Network switch configure for Sophos HA

Hello Stuart James ,

Thank you for reaching out to the community, the following article might help - https://support.sophos.com/support/s/article/KB-000037178?language=en_US

No, not really. That's talking about a LAG on the Sophos unit, my question is about the configuration of the network switches the Sophos LAG is connected to.

For a LAN Interface or dedicated HA Interface Stuart James ?

LAN interface

Hi,

in my setup I use 2x XG210 (HA - active / passive) and 2x Aruba (in stack).

On the XG I use 2 ports in LAG for the uplink (1 cable down to each switch), on the switches I configured the ports as trunks (2 trunks with 2 ports on each switch).

In my case 1 XG and 1 Switch can fail at the same time.

Yep, that's how I have mine configured as well.

Wondered if others had a dumb switch with Sophos taking care of comms. Appears to be the Sophos way given they've recommended STP turned off.

Just curious: why would someone use a "dumb" (if you mean unmanaged with dumb) switch on an enterprise-grade setup (HA)? The way the Sophos is used in this scenario means you have some critical infrastructure in use so an "normal / dumb" switch should not be used.

You could look into this and apply it to your switch: docs.sophos.com/.../index.html

Bad choice of words. I meant an unconfigured Port in VLAN 1 (no trunk), which, looking at the link LuCar just posted is how Sophos is recommending the setup, which explains the disabling of STP

Interesting. So instead of creating a LAG (trunk) which combines port 13 on both CS210 switches in to one, same as the Sophos LAG, Sophos recommends leaving them as individual ports and disabling STP. Is there a reason behind this alternative configuration?