Most engineers think…
Most people treat a firewall as 'an IP and a few allow rules', then get stuck when traffic leaves the wrong link or a rule never matches. That mental model fails you in an interview and on a live branch.
Sophos Firewall is a stack of four layers in a fixed order: zones group interfaces by trust so a rule is written zone-to-zone; interfaces (physical, VLAN, LAG, bridge, alias, RED) are where traffic enters and leaves; the WAN link manager balances and fails over multiple ISPs; and routing picks the path with static and dynamic protocols. On top, SD-WAN steers apps by SLA — and crucially SD-WAN routes are looked up first, before static and dynamic. Knowing that order is what turns 'my static route is ignored' from a mystery into a one-line answer.
① Zones — the trust model everything else hangs off
The first idea to lock in: Sophos Firewall is zone-based, not per-port. A zone groups one or more interfaces by trust level, and every firewall rule is written source-zone to destination-zone. Write one rule from LAN to WAN and it covers every port you placed in LAN — far fewer, clearer rules than per-interface ACLs.
SFOS ships with default system zones: LAN, WAN, DMZ, WiFi and VPN (plus a Local zone for traffic to the firewall itself). When the defaults aren't enough — say you want to isolate a PCI segment or a guest network — you create a custom zone and drop the right interfaces into it.
The interview line: zones decide what a rule even applies to. Get an interface into the wrong zone and a perfectly written rule silently never matches the traffic you meant.
When a firewall rule 'isn't working', confirm the interface is in the zone the rule expects first. A rule from LAN to WAN does nothing for a port you accidentally left in DMZ. Zones decide what a rule even applies to.
Why is Sophos Firewall described as 'zone-based'?
② Interfaces & WAN links — where traffic enters and leaves
An interface is any port — physical or logical — that carries traffic, and each one is assigned to exactly one zone. SFOS supports physical ports (hardware or virtual NICs), VLAN interfaces (802.1Q tagged sub-interfaces that split one port into many logical networks), LAG / link aggregation (bonding ports with LACP for bandwidth or redundancy), bridge interfaces (transparent mode, so the firewall sits inline without re-addressing the segment), alias IPs (extra IPs on one interface) and RED / SD-RED tunnels (a thin remote box that back-hauls a branch LAN over an encrypted link).
Two ISPs, one branch
For WAN, the WAN link manager lets you run multiple gateways with weighted load balancing and failover. Each gateway gets a health check (a gateway probe), so a dead ISP is detected automatically and traffic moves to the surviving link. Weights bias how much load each link carries. Per-interface services like DHCP and DNS are configured here too, so one box runs addressing, name resolution and routing for the site.
A trust grouping of interfaces (LAN/WAN/DMZ/WiFi/VPN/custom). Every firewall rule is written source-zone to destination-zone.
VLAN = an 802.1Q tagged sub-interface splitting one port into many logical networks. LAG = bonding ports with LACP for bandwidth or redundancy.
Runs multiple ISP gateways with weighted load balancing, failover and health-check probes so a branch stays online if one link dies.
App/FQDN-aware policy routing with an SLA monitor (latency/jitter/loss). On breach it fails the app over to the backup link automatically.
Which interface type back-hauls a remote branch LAN to the firewall over an encrypted tunnel?
③ Routing — static, dynamic, and the lookup order that trips people up
Once an interface and gateway exist, routing decides the egress path. SFOS does first-class static routes, plus a full dynamic routing stack built on FRR: OSPF, BGP and RIP, with multicast (PIM/IGMP) for streaming. It also supports policy-based routing, which in modern SFOS is delivered through SD-WAN routes that match on source, destination, service or application — not just a destination subnet.
The precedence you must memorise
SFOS evaluates routes in a fixed order: (1) SD-WAN policy routes, then (2) static routes, then (3) dynamic routes (OSPF/BGP/RIP). The catch: an SD-WAN route wins even if a more specific static route exists. That single fact explains most 'my static route is being ignored' tickets — an SD-WAN route matched first and steered the traffic somewhere else.
It isn't ignored — it lost the lookup. SFOS checks SD-WAN policy routes before static and dynamic routes, so an SD-WAN route matching the same traffic wins even if your static route is more specific. Check SD-WAN routes first when egress looks wrong.
A specific static route exists for 10.20.0.0/16, yet that traffic leaves a different link. What is the most likely cause?
