This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Issue with my VLANs

Hi to All Sophos Gurus,

Good day.

I have been fixing my vlan routing in my Sophos XG 210 Firewall. I created different gateways for each VLANs. Below are the details.

VLAN10 :

IP = 192.168.10.0/24

DG = 192.168.10.254

ISP1

VLAN20 :

IP = 192.168.20.0/24

DG = 192.168.20.254

ISP2

VLAN30 (Wireless) :

IP = 192.168.30.0/24

DG = 192.168.30.254

ISP3

I have all my servers on VLAN10. I wanted to share my fileservers in VLAN10 to all other VLANs. I already created a firewall rule in my SOPHOS. The problem I cannot access my fileservers. Did I do something wrong. Someone might be able to help me. Below is a screenshot of my network diagram and firewall policies LAN to LAN.

Network Diagram

Firewall VLAN to VLAN Policy.

If anyone can give me an idea it would be great!

Thanks

Rodney

This thread was automatically locked due to age.

0 Keyur over 4 years ago

Hi Rodney Altamera

Could you please add a static route for the VLANs added in the Sophos Firewall XG?

To add a static route

Routing >> IPv4 unicast route >> Add >> Destination IP (VLAN Network) >> Gateway >> IP of the switch >> Interface through which the traffic will come to XG from that VLAN

Please also remove the Source and Destination network and apply ANY and try to access the fileserver.

You may also try to ping fileserver from any VLAN machine and take packet capture to see if the traffic is coming to the firewall or not, It might be served by the switch as layer 2 communication if the switch has details of the connected host, for packet capture- https://community.sophos.com/kb/en-us/123189

Hope this helps!

Regards,

Keyur
Community Support Engineer | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 4 years ago

Rodney,

where did you create the VLAN?

Is the routing enabled on the Switch?

How did you create the VLAN on the switch?

Please share the configuration.

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 Rodney Altamera over 4 years ago in reply to lferrara

Hi Iferrara,

I created the vlan on sophos since the switch does not support L3. It is only a L2 switch. So what I am planning is making the sophos handle the L3 routing. I created vlan on the switch using the GUI. I am using HP switches.

My vlans are just working fine. The problem I am facing is all vlans cannot access the fileserver on vlan10.

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 Rodney Altamera over 4 years ago in reply to Keyur

Hi Keyur,

Thanks for sharing your technical expertise regarding this matter. I'll check this by next week once I am in office and get back to you.

Cheers!

Rodney
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 4 years ago in reply to Rodney Altamera

Hi Rodney Altamera

Sure, please reach out to us for further assistance.

Regards,

Keyur
Community Support Engineer | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 Rodney Altamera over 4 years ago in reply to Keyur

HI Keyur,

I have an issue with my vlan, the settings is not working. Below is the screenshot of the captured packets

I am confused as to why it is blocking my access to vlan20 from vlan50.

Thanks

rodneyaltam
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 4 years ago in reply to Rodney Altamera

VLAN 50 is not in the firewall rules (based on the screenshots).

Do you see something from XG console:

drop-packet-capture "host x.x.x.x" where x.x.x.x is the source or destination ip?
Cancel
Vote Up 0 Vote Down

Cancel
0 Rodney Altamera over 4 years ago in reply to lferrara

HI Iferrara,

Good day. Below is the updated policy.

Thanks

rodneyaltam
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 4 years ago in reply to Rodney Altamera

Please share:

tcpdump and drop-packet-capture outputs:

https://community.sophos.com/kb/en-us/123567

community.sophos.com/.../127111
Cancel
Vote Up 0 Vote Down

Cancel
0 Rodney Altamera over 4 years ago in reply to lferrara

Hi Iferrara,

I tried to do drop-packet-capture but nothing shows.

Thanks

rodneyaltam
Cancel
Vote Up 0 Vote Down

Cancel