This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Bridged Mode with VLANs

Hi,

I have been struggling to get transparent birding to work with VLANS properly.

I have two ports bridged, one as LAN and one as WAN in bridge mode. VLAN 1, which is native seems to be working ok. I have another TAGGED vlan, vlan 3, which kind of work. Things like netflix fast.com for example just doesn't work, and other IoT devices.

in the bridge config under Network on the Firewall, I have the IP/gateway in there for VLAN 1.

Am I supposed to create a VLAN interface as well? wouldn't VLAN 3 traffic just pass through the bridge?

Logs show a lot of "Could not associate packet to any connection." for VLAN 3 clients, even ones that go from VLAN3 to VLAN 3 but aross the bridge.

If you can help of guide me, please let me know. been at this for long time.

This thread was automatically locked due to age.

0 Shadi Shalabi over 2 years ago

Here is a message I get traffic from 192.168.3.207 (on LAN side of bridge) to 192.168.3.153 (on WAN side of bridge)

messageid="01001" log_type="Firewall" log_component="Invalid Traffic" log_subtype="Denied" status="Deny" con_duration="0" fw_rule_id="N/A" nat_rule_id="0" policy_type="0" user="" user_group="" web_policy_id="0" ips_policy_id="0" appfilter_policy_id="0" app_name="" app_risk="0" app_technology="" app_category="" vlan_id="" ether_type="IPv4 (0x0800)" bridge_name="" bridge_display_name="" in_interface="Port1" in_display_interface="Port1" out_interface="" out_display_interface="" src_mac="" dst_mac="" src_ip="192.168.3.153" src_country="R1" dst_ip="192.168.3.209" dst_country="R1" protocol="TCP" src_port="443" dst_port="37716" packets_sent="0" packets_received="0" bytes_sent="0" bytes_received="0" src_trans_ip="" src_trans_port="0" dst_trans_ip="" dst_trans_port="0" src_zone_type="" src_zone="" dst_zone_type="" dst_zone="" con_direction="" con_id="" virt_con_id="" hb_status="No Heartbeat" message="Could not associate packet to any connection." appresolvedby="Signature" app_is_cloud="0"

Any indication of why it gets blocked?
Cancel
Vote Up 0 Vote Down

Cancel
0 Shadi Shalabi over 2 years ago in reply to Shadi Shalabi

I looked at the post:

https://community.sophos.com/sophos-xg-firewall/f/discussions/89867/sophos-xg-bridge-mode-in-multi-vlan-enviroment

tried to disabled acceleration mode, but that didn't improve.. maybe I need to reboot?
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 2 years ago

Hi,

which version of XG software are you using?

Ian

XG115W - v20.0.3 MR-3 - on holiday

XGS118 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Shadi Shalabi over 2 years ago in reply to rfcat_vk

Am on SFVH (SFOS 18.5.3 MR-3-Build408)

My config

I also notice 192.168.1.8, the brige IP is sometimes pingable, sometimes not! I have to manage firewall through sophos central.
Cancel
Vote Up 0 Vote Down

Cancel
0 Shadi Shalabi over 2 years ago in reply to Shadi Shalabi

Also, not sure why it shows bridge as red:
Cancel
Vote Up 0 Vote Down

Cancel