Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Inter VLAN Communication is not working


I am using Sophos XG115 as the firewall and i do have a layer 3 switch (Unifi 8 port POE 60W switch)  which leverages VLANS created & tagged at XG115. 

Users in different VLANs want to connect to devices (e.g. Network Printer and Network Attached Storage device [TerraMaster]) located in another VLAN. 

i have created a firewall rule which enables the communication between VLANS. I have also created DHCP records for each VLANs at XG115. 

I am able to PING to the gateway addresses of each VLAN. Unfortunately, the trace route keeps on failing at the gateway address of LAN network port at XG11 5when trying to reach to devices in different VLANs. 

Can someone help me in steps on what we should be adding or enabling to allow users in different VLANs to access the NAS and Printer?

Please note that users are on stand-alone Windows 10 devices. There is no active directory or LDAP integrations (i mean there is no Windows server). 

Below is a diagram of the network. An early response is highly appreciated. 

This thread was automatically locked due to age.
  • ok,

    - you are able to access the internet from all VLAN's (or at least the two that should communicate one with the other)

    - do you see this traffic within logviewer/firewall? ... enabe logging for all rules for testing.

    - try to access the NAS within other VLAN (not with HTTP ... this may be handled different) ... do you see allowed or blocked packets within logviewer?

    - try to ping NAS & Printer ... something within logviewer?

    - please show us the VLAN's behind Port1


    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • Yes I do have VLANS and they are defined under Port 1 as xg-andy mentioned

  • caption of VLANs has been attached. 

    Yes i am able to access Internet from all VLANs, there is no issue. I was using these VLANs and users were accessing Internet from May 2021. 

    When do a ping or tracert to NAS via 2 different VLANs they dont get logged in the logviewer. 

    Accessing of the NAS is not web based (not HTTP). I use the \\NASipaddress\ to access it. 

    PING to the NAS IP address fails. 

    Hope the above helps to clear some doubts at your end

  • Can you ping the nas from its network?

    XG115W - v20.0.1 MR-1 - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • Yes I can PING the NAS from the VLAN where it is located. Then i can PING and TRACER the gateway IP of the VLAN where NAS is located from any other VLANs. But the PING or TRACERT to the NAS from other VLANs fails.

  • So what happens when you try to access other devices on the NAS VLAN?


    XG115W - v20.0.1 MR-1 - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • The other device on this VLAN is the printer. It is using TCP/IP port configuration, hence printing can be done without any issues.  

  • Okay, what is the nas using, sounds like it has a firewall enabled blocking incoming traffic on specific ports?


    XG115W - v20.0.1 MR-1 - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • Hello UJay,

    I do not understand your rules - especially the first one 40 to LAN. 

    However here some things you might try/correct:

    - Can you look on the CLI for dropped packets? Can you look in the logs for dropped packets. Create an explicit deny with all zones (not any) and switch on logging on the end of the rules.

    - There should be no nat between VLAN 1,2,3,4.You problably need to do NAT to access the internet.

    - Is there only one computer within the VLANs 10,20,30? Are you able to ping the devices within the individual VLANs (if there is only one you might consider to add a second device?

    - The switch might also be the reason for this behavior. In the configuration described here and in the answers it should leverage only layer 2 functionality ...

    - Are your devices answering to pings at all? Switch off the firewall / antivirus on the windows 10 computer and try again.


  • Hi Ian

    After deleting and recreating the VLAN and Rule, i am now able to access the NAS by using the UNC path. I am not sure what was the issue which prevent access from the previous arrangements. 

    The firewall rule is same as screenshot displaying 40toLAN where Source LAN, ANY and then Destination LAN with ANY. As soon as I change ANY to specific VLANs, then i am unable to communicate with the NAS. 

    I don't want some VLANs to access NAS, hence need to find a way to prevent such VLANs accessing NAS. How do i achieve that?