Set up VLAN to connect two separate networks

Hello Chevyavalanche ,

Thanks for reaching out to Sophos Community. 

Could you share a network diagram of the setup you're trying to achieve?  

Is there any specific reason why you have to retain the VPN router? Could you onboard the ISP link where the VPN users connect to Sophos Firewall instead? 

This way you’ll manage the connectivity of LAN users and VPN on Sophos Firewall, which I believe is a more straightforward approach for your setup.

Looking forward to hearing from you. Have a nice day and thank you for choosing Sophos. 

Regards,

I use VPN router (running VPN s/w) to do 'secure' work and is a requirement. It was recommended to connect VPN router directly to main router instead of L2 switch.

Everything works fine and has been for years. I just now want to be able to access both networks from any PC on either network.

Hi Chevyavalanche ,

This seems like a layer 2 issue.

Let me know if my understanding of the network is correct

If this is correct, then the users behind these networks (172.16.x.x and 192.168.x.x) will only respond to the same network/subnet since they’re connected to an L2 switch.

To provide communication for these 2 subnets we’ll need to configure SNAT, here is the idea: Whenever the firewall receives a packet with source or destination from either 172.16.x.x or 192.168.x.x it will changes its source IP to whichever interface it will go out to.

So make sure the firewall has an interface that has 172.16.x.x and 192.168.x.x

Let us know if this works on your setup

Looking forward to hearing from you. Have a nice day and thank you for choosing Sophos.

Regards,

Hi Adam,

The WAN of VPN router is connected to a LAN port on Main router...not Cisco L2 switch. That switch is only used on 172.16.x.x network. You are correct with 192.168 going through VPN router and 172.16 going through Main router. In any case, your assessment of the situation is correct.

The Firewall rule shown above...does it allow internet access for 192.168.x.x? I ask as both source and destination are set to LAN. In my current setup, VPN router accesses internet through main router.

So no need then to even set up a VLAN? Just looking for easiest solution that works. Thank you for your help.

Hi Chevyavalanche,

Thats great.

As for the firewall rule shown above, It does not allow internet access since this rule is only specific for traffic between 172.16.x.x and 192.168.x.x

No need to set up a VLAN since we will be using NAT to make it work. The only thing you will need is to make sure that the firewall has an interface for both networks. Here is an example.

The Port connected to the Main router should be configured to have a IP address of 192.168.x.1, (If the port connected to the Main Router is configured differently, you can add an alias interface for this: Add an alias - Sophos Firewall ) Then make sure that the Port connected to the Cisco L2 Switch is also configured with an IP within the network, for example, 172.16.x.1. This is important since this is the IP that the firewall will use to NAT the source address.

Let us know if this works. Looking forward to hearing from you.

Hi Adam,

Sophos FW is running on a Protectli VP2410 mini PC. Sophos FW is also 'bridged' to my main router and has it's own IP address in the 172.16.x.x range (set on the VP2410).

Port 2 on VP2410 is Sophos's WAN port and is the port connected to Main router LAN port. I don't think I can change this port to 192.168 as that will break everything...or am I misunderstanding what you are saying?

Ohh got it Chevyavalanche ,

I think this is how I understood your setup, take note that the IP 123.123.123.1 is just a hypothetical IP that I assume is on your network. As long as the firewall receives packets from 192.168.x.x network this setup will work. As for configuring an Add an alias - Sophos Firewall on the Firewall, I would suggest trying to configure this during a downtime schedule since this is a Virtual firewall.

Let me also share with you a way to know if you’re receiving packets from 192.168.x.x using tcpdump. Firstly access the firewall's Advance shell

Then input this command: {} -> this is a placeholder for your setup

tcpdump -veni {Port of WAN} and host {source IP of 192.168.x.x}

Example: then generate a traffic from 192.168.1.1 to 172.16.x.x

tcpdump -veni Port2 and host 192.168.1.1

You are spot on Adam. So by adding an alias or virtual FW, I still have to connect VPN router to an open port on Sophos (VP2410) and if yes, is there anything special that needs to be done to this port (it's already set to LAN)? Is your alias FW tied to the bridge that I've set up previously?

I can give it a shot but just afraid that if something doesn't work, I lose connection to FW or something crazy like that. I know some things but by no means an expert at this.

I gave this a shot. I added the alias and can ping IP 192.168.x.x. I tried the commands in SSH but kept getting 'no such device' when entering the port of WAN or the physical IP of VP2410. I also tried the main router address and it came back as 'no such device'. I tried to access my VPN router site and I get this: ERR_CONNECTION_TIMED_OUT. Not sure if I need to add a FW rule or something else to make this work but I feel I'm getting close to a solution.

Happy holidays Chevyavalanche ,

We’re getting close to finding the solution only a few more steps to go 

For the SSH command getting "no such device", You can try this steps:

1. Check the information of the interfaces using the command: ifconfig | more
   1. 
2. Then input the command: tcpdump -veni Port1 host 192.168.X.X (Take note that the Port will be different on your setup)
   1. 

While tcpdump is enabled, generate traffic from your VPN gateway to the interface of the Sophos firewall; if the ping fails, kindly check if the ping is enabled in SYSTEM>Administration>Device Access

If the VPN gateway can reach the Sophos firewall interface, then this should now be working. If not, we might need to tweak the firewall rules a bit.

Let us know if this works. Looking forward to hearing from you.