Sophos XG 135 with IP over WAN, in a different network than Alias interfaces

Ivanildo,

Alias IP must use the same subnet of the physical interface.

Regards

I don't know that is entirely true; encountered a customer years ago whose ISP was, in American terms, "lame."  They added additional public IPs using ROTP (Routing Over The Top) …. granted, this was with Sophos SG UTM (may have even been Astaro UTM back then... but to my amazement adding each Alias IP with a /32 worked for publishing inbound services (of course it did not work for outbound, but that wasn't the point)… the ISP did some "Magic" that allowed this to work.  I wasn't a fan of the configuration, but it did work.  Things may be different on XG of course.

I don't know that is entirely true; encountered a customer years ago whose ISP was, in American terms, "lame."  They added additional public IPs using ROTP (Routing Over The Top) …. granted, this was with Sophos SG UTM (may have even been Astaro UTM back then... but to my amazement adding each Alias IP with a /32 worked for publishing inbound services (of course it did not work for outbound, but that wasn't the point)… the ISP did some "Magic" that allowed this to work.  I wasn't a fan of the configuration, but it did work.  Things may be different on XG of course.

The provider gave a solution.

It will put a router on the edge, where it will be the gateway of Sophos, the WAN interface of the router will have IP 189.10.10.46/255.255.255.192, since its internal interface connected directly to XG, it will have IP 189.10.20.17, in XG it will be 189.10.20.18.
So the XG interface and the Alias will be on the same network.

That solves the problem, right?

Detail: The IP addresses here are fictitious.

It will work but you will have another hop.

As I said on v18, you CAN HAVE IP Alias with different subnet mask. Check the screenshots.

Regards