This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos SD-RED 20 and VLANs

Hello, I have the following scenario, I need to transport some VLANs that are on my core switch L3, behind the RED (Appliance), I have already tried to put the Firewall interface marked with the VLANs that I need, in Sophos I grouped the VLANs in a bridge, station behind RED gets ip from guest VLAN but does not browse.

I know it's not a good practice, but I need the Hotspot of my guest network, also in the branches.



This thread was automatically locked due to age.
  • What do you mean exactly by „doesn‘t browse“?

    Mit freundlichem Gruß, best regards from Germany,

    Philipp Rusch

    New Vision GmbH, Germany
    Sophos Silver-Partner

    If a post solves your question please use the 'Verify Answer' button.

  • SD-RED20 is not VLAN aware.
    Possibly the RED ignores the VLAN-tags and just transmits everything.. including the VLAN-tags.
    But i think it is not official supported. (even if it worked with RED15)
    Next, you should check at the branch-switch, if VLAN-packets arrive the switch (VLAN/Port statistics or a packet capture).
    If this is working, the client should get an IP or be able to ping the gateway.


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • The station obtains an IP address from DHCP, pings the gateway but does not ping the internet.

  • Yes, I understand that SD-RED 20 ignores the VLANs tags and just broadcasts everything, I put a Switch behind the RED and put the port as Tagged, my station receives an IP address from DHCP, I can ping the gateway, but not ping the Internet.

  • ok, try to ping the internet and take a look to the log-viewer.
    if you enable "logging" within your firewall-rules, you should see something.
    Unfortunately, the last "default drop" rule doesn't log. (i build a "drop and log" rule by myself)

    I think there is missing a firewall-rule or a NAT (Masquerade) rule.


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • This kind of design can work in smaller setups, but is not recommended for larger setups (Multiple REDs).

    You need to bridge the LAN port with the RED. Then place the VLANs as you want on this bridge. 

    You need to have Standard/Unified on RED to get this working. 

    __________________________________________________________________________________________________________________

  • But if I put the XG port that is connected to my core, in a Bridge with RED, I will lose the other VLANs that are configured there.

  • You can place as many VLANs on the bridge as you want. 

    __________________________________________________________________________________________________________________

  • Okay, I'll need to put two REDs in different locations, would it work the way you said?

  • Yeah, 2 RED should not cause much issues. If you scale this scenario up to multiple locations, this can get complex and a bridge with so many network interfaces is not recommended. 

    __________________________________________________________________________________________________________________