Routing to another gateway on the same LAN Subnet as Sophos XG

RE: Routing to another gateway on the same LAN Subnet as Sophos XG

Edson Siqueira — Tue, 19 Nov 2019 18:46:40 GMT

Hello ShunzeLee,

I'm trying to do the same thing, but I tried to use this command "set advanced-firewall bypass-stateful-firewall-config" and it didn't worked for me. Actually the command worked but the route didn't, the machines in the subnet 192.168.0.0 /24 can't access machines in the subnet 192.168.5.0 /24 for example.

If I add a static route to 192.168.5.0 /24 in any windows machine in the subnet 192.168.0.0 /24 it works good, but if an add a static route in Sophos XG like bellow it didn't work.

Can you help me?

RE: Routing to another gateway on the same LAN Subnet as Sophos XG

max.mo — Fri, 19 Oct 2018 07:58:07 GMT

Hello,

I can confirm that worked perfectly .

No need to use a MASQ.

Thanks again.

Enjoy your weekend.

Best Regards, Maxime

RE: Routing to another gateway on the same LAN Subnet as Sophos XG

rfcat_vk — Fri, 19 Oct 2018 03:32:20 GMT

Hi,

I hope that works for you, but I would have thought an MASQ on your outgoing gateway is required?

Ian

RE: Routing to another gateway on the same LAN Subnet as Sophos XG

max.mo — Fri, 19 Oct 2018 03:03:18 GMT

Hello,

Thanks a lot !

I completed your post with https://community.sophos.com/products/xg-firewall/f/sophos-xg-firewall-general-discussion/79041/troubleshooting-guide-for-xg.

I think it solved my case.

I need to do more tests to be sure :)

RE: Routing to another gateway on the same LAN Subnet as Sophos XG

ShunzeLee — Fri, 19 Oct 2018 01:55:54 GMT

Maybe it was blocked with XG as asymmetric route.

Only one way pass through XG will be blocked as asymmetric route.

If you can't change the network structure, you may bypass asymmetric routing on XG with following command.

set advanced-firewall bypass-stateful-firewall-config add source_network 192.168.0.0 source_netmask 255.255.255.0 dest_network 192.168.X.0 dest_netmask 255.255.255.0

set advanced-firewall bypass-stateful-firewall-config add source_network 192.168.X.0 source_netmask 255.255.255.0 dest_network 192.168.X.0 dest_netmask 255.255.255.0

Try it.

RE: Routing to another gateway on the same LAN Subnet as Sophos XG

max.mo — Fri, 19 Oct 2018 01:29:17 GMT

Hello,

Thanks for your response.

My rule is on top of the top and there is no blocking traffic :

There was hit to the rule :

the other gateway device is a sonicwall. WE replaced a sonicwall by one sophos but there is still one sonicwall on the other side.

I will try to sketch it out today.

Thanks for your help.

Maxime

RE: Routing to another gateway on the same LAN Subnet as Sophos XG

rfcat_vk — Thu, 18 Oct 2018 17:37:44 GMT

Hi,

where does your rule sit in the list of rules?

Please post a copy of your rule.

Which firewall rule is blocking the traffic?

Ian

RE: Routing to another gateway on the same LAN Subnet as Sophos XG

AADD — Thu, 18 Oct 2018 17:06:53 GMT

Either method mentioned should work, however each gateway or device needs to know the routes on each end.

I did this while migrating to Sophos from Sonicwall.

Maybe I am missing something, can you sketch it out?

RE: Routing to another gateway on the same LAN Subnet as Sophos XG

max.mo — Thu, 18 Oct 2018 09:32:19 GMT

Hell I tried to do a firewall rule with a gateway but this did not work either.

Do you have another idea?

Thanks for your help.

Best Regards, Maxime

RE: Routing to another gateway on the same LAN Subnet as Sophos XG

max.mo — Thu, 11 Oct 2018 04:24:10 GMT

Hello,

Thanks for your response.

I did not try that one.

I know the destination subnet.

So you mean changing the primary gateway in the advanced setting of the firewall network rule?

good idea, I will give it a try tomorrow.

thanks !

RE: Routing to another gateway on the same LAN Subnet as Sophos XG

rfcat_vk — Thu, 11 Oct 2018 04:16:46 GMT

Why not remove all your routes and do it with a firewall rule, you must know the destination IP address range?

Ian