Sophos UTM: Decommissioning of obsolete URL categorization services CFFS. Click here for important info.

Multiple VLAN on each port

On XGS series firewall, how to assign multiple VLANs  on each port (port 1-8), such that each port has a native VLAN, and some allowed VLANs.

e.g.:

  • port 1, native VLAN 1, allowed VLAN 2,3,4
  • port 2, native VLAN 2, allowed VLAN 4,5,6
  • port 3, native VLAN 3, allowed VLAN 1,3,5

Thanks!



Added tags
[edited by: Raphael Alganes at 2:59 AM (GMT -7) on 18 Sep 2023]
Parents
  • Hi,

    the native VLAN is always 1 and you don’t address it as a VLAN.

    ian

    you can have up to 1023 VLANs per port.

    XG115W - v20 EAP 1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • >the native VLAN is always 1 and you don’t address it as a VLAN.

    Understood. But since each interface must have unique IP, how is native VLAN is defined?

    e.g.: switch 1 connects to firewall port 1; switch 2 connects to firewall port 2

    Firewall port 1: 10.10.1.1

    Firewall port 2: 10.10.2.1

    What are native VLANs for switch 1 and 2 respectively?

    Shall I use 10.10.1.1 /27 for port 1 and 10.10.1.33 /27 for port 2?

  • You will have to create a Bridge between all 3 Ports and then place the VLANs on the bridge. 

    Then you wont have the "Permitted" Stuff on a Port Level but generally speaking this wll work. 

    __________________________________________________________________________________________________________________

  • You don't need to provide an address for the native VLAN unless you are using that for traffic, this asumes you are setting up L2 type VLANs?

    Ian

    XG115W - v20 EAP 1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • I don't want to bridge ports.

    It appears Sophos doesn't support many-to-many interface-VLAN mapping. In Sophos, one interface can have multiple VLANs, but one VLAN can only exist on one interface.Is this about true?

    For example:

    • VLAN 10 and VLAN 20 can exist on port 1 (a physical interface).
    • VLAN 10 and VLAN 20 cannot exist on both port 1 and port 2.
    • In order to make VLAN 10 and VLAN 20 work on physical port 1 and 2, I must create a virtual bridge interface, and bridge port 1 and port 2 together
    • After bridging port 1 and 2, VLAN 10 and 20 exist on the bridge interface, and only exist on this newly created bridge interface
  • I am trying to understand your issue.

    You can have vlan 20 on three different interfaces eg 1.20, 2.20, 3.20 and they can be connected via a firewall rule eg source LAN, vlan1.20, destination LAN, VLAN2.20, allow all for traffic to flow from VLAN1.20 to VLAN2.20. Each VLAN is unique because it has a different P address range assigned to it.

    The only issue would be if you connected 1.20 and 2.20, etc to the same switch.

    Ian

    XG115W - v20 EAP 1 - Home

    If a post solves your question please use the 'Verify Answer' button.

Reply
  • I am trying to understand your issue.

    You can have vlan 20 on three different interfaces eg 1.20, 2.20, 3.20 and they can be connected via a firewall rule eg source LAN, vlan1.20, destination LAN, VLAN2.20, allow all for traffic to flow from VLAN1.20 to VLAN2.20. Each VLAN is unique because it has a different P address range assigned to it.

    The only issue would be if you connected 1.20 and 2.20, etc to the same switch.

    Ian

    XG115W - v20 EAP 1 - Home

    If a post solves your question please use the 'Verify Answer' button.

Children
No Data