Sophos XG in bridge mode with vlans

Question

I'm running Peplink router with 2 POE APs, multiple SSIDs and Vlans. 
 
 Deployed Sophos XG in bridge mode between the Peplink router, and POE switch. WAN/LAN connections from the Sophos are both connected to trunk ports (any vlan). 
 My bridge interface is configured like the following:

Firewall rules: 
 
 Linked to Nat rule #2:

Sophos Central no issue seeing and connecting to the firewall... 
 At first, my wifi devices were working, but then noticed appletvs with no connection and some wifi devices getting disconnected. 
 Noticed AppleTv traffic blocked in FW incoming ... 
 
 Any tips or advice?

rfcat_vk · Accepted Answer

Hi, 
 linked NAT rules are usually only required if you have multiple gateways and using SD-WAN features. 
 Most apple applications need to have no web proxy or DPI functions attached to them. All my Apple applications etc come through a rule that does not use the web proxy, I havre application and IPS rules. Initially you will need to allow all services to your apple devices while, you workout which ports are actually required, then tighten your access rules to limit access to those ports for your apple devices. 
 Ian

Sophos XG in bridge mode with vlans

Top Replies