I am using Sophos XG115 as the firewall and i do have a layer 3 switch (Unifi 8 port POE 60W switch) which leverages VLANS created & tagged at XG115.
Users in different VLANs want to connect to devices (e.g. Network Printer and Network Attached Storage device [TerraMaster]) located in another VLAN.
i have created a firewall rule which enables the communication between VLANS. I have also created DHCP records for each VLANs at XG115.
I am able to PING to the gateway addresses of each VLAN. Unfortunately, the trace route keeps on failing at the gateway address of LAN network port at XG11 5when trying to reach to devices in different VLANs.
Can someone help me in steps on what we should be adding or enabling to allow users in different VLANs to access the NAS and Printer?
Please note that users are on stand-alone Windows 10 devices. There is no active directory or LDAP integrations (i mean there is no Windows server).
Below is a diagram of the network. An early response is highly appreciated.
Hello, try source zone :lan , source network select all VLAN inside and the same for destination zone: LAN and destination network : all VLAN . move the rule set to the top position at the Intranet rulesets…
UJay In this scenario, you need to add static route in the firewall. For an IPv4 unicast route, go to Configure > Routing > Static Routing and click Add under IPv4 Unicast Route.https://docs.sophos.com/nsg/sophos-firewall/v17.1.4/Help/en-us/webhelp/onlinehelp/index.html#page/onlinehelp%2FUnicastRouteEdit.html%23Video link: https://www.youtube.com/watch?v=h-nu7tMfL_E
Hope this helps!
Thank & Regards,
If a post solves your question, use the 'Verify Answer' link.
I tried your suggestion and still unable to cross from one VLAN to another.
I am able to ping between gateways of each VLANs but not able to trace route or ping a specific IP address of device.
Do you forward all VLAN's to the XG or terminates the L3-Switch the VLAN and use a transfer-subnet to communicate with XG?
... where is the gefault gateway-IP for the VLAN's located .. at the Switch or at the XG?
If XG is the gateway - you don't need additional routes.
Would be helpful you post a screenshot of XG - interfaces-list.
and follow the suggestion from rfcat_vk:
" On the first rule try changing the any to LAN and enable logging so you can see what if any traffic is attempting to use the firewall rule. Also please make it the top of the rule list."
check the log-viewer...
BTW: are your clients able to access the internet?
Sophos Solution Partner since 2003 If a post solves your question, click the 'Verify Answer' link at this post.
... and a common error: check the IP/subnet-mask and gateway at the NAS!!
The default gateway IP for VLANs are located at XG.
I have done all steps rfact_vk has recommended and still no luck. When i try the POLICY TEST utility under LOG VIEWER,I can see it is picking up the first rule and getting passed as expected. But when i do a trace route, it fails.
Yes clients are able to access internet.
Below is a quick screen caption of interfaces.
with regard to common error - yes i have checked those. Also to make troubleshooting easy, i am using a PC on the VLAN 4 so I can try tracert, ping, and other network troubleshooting commands from both ends to whether it is only dropped at one end or both.
you don't have any VLANs configured on your XG so there is no way for the traffic to get from one Vlan to the other unless you enable routing in your switch to configure Vlans on the XG.
i think he have the vlans under Port1.
you might be right, but that is a guess based on the blue line besides port 1. He was asked for his interface configuration.
- you are able to access the internet from all VLAN's (or at least the two that should communicate one with the other)
- do you see this traffic within logviewer/firewall? ... enabe logging for all rules for testing.
- try to access the NAS within other VLAN (not with HTTP ... this may be handled different) ... do you see allowed or blocked packets within logviewer?
- try to ping NAS & Printer ... something within logviewer?
- please show us the VLAN's behind Port1
Yes I do have VLANS and they are defined under Port 1 as xg-andy mentioned
caption of VLANs has been attached.
Yes i am able to access Internet from all VLANs, there is no issue. I was using these VLANs and users were accessing Internet from May 2021.
When do a ping or tracert to NAS via 2 different VLANs they dont get logged in the logviewer.
Accessing of the NAS is not web based (not HTTP). I use the \\NASipaddress\ to access it.
PING to the NAS IP address fails.
Hope the above helps to clear some doubts at your end
Can you ping the nas from its network?ian