Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 16 replies
  • Answers 2 answers
  • Subscribers 41 subscribers
  • Views 4497 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to enable gateway on XGS 2100

Poddy

I have a small ICMS network to deploy. There are several VLANs involved. Devices in some VLANs are to be allowed talking to devices in other VLANs, but not all devices are allowed to talk to all other devices. 

I am expecting all routing to be done by the XGS 2100. 

This is my current bench setup. 

The 2 computers can ping each other. But neither can ping the GW. 

So, the config I have on the XGS 2100 unit so far: 

The Network section:

I have assigned the ip address of the F1 interface on the XGS unit to be 10.88.100.254. 

And this is where I can't seem to get it right, I tried it every which way, but the closest I got to having the Gateway up and running is with this setup:

I created a VLAN interface to participate, and assigned it an IP of the GW, 10.88.100.1, and also the VLAN interface has got the VLAN tag of 1100 enabled - I am guessing this allows the XGS unit to tag the traffic(?)

The Routing section: 

Under "Gateways" section, I created the Gateway, and that seems to be "up" and "running" 

And I assigned it the following settings: 

But I am obviously missing some fundamental piece of puzzle. 

Would anyone be able to give me a working example of the settings that are needed to have the XGS 2100 unit provide gateway services (among others) to the local networks? 

Some addtional information: 

I created the rules to basically alloow the traffic to flow: 

I am allowing the ping to be used in the custom zone that I created: 

I created a simple route for the 1 subnet I have to test it with, even though it shouldn't be required at this stage... 

I am starting to run out of ideas. If anyone could kindly throw some pointers my way, it would be greatly appreciated. Thank you in advance, 



This thread was automatically locked due to age.
Parents
  • 0

    Hi Tomas Podmaka,

    As per the snapshots, it seems we have a lot of things to discussed and check with your new setup.

    Thump rule we have to keep in mind that we cannot set up the same network on interfaces or VLANs.We have to configure the different networks to make it work.

    Once we fine-tune the configuration we then have to check traffic is reaching Sophos XG or not.

    For that, we can check with packet capture and tcpdump and drop the packet if any 

    Please refer to the below link for the same : 

    support.sophos.com/.../KB-000035761

    console>tcpdump 'host <ip address of the sophos firewall> and proto ICMP

    console>drop-packet-capture 'host <ip address of the sophos firewall> and proto ICMP

    If no traffic hitting on Sophos XG then we have to also check the configuration from switch end.

    "Sophos Partner: Networkkings Pvt Ltd".

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Bharat J

    This is helpful, thank you Bharat. The FW is not getting anything from the core switch; So I bypassed the core switch and connected a laptop directly to a F1 ports, and boom, the GW is alive and pingable. My next question is, how can I enable the 802.1q tagging on the F1 interface? 

Reply
  • 0 in reply to Bharat J

    This is helpful, thank you Bharat. The FW is not getting anything from the core switch; So I bypassed the core switch and connected a laptop directly to a F1 ports, and boom, the GW is alive and pingable. My next question is, how can I enable the 802.1q tagging on the F1 interface? 

Children
No Data
Unfiltered HTML