SIM)

RIP

Relaterede

Sophos XG Firewall User Guide

Swisscom Huawei Router B593s-22 Instructions

Sophos Endpoint Security Manual: AI Chat & PDF

Sophos XG Firewall v16.5 User Guide

Cyberoam Web Filter Policy Manual: AI Chat & PDF

Sophos XG Firewall XG v15.01.0 Administrator Guide

Sophos Email Appliance User Manual | AI Chat & PDF Access

Sophos Endpoint Security Guide: AI Chat & PDF Download

Kramer Panels User Manual + AI Chat & PDF Download

Kramer Panels User Manual: AI Chat & PDF Access

Vodafone Email Client User Manual: AI Chat & PDF Access

Sophos Group Level Web Interface Guide