④ SD-WAN — app-aware routing with SLA failover
SD-WAN is where SFOS gets smart about which link an application uses. You build an SD-WAN profile with an SLA monitor — thresholds for latency, jitter and packet loss measured by gateway probes — and pick a primary link plus a backup. You then attach it to an SD-WAN route that matches by application or FQDN, so (for example) your SaaS ERP always rides the fibre link while it is healthy.
Design it so it actually fails over
When the SLA on the primary link is breached, the profile automatically fails the matched traffic over to the backup link, then moves it back when the primary recovers. The failure everyone hits is creating the SD-WAN route but attaching no SLA monitor — SFOS never notices the link degrading and pins the app to a bad link forever. Always pair an app route with an SLA profile and a probe target.
Priya at Kavin Retail Solutions (Pune) faces this
A branch on two ISPs runs a cloud ERP that goes slow and times out at peak, even though 'the SD-WAN route exists' and both ISPs are up.
The SD-WAN route pins the ERP to link1 but has no SLA monitor or health probe attached, so SFOS never notices link1's latency and packet loss have crossed acceptable limits.
In Routing ▸ SD-WAN the ERP route matches, but its profile has no SLA thresholds and no gateway probe; in the WAN link manager both gateways show up, so nothing triggers a failover.
Routing ▸ SD-WAN ▸ Profiles / Routes + Network ▸ WAN link managerBuild an SD-WAN profile with an SLA monitor (probe target + latency/jitter/loss thresholds), set link1 primary and link2 backup, and attach it to the ERP SD-WAN route.
Inject loss on link1 (or wait for peak): watch the SLA flip to breached, the ERP sessions move to link2, the route show link2 active, and the app become responsive again.
Never trust that SD-WAN will fail over because 'a backup link is configured'. Inject loss or drop the primary and watch the SLA monitor flip to breached and the app move links in the SD-WAN status. No SLA monitor means no failover — full stop.
▶ Watch a SaaS app ride link1, then fail over to link2
How an SD-WAN route steers an app and fails it over on an SLA breach. Press Play for the healthy path, then Break it to see the classic failure.
Your SaaS ERP rides link1 but never fails over to link2 when link1 degrades. What is missing?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: in what order does Sophos Firewall pick a route, and why does that explain an 'ignored' static route? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Zone
- A trust grouping of interfaces (LAN, WAN, DMZ, WiFi, VPN or custom) used as the source/destination of firewall rules.
- Interface
- A physical or logical port (physical, VLAN, LAG, bridge, alias, RED) assigned to one zone, optionally with an IP, DHCP and DNS.
- VLAN (802.1Q)
- Tagging that lets one physical port carry multiple logical networks as separate VLAN sub-interfaces.
- LAG (link aggregation)
- Bonding several physical ports (LACP/802.3ad) into one logical link for more bandwidth or redundancy.
- Bridge interface
- Transparent mode where the firewall sits inline between segments without re-addressing them.
- RED / SD-RED
- Remote Ethernet Device — a thin remote box that back-hauls a branch LAN to the firewall over an encrypted tunnel.
- WAN link manager
- The SFOS feature for running multiple WAN gateways with weighted balancing, failover and health-check probes.
- OSPF / BGP / RIP
- Dynamic routing protocols (FRR-based) SFOS can run to learn and advertise routes, alongside static routes.
- SD-WAN profile
- Application/FQDN-aware policy routing with an SLA monitor (latency/jitter/loss) and automatic failover.
- Route precedence
- The SFOS lookup order: SD-WAN policy routes first, then static routes, then dynamic routes.
📚 Sources
- Sophos — Sophos Firewall: Zones (LAN/WAN/DMZ/WiFi/VPN and custom zones). docs.sophos.com
- Sophos — Sophos Firewall: Interfaces — physical, VLAN, LAG, bridge, alias and RED. docs.sophos.com
- Sophos — Sophos Firewall: WAN link manager and gateways (weighted balancing & failover). docs.sophos.com
- Sophos — Sophos Firewall: Routing — static, OSPF, BGP, RIP and multicast (FRR). docs.sophos.com
- Sophos — Sophos Firewall: SD-WAN profiles, SLA monitoring and SD-WAN routes. docs.sophos.com
- Sophos Support — SD-WAN routing and route precedence (SD-WAN over static and dynamic). support.sophos.com
What's next?
Got the plumbing? Next, learn how Sophos Firewall rules and rule groups actually match traffic — and why NAT lives in its own separated NAT rule table instead of being baked into the firewall rule.