Set an indipendent second WAN interface

Just remove the „Gateway“ setting from this uplink. 

Hello PhilippRusch ,

thank you for your answer. What do you mean? Once I setup the WAN interface, I cannot remove the gateway.

Hello Leonardo,

you need to define the network you want to route to, not the host.

Then you need to define the route to the 10.10.210.0 /24 network ON THE OTHER SIDE. The remote site has to knw how to reach the 210 net.

Good morning Kevin, Philipp,

thank you. After clicking on the "Save" button, the setting automatically translates the host IP in a Network IP. So, this is not the problem.

 PhilippRusch as from the screenshots I defined both of the routes. From VLAN to MPLS and from MPLS to VLAN.Is there something wrong about it?

The second screenshot is from the other firewall system at the remote site?

Hello PhilippRusch 

VLAN and MPLS are on the same site. Sorry for missing this information.

The MPLS router is connected to the Port4 and the switch in which the VLAN is tagged to the port 6. The VLAN is configured from port 37 to port 48 of the switch and it is defined in the Unifi Dream Machine Pro networks as a "third-party gateway" with VID 210. 

For this reason, I binded a VLAN interface to Port6 with VID 210. Is the setup clear now or you need further information?

Hi, reading back I don't quite get your setup. You have 2 ports (port 4 and port 6.210). You only have 1 MPLS router on port 4. Where is port 4 connected?
Is it connected directly to the MPLS router or is there a switch in between? If there is a switch in between and it's port is a tagged port, then you should also have a tagged (VLAN) port on the Sophos side.

Perhaps you could create a little drawing of your network topology because I don't quite see yet why you have two interfaces in the firewall that both have to do something for your MPLS network.

Hello apijnappels ,

thank you for your answer.

The MPLS router is directly connected to the Port4 of the firewall. There is no switch in the middle. To the Port6 of the firewall, there is a switch that has the VLAN 210 tagged from port 37 to port 48 of the switch. On these ports there are our ESXi host connected. What I want is to let some Virtual Machines reach the MPLS router. 

As a workaround, what I am currently doing is to keep the MPLS router directly connected to the switch bypassing the firewall. But this is not a good setup neither from a security point of view nor from a logging point of view.

If the setup is still not clear, I will prepare a short schema for you.

Thank you for your support!

Leonardo

First guess, your VLAN210 subnet should have a route to the "other side" of the MPLS tunnel but the other side of the MPLS tunnels should also have a route back to your VLAN210 subnet otherwise the return traffic will never reach you.

Please add ip-ranges to the schema if possible.

Hello apijnappels ,

here you are a quick drawing:

Thank you!

Leonardo

That is a lot clearer now. What is the gw on 10.10.200.1 ?

That is a lot clearer now. What is the gw on 10.10.200.1 ?

Hello PhilippRusch ,

unluckily that router is a CPE and it is not managed from me but from my supplier. That's the problem.

Hi LeonardoM,

as PhillipppRusch said, routing to local networks behind your firewall (from the perspective of the MPLS router) has to be done on the MPLS-router - unless your firewalls IP (10.10.200.2) in that network is not the default gateway for it - what I don't think.

Hello kerobra ,

I will get in touch with my supplier in order to understand the current addressing and for adding a static route through 10.10.200.2/24, that is the IP of the Port4 to which the router is connected through.

Then, I think that a firewalling rule should be enough without creating other static routes on the XGS for going from the VLAN zone to the MPLS zone and backward. Am I right?

Then this won't work, if the router has a different gateway than 10.10.200.2.

You only have to create static routes for networks that your own firewall doesn't know how to reach.

A default gateway on a WAN interface means a static route for 0.0.0.0/0 (any) to the IP address of your ISP's router/network. Which will mean your firewall will send traffic to other networks than locally known (assigned to a local interface) to that gateway. Your ISP kwows nothing about a 10.x.x.x network, since it is a non-routable, private network address.

In cases where you have a network somehow connected over another way/router - lets say a network 10.0.0.0/24 is located behind that MPLS router (from your firewall's perspective) - then you will have to create a static route for 10.0.0.0/24 to the IP you know, in this case 10.10.200.1.

