Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Set an indipendent second WAN interface

Good morning,

I have two clusters of XGS 2100 in HA (Active-Passive) running with the firmware version 19.5.3 MR-3-Build652. This is my current setup in both of the clusters: 

WAN1 (ISP) > Port2

LAN > PortF1

HA > PortF2 - PortF2

As per object, in one of them, I need to set an indipendent second WAN interface (WAN2) for connecting a MPLS router that will be reachable only from a VLAN. This operation is quite simple and I made it from Network > Add Interface. I set the IP information, the WAN zone and the port.

The desired setup would be:

WAN2 (MPLS with NO Internet access) > Port4

VLAN > Port6

However, after I enable the port and I plug the cable in, that will connect the MPLS router to the Port4 of the firewall, the Load Balancing (that I don't need) starts to work and most ot my users lose the Internet access (WAN1). Even configuring the weights, for each gateway, from the WAN link manager, is not helping at all.

Furthermore, I tried to set my firewalling rules so part of the traffic gets forwarded to the WAN1 (I selected WAN from the Destination zones and Port2 from the Destination networks) and some to the WAN2 (I selected WAN from the Destination zones and Port4 from the Destination networks) but it is not working at all.

Do you have any suggestions or any idea on why this setup is not working? Please let me know if you need further information, I have been vague just to explain the main issue.

As a temporary workaround, I just created a VLAN on the switch, and on the XGS cluster, and connected the MPLS router directly to the tagged switch port. Of course, this is not sustainable and this is not the setup I want.

Thank you and have a nice day!

Best regards.



This thread was automatically locked due to age.
Parents Reply
  • Hello  

    VLAN and MPLS are on the same site. Sorry for missing this information.

    The MPLS router is connected to the Port4 and the switch in which the VLAN is tagged to the port 6. The VLAN is configured from port 37 to port 48 of the switch and it is defined in the Unifi Dream Machine Pro networks as a "third-party gateway" with VID 210. 

    For this reason, I binded a VLAN interface to Port6 with VID 210. Is the setup clear now or you need further information?

Children
  • Hi, reading back I don't quite get your setup. You have 2 ports (port 4 and port 6.210). You only have 1 MPLS router on port 4. Where is port 4 connected?
    Is it connected directly to the MPLS router or is there a switch in between? If there is a switch in between and it's port is a tagged port, then you should also have a tagged (VLAN) port on the Sophos side.

    Perhaps you could create a little drawing of your network topology because I don't quite see yet why you have two interfaces in the firewall that both have to do something for your MPLS network.


    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • Hello  ,

    thank you for your answer.

    The MPLS router is directly connected to the Port4 of the firewall. There is no switch in the middle. To the Port6 of the firewall, there is a switch that has the VLAN 210 tagged from port 37 to port 48 of the switch. On these ports there are our ESXi host connected. What I want is to let some Virtual Machines reach the MPLS router. 

    As a workaround, what I am currently doing is to keep the MPLS router directly connected to the switch bypassing the firewall. But this is not a good setup neither from a security point of view nor from a logging point of view.

    If the setup is still not clear, I will prepare a short schema for you.

    Thank you for your support!

    Leonardo

  • First guess, your VLAN210 subnet should have a route to the "other side" of the MPLS tunnel but the other side of the MPLS tunnels should also have a route back to your VLAN210 subnet otherwise the return traffic will never reach you.

    Please add ip-ranges to the schema if possible.


    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • Hello  ,

    here you are a quick drawing:

    Thank you!

    Leonardo

  • That is a lot clearer now. What is the gw on 10.10.200.1 ?

    Mit freundlichem Gruß, best regards from Germany,

    Philipp Rusch

    New Vision GmbH, Germany
    Sophos Silver-Partner

    If a post solves your question please use the 'Verify Answer' button.

  • Hello  ,

    unluckily that router is a CPE and it is not managed from me but from my supplier. That's the problem.

  • Hi LeonardoM,

    as PhillipppRusch said, routing to local networks behind your firewall (from the perspective of the MPLS router) has to be done on the MPLS-router - unless your firewalls IP (10.10.200.2) in that network is not the default gateway for it - what I don't think.

    Regards,

    Kevin

    Sophos CE/CA (XG, UTM, Central Endpoint)
    Gold Partner

  • Hello  ,

    I will get in touch with my supplier in order to understand the current addressing and for adding a static route through 10.10.200.2/24, that is the IP of the Port4 to which the router is connected through.

    Then, I think that a firewalling rule should be enough without creating other static routes on the XGS for going from the VLAN zone to the MPLS zone and backward. Am I right?

  • Then this won't work, if the router has a different gateway than 10.10.200.2.

    Mit freundlichem Gruß, best regards from Germany,

    Philipp Rusch

    New Vision GmbH, Germany
    Sophos Silver-Partner

    If a post solves your question please use the 'Verify Answer' button.

  • You only have to create static routes for networks that your own firewall doesn't know how to reach.

    A default gateway on a WAN interface means a static route for 0.0.0.0/0 (any) to the IP address of your ISP's router/network. Which will mean your firewall will send traffic to other networks than locally known (assigned to a local interface) to that gateway. Your ISP kwows nothing about a 10.x.x.x network, since it is a non-routable, private network address.

    In cases where you have a network somehow connected over another way/router - lets say a network 10.0.0.0/24 is located behind that MPLS router (from your firewall's perspective) - then you will have to create a static route for 10.0.0.0/24 to the IP you know, in this case 10.10.200.1.

    The other side (MPLS router) only knows your firewalls IP in the network both devices share (10.10.200.0/24). The clean way is routing all traffic to your local networks to your firewalls IP in that network. If your supplier refuses to add routes another way could be, that you use NAT for the traffic that passes to the MPLS router, SNATing (masquerading) it to your firewalls IP in that network (10.10.200.2/24). But in this case I would try to find another supplier.

    A problem I see is your VLAN. You can't use the same IP range for your physical and your virtual interface.

    If the traffic reaches the firewall untagged (without a VLAN ID) just use Port6. If the traffic reaches your firewall with a VLAN TAG of 210 then only use Port6.210 and give Port6 a dummy IP address like 10.11.12.13/30.

    Regards,

    Kevin

    Sophos CE/CA (XG, UTM, Central Endpoint)
    Gold Partner