The short version
How does the firewall connect?
The provider supplies a handoff to the firewall or an upstream customer device. In a common routed configuration, Sophos Firewall uses an external WAN interface, the assigned address and gateway, and appropriate firewall and NAT rules to connect the business network.
This is a single routed firewall with static IPv4 addressing. Your installation may use HA, VLANs, an upstream router, SD-WAN routing, IPv6, or centrally managed settings.
Menus and options vary with Sophos Firewall version, hardware, deployment mode, and administrative permissions. Preserve access, record the existing configuration, schedule the change, and prepare rollback with the responsible administrator.
01 / Preparation
Gather the service details.
Confirm the circuit reference and handoff location, port speed, supported optic and cable, VLAN tag if required, MTU, and agreed negotiation or FEC. Obtain the assigned IPv4 address and prefix, gateway or routing information, and any separately routed address block. Verify the data port and which team manages each connected device.
If the firewall is centrally managed or part of an HA pair, coordinate the changes, policy installation, synchronization, and failover with the appropriate team.
02 / WAN interface
Configure the intended data port.
Connect the agreed handoff and confirm the link state and negotiated speed on both sides. For a static routed configuration, Sophos documents physical interfaces under Network → Interfaces. Select the correct interface, confirm the WAN zone and static IPv4 assignment, and enter the address, mask, and gateway details supplied for the circuit.
Use a VLAN interface only when the handoff requires tagging. A physical link can be up while a VLAN or MTU mismatch prevents traffic. Sophos notes that some IP-assignment changes are restricted when VLANs exist, so assess the existing design before changing the port.
A sample set of fields.
- Interface
Port2- Zone
- WAN
- IPv4 / prefix
198.51.100.2/30- Example gateway
198.51.100.1
Use your own provider-supplied address, gateway, interface, and approved settings.
See Sophos’ physical-interface guide and VLAN guidance for the applicable release.
03 / Gateway and routing
Check where traffic will go.
Confirm the WAN gateway and default route match your provider’s service details and the intended design. Sophos’ Routing → Gateways view shows gateway configuration and health checks. An existing SD-WAN policy route, another gateway, or failover configuration can affect which path a particular flow takes.
In our example only, the next hop is 198.51.100.1. For the actual service, use the assigned next hop and verify the route for the destination. A gateway health check may fail because of its test destination or policy even when another destination is reachable; investigate its configured method.
04 / Firewall and NAT
Permit only the traffic the business needs.
Review the firewall rule for the intended LAN-to-WAN traffic, including source and destination zones, networks, services, schedules, and security policies. Rule order matters. Keep inspection and access restrictions in place; do not add a broad bypass as a routine connectivity fix.
For clients using private IPv4 addresses, source NAT or masquerading is often required. Sophos supports independent NAT rules and source-NAT rules linked to firewall rules. A higher matching NAT rule can take precedence. NAT translates traffic; it does not replace the firewall rule. Public routed blocks, inbound services, and IPv6 require their own design.
Review the applicable firewall rule and NAT rule documentation for your installed release. Validate a representative session and its return path.
05 / Verify
Work outward from the handoff.
- 01
Confirm link state
Review the interface, cable, speed, addressing, and any tagging on both sides.
- 02
Check gateway and route
Review gateway health and use a route lookup for an authorized destination. A ping that is not answered does not prove the entire path is down.
- 03
Test a client
From an authorized wired client, test DNS and a business application. Confirm the intended rule, translation if needed, and return path. Check IPv4 and IPv6 independently where used.
- 04
Record the baseline
Save the test time, interface counters, rule and gateway context, and the outcome. Test HA under the approved plan.
06 / Troubleshooting
Find where the behavior changes.
Start with the relevant interface and the equipment on the other side of the handoff. Compare link state, speed, traffic, errors, and discards at two recorded times. Increasing counters are evidence to investigate, not proof by themselves of a provider or firewall fault. Do not clear counters before recording them.
Ping and route lookup
Use Diagnostics → Tools to test an authorized destination and inspect the route. The firewall’s test source and path may differ from an employee’s session.
Follow a test flow
Review the relevant firewall and NAT rule matches, security logs, gateway, and return path for the affected client and time.
show network interfacesFrom the firewall console, select 4. Device Console and run this read-only command. Locate the WAN port and compare its addressing and link information with your handoff details.
Reading the WAN interface.
console> show network interfaces
Port2 Zone: WAN
IPv4: 198.51.100.2/30
Link: up
Receive errors: 0 Transmit errors: 0Address and link: Check that the correct port is up and uses the assigned address and prefix.
Errors: Record counters again after an interval and compare them. Zero errors in a single reading does not establish that the entire path is healthy.
For a difficult issue, the vendor’s packet-capture tool can show how packets are processed and which firewall rule is involved. Use a narrowly scoped capture approved by the security team, protect its contents, and stop it when complete. Captures can contain sensitive information.
07 / Performance
Check capacity with security enabled.
Port speed and licensed service rate do not by themselves establish inspected firewall throughput. Check the appliance specifications and resources with the active inspection, VPN, session, logging, and packet-size mix. Review utilization during the issue; a five-minute average can hide bursts.
For a coordinated high-speed test, use separate capable systems across the intended path. Our performance guide explains multi-stream iperf3, test load, and its limits. Compare latency and packet loss as well as throughput.
08 / Escalation
What to share with support.
- Circuit reference, service address, handoff interface, and issue times with time zone.
- Expected and observed link speed, interface errors and discards, and counter changes.
- Test source, destination, IP family, tool, and whether a VPN or Wi-Fi was involved.
- Applicable route, gateway, firewall and NAT rule observations, and recent changes.
- Affected applications, clients, and whether the issue is ongoing.
Share logs or captures through an approved channel. Contact support@stealth.net or +1 212 232 2020 for Stealth service, and your firewall administrator or Sophos support for device-specific behavior.
About this brief
Sources and further reading.
These Sophos references describe specific product releases; use the documentation for your installed version.
Interfaces and gateways
- Configure physical interfacesWAN zones, static addressing, and gateway fields
- Configure a VLAN interfaceVLANs and interface assignment constraints
- Add a gatewayGateway and health-check settings
Rules and diagnostics
- Firewall rulesRule matching and inspection
- NAT rulesTranslation, rule order, and linked rules
- Ping, traceroute, and lookupsWeb-admin diagnostic tools
- Device Console interface checkRead-only interface command
- Packet captureControlled flow troubleshooting
Prepared by Stealth Communications, a business connectivity provider. This independent guide does not replace your service documentation or Sophos’ instructions.