Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 37 replies
  • Answers 5 answers
  • Subscribers 42 subscribers
  • Views 15173 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Set an indipendent second WAN interface

LeonardoM

Good morning,

I have two clusters of XGS 2100 in HA (Active-Passive) running with the firmware version 19.5.3 MR-3-Build652. This is my current setup in both of the clusters: 

WAN1 (ISP) > Port2

LAN > PortF1

HA > PortF2 - PortF2

As per object, in one of them, I need to set an indipendent second WAN interface (WAN2) for connecting a MPLS router that will be reachable only from a VLAN. This operation is quite simple and I made it from Network > Add Interface. I set the IP information, the WAN zone and the port.

The desired setup would be:

WAN2 (MPLS with NO Internet access) > Port4

VLAN > Port6

However, after I enable the port and I plug the cable in, that will connect the MPLS router to the Port4 of the firewall, the Load Balancing (that I don't need) starts to work and most ot my users lose the Internet access (WAN1). Even configuring the weights, for each gateway, from the WAN link manager, is not helping at all.

Furthermore, I tried to set my firewalling rules so part of the traffic gets forwarded to the WAN1 (I selected WAN from the Destination zones and Port2 from the Destination networks) and some to the WAN2 (I selected WAN from the Destination zones and Port4 from the Destination networks) but it is not working at all.

Do you have any suggestions or any idea on why this setup is not working? Please let me know if you need further information, I have been vague just to explain the main issue.

As a temporary workaround, I just created a VLAN on the switch, and on the XGS cluster, and connected the MPLS router directly to the tagged switch port. Of course, this is not sustainable and this is not the setup I want.

Thank you and have a nice day!

Best regards.



This thread was automatically locked due to age.
Parents
  • 0

    Just remove the „Gateway“ setting from this uplink. 

    Mit freundlichem Gruß, best regards from Germany,

    Philipp Rusch

    New Vision GmbH, Germany
    Sophos Silver-Partner

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to PhilippRusch

    Hello  ,

    thank you for your answer. What do you mean? Once I setup the WAN interface, I cannot remove the gateway.

  • 0 in reply to LeonardoM

    Hello  ,

    I spoke with my supplier and they promptly created the static route through 10.10.200.2/24. Now, I can reach the MPLS router. However, I cannot reach any resource behind it as they need to announce my 10.10.210.0/24 to their devices/networks.

    Now, regarding the VLAN 210: on the UDMP, as already said, I created this VLAN and assigned it to the ports 37 to 48 of the L3 switch:

    Then, I created a VLAN interface to the Port6 of the firewall (Port6.210) and assigned a dummy IP to the Port6. However, seems like the traffic doesn't get forwarded with the VID as it does not go through the VLAN interface of the firewall. If I configure the firewall interface as a normal interface, the traffic goes through it and can reach the MPLS router. The firewall rule is configured with network objects and not with ports and, of course, the static route is configured. This is a bit odd.

    Another question is: I have a secondary site (let's say with the subnet 172.16.1.0/24) that is linked to the primary site through a VPN S2S IPsec. I would like to let the secondary site reach the MPLS router as well. This MPLS router, I did not say it before, gives access to DRaaS and BaaS resources. According to your experience, what is the best way to achieve it? Through DNAT?

  • 0 in reply to LeonardoM

    If you want your secondary site to reach networks behind the MPLs it's nearly the same but it depends a bit on what technique is used (policy based VPN or route-based VPN with traffic-selector or any-any tunnel) and what device is on the secondary site.
    Do you have more information on that?

    Regarding your VLANs. Do you have to use VLAN tags on your end-devices to reach each-other or do you only have to connect them to the correct switchport to do so?

    If you do not have to edit the VLAN tag on the end devices your switch is using port-based VLANs, meaning your VLAN tag of 210 is directly assigned to the specific ports. Traffic that enters the switch has to be "untagged", without a VLAN tag and traffic that leaves the switch through a port is "untagged" again. In this case you do not have to use a VLAN-Interface on the firewall. Simpy connect a cable to a configured vlan-port of the switch, give the firewall the IP 10.10.210.1 on that port (6 in your overview), delete the vlan interface on the firewall and you are fine.

    A VLAN interface on the firewall is needed if you have 1 cable to a switch but you want to serve more than 1 network over that cable. In this case the physical adapter gets one network, and each VLAN adapter gets another network. On the switch that has to be devided by VLAN-tagging.There are different namings with VLAN, I don't know how Ubiquity is doing it. Some vendors call interfaces with more than 1 vlan "trunk interfaces", others use wordings like "untagged" and "tagged", others use wordings like "access", "trunk native", "trunk allowed".

