Newbie to Sophos needs a little help

For clarity, which SFOS are you on?

I've never used the Sophos in bridge mode, so can't say anything definitively. That said, my first thought is that you may need to create VLANs in the Sophos in order for it to consider them something it cares about -- even though you're not routing. No clue if that matters, but it might be worth a try.

Bridged interfaces allow you to filter VLANs, which I assume you aren't doing. And I'd say there's always the possibility that something like a bug with LAG'd ports that don't allow certain things.

Hi Wayne

SFOS 18.5.2 MR-2

Yeah i did try adding them to the bridge, but it caused all sorts of problems with devices getting DHCP in the correct ranges 169.254.x.x. In the current setup the VLANs are being passed through ok to the router and back again.

I've tried filtered VLANs on/off on the bridge-pair with all their IDs (currently its OFF) but no joy.

I might try again and disable the LAGs.

Thanks

Piers

Hi Piers,

I'd recommend you abandon LAGs at first, then use no bridging at all and try to seperate the nets. Personally I would use a transfer-net and normal routing.

Hi Philipp, thanks i will try that.

Not sure i understand what you mean by a transfer net? or separating the nets as they are all managed by the router each for different purposes.

Hello,

I would use the Sophos Firewall as the central point to manage the networks. The router is only a measure to reach out to the ISP.

Thanks Philipp.

Not really a realistic option at present. I picked Sophos in bridge mode so that it could be placed easily inline within the existing setup.

I tried removing the lags and it didn't make any difference, the firewall was still only accessible from the WAN side.

Without bridging it seems to cause all sorts of issues passing the traffic through, bridging was the only way i could get it to work seamlessly.

OK, last try: with bridging you always have ALL traffic passing thriough the Sophos. This is your bottleneck.

With routing (and this is the main advantage of routing) you only have fractions of traffic going from source interface to target interface.

Besides, you have much easier control about security between these segments.

I get what you're saying regarding ease of management and bottlenecks and will consider it, there's always plenty of room to improve

The initial plan was to get everything to pass through the Sophos at least on 2Gbps lag between the VLANs but on the core VLAN there's a 10GBe pipe via the core switch to the other switches behind the FW.

The main router manages more than just the internet, it manages all the AP's (same brand), the mesh, wifi as wan and routing/encryption to/from a AWS instances via different isps. Site to site vpns and all the remote access. It works beautifully and it would be an upheaval to change it all when it works so well.

I was hoping that i could manage the FW LAN side within the current setup.

I get what you're saying regarding ease of management and bottlenecks and will consider it, there's always plenty of room to improve

The initial plan was to get everything to pass through the Sophos at least on 2Gbps lag between the VLANs but on the core VLAN there's a 10GBe pipe via the core switch to the other switches behind the FW.

The main router manages more than just the internet, it manages all the AP's (same brand), the mesh, wifi as wan and routing/encryption to/from a AWS instances via different isps. Site to site vpns and all the remote access. It works beautifully and it would be an upheaval to change it all when it works so well.

I was hoping that i could manage the FW LAN side within the current setup.