XG Home on XG 115 Rev3 Appliance

Hi Nicholas Cutajar 

Could you please try to capture the logs in console serial access to the device? Are you abe to access SF loader? When you boot the device with XG home what details are getting generated?

Let me tag rfcat_vk he is the expert we have got and maybe he can share his expertise.

Try this like in KB123542 described:

1. Log in to the Command Line Interface (CLI) using Console Access.
2. Select option 4. Device Console.
3. Execute the following command: system appliance_access enable 
4. (You can try via ping command on the advanced shell if you can reach your admin computer - check also if the network config of the XG is correct)
5. Try again to connnect to the XG via Admin Web Interface.
6. Log in to the Admin Console as an administrator and go to Administration > Device Access. Tick the boxes under HTTPS in all the desired or required zones.
7. Execute the following command in the Device Console: system appliance_access disable 

Note: The system appliance_access command will cause a short network interrupt on the XG.

Hi Keyur,

Thanks for the fast response, much appreciated. Below please find some logs together with the prompt displayed on device startup. I am able to access SF loader without issues

sysinit.log

error_log.log

Thanks to the post from @intrusus i managed to login and complete the installation wizard. The only thing is that the ports are miss-configured.

• Appliance Port 1 shows as Port 2 on Web interface
• Appliance Port 2 shows as Port 3 on Web Interface
• Appliance Port 3 shows as Port 4 on Web Interface
• Appliance Port 4 shows as Port 1 on Web Interface

Is there a way i can align these ports so appliance ports correctly show in the Web interface.

Thanks a lot,

Nic

• Appliance Port 1 shows as Port 2 on Web interface
• Appliance Port 2 shows as Port 3 on Web Interface
• Appliance Port 3 shows as Port 4 on Web Interface
• Appliance Port 4 shows as Port 1 on Web Interface

This also seems to have caused you to be unable to reach the web interface. Apparently the ports were internally swapped and the LAN interface was not recognized as such.

The swapped ports seem often to be due to the MAC address allocation of the XG. Often the "size" of the address is used here: the higher the numbers of the MAC address at the end, the higher the port number. For me, if I create a virtual machine on a VMware vSphere host and assign 8 interfaces to it, it's the same as with you. I had to go through a lot of Mac address changes, because VMware automatically creates addresses for the interfaces and XG maps ports randomly to these addresses. After some time I got it finally working and the Ports were set correct. This is something that should really be addressed by the Sophos developers. No other firewall maps MAC addresses to ports as strangely as XG. [:(]

Back to your problem:
First check the MAC addresses of the hardware interfaces with the command: ifconfig
Then check out the MAC addresses in the Web Admin interface, you're also able to edit them there:

Let us know if this works out for you.

Cheers

Thanks for the information as to how ports are mapped.

Changing the MAC addresses from the Web GUI will change the MAC successfully but the ports will still remain as they are since sophos already assigned them that way.

So port 1 after MAC change will still be port 4 on the appliance.

I was thinking of trying to edit that Hardware Port1 via advance shell and change it to be mapped to Port4, but not sure were such a change needs to be done.

Is there any other way perhaps?

Thanks,

Nic

Nicholas Cutajar said:

Changing the MAC addresses from the Web GUI will change the MAC successfully but the ports will still remain as they are since sophos already assigned them that way.

So it was correct that the MAC addresses were really swapped with the hardware ports, right?

Could you show the output of ifconfig, especially from PortA-PortX. Please also provide some screenshots of the changed mac addresses in the Web UI.
Did you perform a reboot?

Update:

You can check out the mac address on the appliance console:

console> show network macaddr PortA
Permanent MAC : 00:0C:29:36:C1:66
Override MAC :
---------------------------------
Current MAC : 00:0C:29:36:C1:66

You can also edit the mac address of a specific hardware interface by using:

console> set network macaddr PortA override "XX:XX:XX:XX:XX:XX"

I am not quite sure if the string is required to be in " but you have to try out. ;)


Nicholas Cutajar said:

I followed it by a restart yes. I did not get this question "So it was correct that the MAC addresses were really swapped with the hardware ports, right?"

Sorry for confusing you. 
What happens now if you enter

• the MAC from Port2 into the Override MAC address field of Port1?
• the MAC from Port3 into the Override MAC address field of Port2?
• the MAC from Port4 into the Override MAC address field of Port3?
• the Mac from Port1 into the Override MAC address field of Port4?

Logically the virtual Port should then match the physical one, shouldn't it?
Please also install v18-GA Build354 as it is the newest and most stable v18 release.

Maybe some Sophos employee has a tip here too...

No problem, thanks for trying to help out :)

The below error is displayed when i try to change the MAC address of port 1 with the physical MAC address of port 2. Same error on all interfaces.

Is it possible to change these from advanced shell? I tried looking for network config files but couldn't find any in their default location.

 Already updated to the latest firmware.

Thanks,

Nic

Try it via en.m.wikibooks.org/.../Linux and don't forget to write the MACs down somewhere.