    Regards,

    Kevin

    Sophos CE/CA (XG, UTM, Central Endpoint)
    Gold Partner

  • 0 in reply to LeonardoM

    In addition to  about the VLAN issue you are experiencing:

    If you use a VLAN interface in the firewall, then this interface needs to be connected to a switchport that has the same VLAN tagged (usually a trunk). If the switchport is an access port in the desired VLAN then you cannot use a VLAN interface in the firewall since it sends the VLAN tag.

    Same thing as kerobra already said, but explained differently.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels

    Thank you  and  ,

    everyhing clear. The problem is that Ubiquiti is not really clear when it comes to configuring VLANs. Since I configured the VLAN to be managed from a third-party gateway (and, for this reason, managed from the firewall VLAN interface), I could just assign the VID that, of course, is the same on the firewall VLAN interface.

    So, if I got it right, for letting it work I have to set the VLAN ID to the vSwitch, in vSphere, that is managing the VLAN network object and the VMs assigned to it for working with tags. Actually I am working with a simple access port as I did not set the VID on the vSwitch level.

    Regarding  's question, I set a policy based VPN with any to any tunnel.

  • 0 in reply to LeonardoM

    Your vSphere is an example, where you normally have 1 (or more) physical uplinks connected to the physical switch and where the switch has to be configured as a trunk with more than 1 VLAN IDs. But I don't understand how it is involved here.

    "Third party gateway" on your ubiquity switch says who is responsible for the routing between the different subnets/vlans. A layer 3 switch can do that on it's own, but normally you want that to be done by a firewall because otherwise you will have to create accesslists on the switch which control, which connections are allowed. That doesn't mean the firewall controls anythin IN that subnet, it only controls the "exit" and "entrance" to that subnet in form of a firewall ruleset.


    Regarding the VPN, please share a screenshot of your S2S tunnel. "Any" to "Any" is only possible if it is a tunnel interface, which would be route-based VPN.

    Regards,

    Kevin

    Sophos CE/CA (XG, UTM, Central Endpoint)
    Gold Partner

  • 0 in reply to LeonardoM

    I use Ubiquiti Unifi access points and have a controller in my environment. I think this is what you mean with "managed from third-party gateway"

    The VLAN-id's here have to be tagged on the switchport where I connect my access points. The access point itself uses the so-called native vlan which in my case is my management VLAN. 
    See this page for a small explanation on how to create a trunk port ((tagged vlans) port 1 in the example) and how to create an access port ((untagged vlan) port 2 in the example)

    I think 

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to kerobra

    Hello  ,

    for configuring the VLAN on "end-devices", do you mean directly on the Network Interfaces of each device?

    Anyway, here you are the screenshot of the S2S:

    Thank you!

  • 0 in reply to LeonardoM

    OK, policy based and no "any-any" tunnel :-)

    Regarding your S2S you must add the network(s) behind the MPLS router as "remote subnet(s)" on your BO firewall so that the firewall on this end knows, which destination networks can be reached through the tunnel.

    On the HQ firewall this network then has to be a "local subnet" to make the S2S tunnel work from IPsec SA view. You will have to take care for HQ firewall rules to add the correct zones to the networks, depends on what zone your MPLS router is in (for example if that is resided on a DMZ zone the firewall rule for the S2S tunnel has to include LAN and DMZ to make it work) as destination zones.

    Regards,

    Kevin

    Sophos CE/CA (XG, UTM, Central Endpoint)
    Gold Partner

  • 0 in reply to kerobra

    Good morning  ,

    as always, thank you very much for your precious inputs.

    Just an update: in order to simplify my setup, I just reviewed the diagram. I will no longer use the VLAN 210 but I will just use the VLAN 200, the one created from my supplier and that the MPLS router is using. For this reason, I now just created a bridge interface between Port4 (that connects the swtich where my virtual hosts are connected to) and Port6 (where the MPLS router is connected to).

    Based on this new setup, in case of disaster, should I NAT the VPN traffic to 10.10.200.0/24 and let the VPN traffic reach directly the Port6? Is there a "cleaner" way to do it without interrupting the current VPN setup?

    Please let me know if you would like to have an updated diagram based on this.

    Thank you and have a nice day!

    Best regards,

    Leonardo

Reply
  • 0 in reply to kerobra

    Good morning  ,

    as always, thank you very much for your precious inputs.

    Just an update: in order to simplify my setup, I just reviewed the diagram. I will no longer use the VLAN 210 but I will just use the VLAN 200, the one created from my supplier and that the MPLS router is using. For this reason, I now just created a bridge interface between Port4 (that connects the swtich where my virtual hosts are connected to) and Port6 (where the MPLS router is connected to).

    Based on this new setup, in case of disaster, should I NAT the VPN traffic to 10.10.200.0/24 and let the VPN traffic reach directly the Port6? Is there a "cleaner" way to do it without interrupting the current VPN setup?

    Please let me know if you would like to have an updated diagram based on this.

    Thank you and have a nice day!

    Best regards,

    Leonardo

Children
No Data
Unfiltered HTML