The other side (MPLS router) only knows your firewalls IP in the network both devices share (10.10.200.0/24). The clean way is routing all traffic to your local networks to your firewalls IP in that network. If your supplier refuses to add routes another way could be, that you use NAT for the traffic that passes to the MPLS router, SNATing (masquerading) it to your firewalls IP in that network (10.10.200.2/24). But in this case I would try to find another supplier.

A problem I see is your VLAN. You can't use the same IP range for your physical and your virtual interface.

If the traffic reaches the firewall untagged (without a VLAN ID) just use Port6. If the traffic reaches your firewall with a VLAN TAG of 210 then only use Port6.210 and give Port6 a dummy IP address like 10.11.12.13/30.

Hello Kevin,

thank you for your really useful explanation. I will get in touch with my supplier on Monday, I am pretty sure that there will not be any problem in adding a route.

Thank you all for your precious support!

Best regards,

Leonardo

Hello kerobra ,

I spoke with my supplier and they promptly created the static route through 10.10.200.2/24. Now, I can reach the MPLS router. However, I cannot reach any resource behind it as they need to announce my 10.10.210.0/24 to their devices/networks.

Now, regarding the VLAN 210: on the UDMP, as already said, I created this VLAN and assigned it to the ports 37 to 48 of the L3 switch:

Then, I created a VLAN interface to the Port6 of the firewall (Port6.210) and assigned a dummy IP to the Port6. However, seems like the traffic doesn't get forwarded with the VID as it does not go through the VLAN interface of the firewall. If I configure the firewall interface as a normal interface, the traffic goes through it and can reach the MPLS router. The firewall rule is configured with network objects and not with ports and, of course, the static route is configured. This is a bit odd.

Another question is: I have a secondary site (let's say with the subnet 172.16.1.0/24) that is linked to the primary site through a VPN S2S IPsec. I would like to let the secondary site reach the MPLS router as well. This MPLS router, I did not say it before, gives access to DRaaS and BaaS resources. According to your experience, what is the best way to achieve it? Through DNAT?

If you want your secondary site to reach networks behind the MPLs it's nearly the same but it depends a bit on what technique is used (policy based VPN or route-based VPN with traffic-selector or any-any tunnel) and what device is on the secondary site.
Do you have more information on that?

Regarding your VLANs. Do you have to use VLAN tags on your end-devices to reach each-other or do you only have to connect them to the correct switchport to do so?

If you do not have to edit the VLAN tag on the end devices your switch is using port-based VLANs, meaning your VLAN tag of 210 is directly assigned to the specific ports. Traffic that enters the switch has to be "untagged", without a VLAN tag and traffic that leaves the switch through a port is "untagged" again. In this case you do not have to use a VLAN-Interface on the firewall. Simpy connect a cable to a configured vlan-port of the switch, give the firewall the IP 10.10.210.1 on that port (6 in your overview), delete the vlan interface on the firewall and you are fine.

A VLAN interface on the firewall is needed if you have 1 cable to a switch but you want to serve more than 1 network over that cable. In this case the physical adapter gets one network, and each VLAN adapter gets another network. On the switch that has to be devided by VLAN-tagging.There are different namings with VLAN, I don't know how Ubiquity is doing it. Some vendors call interfaces with more than 1 vlan "trunk interfaces", others use wordings like "untagged" and "tagged", others use wordings like "access", "trunk native", "trunk allowed".

In addition to kerobra about the VLAN issue you are experiencing:

If you use a VLAN interface in the firewall, then this interface needs to be connected to a switchport that has the same VLAN tagged (usually a trunk). If the switchport is an access port in the desired VLAN then you cannot use a VLAN interface in the firewall since it sends the VLAN tag.

Same thing as kerobra already said, but explained differently.

Thank you kerobra and apijnappels ,

everyhing clear. The problem is that Ubiquiti is not really clear when it comes to configuring VLANs. Since I configured the VLAN to be managed from a third-party gateway (and, for this reason, managed from the firewall VLAN interface), I could just assign the VID that, of course, is the same on the firewall VLAN interface.

So, if I got it right, for letting it work I have to set the VLAN ID to the vSwitch, in vSphere, that is managing the VLAN network object and the VMs assigned to it for working with tags. Actually I am working with a simple access port as I did not set the VID on the vSwitch level.

Regarding kerobra 's question, I set a policy based VPN with any to any tunnel.