Sophos UTM: Decommissioning of obsolete URL categorization services CFFS. Click here for important info.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 21 replies
  • Answers 3 answers
  • Subscribers 35 subscribers
  • Views 5086 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Clients don't receive an IP address from DHCP on newly created VLAN

dsurfer

Hi! I just created a new VLAN and DHCP server with firewall rule and clients are not able to get an IP address. My goal is to have my guest WIFI network (and if I can get this working, my IoT network) on a separate VLAN. I've restarted my switch, firewall, and DHCP server, removed and re-created everything a few times but no joy.

My newly created VLAN interface:

My new network IP host:

My newly created DHCP server on the firewall for the new VLAN:

The new firewall rule to allow traffic from the 192.168.200.0 network to the WAN (placed in top position):

I have a Unifi AP connected but have also tried a wired laptop to another dedicated VLAN port on the switch with the same results: can't get an IP address

Thanks for any help!



This thread was automatically locked due to age.
Parents
  • 0

    Please share a screenshot of your network topology (router/firewall, switches, clients / servers).
    Is the uplink from switch to firewall correctly tagged / untagged with the said VLAN?

    Also share informations with your interface settings - vlans, ips, ports on the firewall and switch.

    _______________________________________________________

    Sophos SG 210 with Sophos XG Home - 19.5 MR 2

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Thomas_XG

    I've also now removed the Datto switch from the equation, and put a different switch, a Dell switch at the front. I tagged the trunk/uplink port to the firewall and untagged port 2 as a VLAN access port for VLAN 200, and plugged my laptop in again, and still no IP address from DHCP.

Reply
  • 0 in reply to Thomas_XG

    I've also now removed the Datto switch from the equation, and put a different switch, a Dell switch at the front. I tagged the trunk/uplink port to the firewall and untagged port 2 as a VLAN access port for VLAN 200, and plugged my laptop in again, and still no IP address from DHCP.

Children
  • 0 in reply to dsurfer

    Can you share a screenshot from your interface configuration on the XG

    Did you configure Zones as well or just default LAN?

    _______________________________________________________

    Sophos SG 210 with Sophos XG Home - 19.5 MR 2

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to dsurfer

    The port needs VLAN 200 to be tagged on Switch and the XG needs the VLAN adapter for PortA with VLAN200. So far so good. If that is true, it should work.

    If the DHCP requests arrive at the Physical interface of the XG, not the VLAN, something with the VLANs in virtual infrastructure or switch is wrong. Is that a virtual firewall?

    Adding to my first answer: you don't need DHCP relay / helper if the XG has the DHCP Server enabled on the VLAN interface which should be true here.

  • 0 in reply to LHerzog

    The VLAN 200 is tagged on the uplink port on the switch to the XG. I've also hooked up another switch, a Dell switch, and I'm getting the same issue. I've also plugged in a laptop and untagged a port and the laptop doesn't get an IP either.

    Yes the XG is a virtual firewall. This is connected to the uplink port on the switch which is tagged VLAN 200.

    So just to test, and to remove switches from the equation, I also created another LAN interface on the firewall "LAN 2" and set up another VLAN 100 and plugged the laptop directly into the firewall bypassing the switch but no IP address. I figure for that to work, I have to somehow untag VLAN 100 on the NIC of the laptop. But when I go into the advanced properties of the NIC I'm not sure what to select, and there's no place to put in a VLAN ID (Default is the one highlighted:

  • 0 in reply to dsurfer

    nothing there. you need intel proSet adapter configuration tool.

    and then something like this (if VLAN1) is the default untagged and 200 is tagged.

  • 0 in reply to LHerzog

    So installed the Intel tool and set it up for the laptop NIC. It's at VLAN100 as I've plugged it directly into "LAN2" interface on the firewall which has a test VLAN100 interface tied to it. But still it didn't give me an IP. (LAN2 interface has been confirmed working with it's own DHCP server, and the laptop can get an IP from it, but just not when configured with the VLAN)

  • 0 in reply to dsurfer

    So I'm pretty sure it has to be related to the fact that my XG firewall is on a vm on a Hyper-V server. This thread, 3 years ago, addressed it (thread is locked now) virtual XG on Hyper-V - how to deal with VLANs - Discussions - Sophos Firewall - Sophos Community - I tried what they suggested and put the virtual NIC for the LAN into Trunk mode and set the "native VLAN" as 1 and the allowed VLAN list to whatever range I wanted, so I did 1-253.

    After doing this, there was still no VLAN traffic passing, and my internet went down, so I put it back to Untagged

  • 0 in reply to dsurfer

    So by doing more research, I set the "native VLAN" as 0 and then internet worked again. Still cannot get any VLAN traffic though!

  • 0 in reply to dsurfer

    After I put the LAN2 virtual Hyper-V NIC in trunk mode, the laptop got an IP from the VLAN 100 network and it can get out to the internet!

  • 0 in reply to dsurfer

    Great you found the solution and posted it here. It was obvious it was something with the VLAN settings in the virtual infrastructure.

  • 0 in reply to LHerzog

    Yes, to test to ensure that the firewall was working regarding VLANs, that did work for a computer that was connected directly to the 2nd LAN on the Sophos firewall without going through a switch. I had to use the Intel Proset software to configure the actual network adapter so that it was in access mode with the VLAN ID. However, I can't seem to find out why VLAN traffic, which passes from the firewall, doesn't reach or is not passed through any physical switch.

Unfiltered HTML