Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

RED tunnel - software v.s. hardware

Hi,

I tested Sophos XG Home and also XG trial (client and server both software VMs), but with both RED tunnel dont work. No L2, no VLANS, only L3.

I have also hardware XG86. When I use XG86 as server and XG Home (software) as client, all works - L2 and VLAN-s.

So, seems for RED I cant use software version, only hardware. Is this officially declared by Sophos? I dont see information about. I tested many days this to find out

But how when I put for RED server UTM? And client XG Home? Can UTM software server works with XG software client?

I cant use client as UTM.



Added TAGs
[edited by: emmosophos at 10:40 PM (GMT -7) on 3 Jun 2022]
[locked by: FloSupport at 10:56 PM (GMT -7) on 6 Jun 2022]
  • Hello ,

    Thank you for reaching out to the community: 

    • Firewall RED Server: Connects to a UTM using 9.700 or later.
    • Firewall RED Client: Connects to a UTM using 9.700 or later.
    • Firewall RED Server Legacy: Connects to a UTM using versions earlier than 9.700.
    • Firewall RED Client Legacy: Connects to a UTM using versions earlier than 9.700.

    Thanks & Regards,
    _______________________________________________________________

    Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

    Log a Support Case | Sophos Service Guide
    Best Practices – Support Case  | Security Advisories 
    Compare Sophos next-gen Firewall | Fortune Favors the prepared
    Sophos Community | Product Documentation | Sophos Techvids | SMS
    If a post solves your question please use the 'Verify Answer' button.

  • Using a RED Site to Site Tunnel will cause problems, if you use a static route with gateway routes. 

    Did you generate any kind of routes or is your entire routing based on the VLANs, which are extended by the bridge? 

    In general, the RED protocol works the same on hardware and software. But you created a bridge, correct? 

    __________________________________________________________________________________________________________________

  • Please learn what is layer 2. RED is pure L2 tunnel. There is no needed any routing, any IP. Only you need bridge RED interface to physical interface and allow traffic by firewall.  The result is just like you have put very long RJ45 cat cable between devices. It can be managed in switches level, without any IP or routing. You can use VLANs. VLANs also go through tunnel, only you need make VLAN interface both in tunnel and physical nic side and then bridge them, as without it sophos device accepts only untaged traffic..

  • I perfectly understand what you mean and it is working. I tested it recently with this setup. 

    But i am once again not able to understand, what you mean by hardware/software red. 

    RED is a protocol. It is based on SSLVPN, but in the end it is a TLS based tunnel, like SSLVPN. 

    And you can do this perfectly fine. The only issue could be generated by the MAC using of the bridge. Because generally speaking the mac of the logical bridge can be the same on both appliances. You can check the mac addresses of br0 on a SFOS appliance and then check the same br0 interface on the other appliance and verify, they differ. If not, this will likely cause your problem, as duplicated MACs in a extended network will cause problems. 

    __________________________________________________________________________________________________________________

  • You dont need MAC addresses in L2 bridge. You can use bridge without IP. By software I mean Sophos installers for vmware, hyper-v or physical computer. By hardware I mean physical firewall box. And L2 RED tunnel works only between hardware server box and hardware/software client. Between software server and software client I cant put L2 RED working. Have you tested this?

  • Yes. And it works fine. 

    But a bridge has a mac address. I needs to have one. 

    SFV6C8_AZ01_SFOS 19.0.0 GA-Build317# ifconfig Test
    Test Link encap:Ethernet HWaddr 00:0D:3A:22:81:B5
    inet6 addr: fe80::20d:3aff:fe22:81b5/64 Scope:Link

    Otherwise there should not be any difference between those setups. Maybe your hypervisor causes some issues? 

    I tested this scenario in the past couple of times and now people running this in public cloud setups. 

    Do you have any tcpdumps and conntracks of those connections? 

    __________________________________________________________________________________________________________________

  • You are wrong - you dont need MAC address in bridge. How you can say there is no difference if you even havent tested L2 RED. I ask once more - have you tested L2 RED? And there is no MAC addresses. Do you at all know what is layer 2, what is osi model, what is remote ethernet? I see you have no idea about those thing, because you continually talk about MAC addresses. MAC addresses are in my devices, not in bridge, behing RED, both sides in my networks. My devices made arp requests and get MAC address of interested ip.The RED devices are transparent. They only passthrough arp requests. Have you tested VLAN-s? VLANs are the most important part.

  • I cannot help you anymore further, if you do not provide the proof of tcpdumps and conntracks (maybe droppacketcaptures). Otherwise we cannot comment on this situation anymore. 

    __________________________________________________________________________________________________________________

  • I ask once more - have you tested it? Do VLAN-s work?

  • Hello Ivar,

    this is a voluntary community help forum here. That said, I ask why you are so rude to LuCar Toni?

    He is just asking for some info to help you out. But you try to teach him things, he really knows already. (Have a look at his forum-points 53413, this should tell you something...)

    Maybe you are open to discuss your problem:

    Ethernet Bridging - VLANs

    Ethernet bridges enable hosts to communicate through layer 2 by connecting all of the physical and logical interfaces in the system into a single layer 2 domain. The bridge is a logical interface with a MAC address and an MTU (maximum transmission unit). The bridge MTU is the minimum MTU among all its members. By default, the bridge’s MAC address is the MAC address of the first port in the bridge-ports list.

    This is how a linux kernel doas bridging.

    Example:

    https://tldp.org/HOWTO/Ethernet-Bridge-netfilter-HOWTO-4.html#ss4.4

    Of course is a MAC-address assigned to your bridge, this is normally the same address as your first w port.

    If using SW-type of firewall installer, this could be by chance the SAME MAC for both ends of the RED tunnel.

    This could cause problems and that's what Lucar Toni wanted to verify with your help.

    HTH.

    Mit freundlichem Gruß, best regards from Germany,

    Philipp Rusch

    New Vision GmbH, Germany
    Sophos Silver-Partner

    If a post solves your question please use the 'Verify Answer' button.