Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG appliance has no internet but LAN devices do

Hello,

I've Sophos XG installed in between ISP modem and router. The XG in bridge mode with LAN and WAN bridged together.

The router and LAN all have internet access. 

However, Sophos XG doesn't - what I mean by that I can't update firmware for instance (or update clock using server), or ping using Diagnostics menu anywhere further than ISP modem/gateway. I can't ping 8.8.8.8, or any other outside IP. All packets are lost. There also seems to be no indication in Log as rejected traffic.

I used various DNS settings in Network, 1.1.1.1, 8.8.8.8, 127.0.0.1. 

LAN has DNS service checked and DNS service is running under System Services. 

I tried factory reset several times and noticed that in router mode XG is fine, updates firmware etc but as soon as I put in in Bridge mode I can't resolve DNS address during initial installation, need to continue offline and can't fix that later on.

Any suggestions would be appreciated. 

Thank you very much. 



This thread was automatically locked due to age.
Parents
  • Hi,

    do you have firewall rules in your router that allow the IP address assigned to the XG from your router out?

    Ian

    XG115W - v20.0.3 MR-3 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

Reply
  • Hi,

    do you have firewall rules in your router that allow the IP address assigned to the XG from your router out?

    Ian

    XG115W - v20.0.3 MR-3 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

Children
  • Hi and thank you for the suggestion. 

    XG has static IP on bridge interface (I think it's required).

    The bridge IP 192.168.100.111 is in the same subnet as my gateway 192.168.100.1

    The gateway is ARRIS S33 and doesn't have any firewall rules or routing. 

    I don't have any firewall rules pointing towards XG on my router because it's downstream from XG.

    Is that a correct setup?

    Thanks. 

    Kindest regards,

    Jakub 

  • It made me think and I double checked. 

    Bridge interface IP can be set up as DHCP assigned.

    I created another interface on Lan as static ip to have an appliance entry point for management and change bridge to DHCP. 

    The root cause is maintained. The bridge can't obtain an ip address from my gateway/dhcp. 

    In the Routing/Gateway menu it show status as red and ip address as 128.0.0.1 as my gateway IP. Incorrect. 

  • Hi,

    is your ISP router/gateway setup to hand out IP addresses? Do you have firewall rules in the XG bridge?

    Ian

    XG115W - v20.0.3 MR-3 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • Yes, it's a Spectrum ISP and I'm provided dynamic public IP address through that gateway. 

    I have the following FW rules using a DHCPServer host set up with my gateway 192.168.100.1. I also left default rules.

    1. DHCP Inbound - Accept

    Source zones Source networks Dest zones Destination networks Services
    WAN DHCPServer LAN ANY DHCP

     

    1.1 Linked NAT - everything set as Original

     

    2. DHCP Outbound - Accept

    Source zones Source networks Dest zones Destination networks Services
    LAN Any WAN ANY DHCP

     

    2.2 Linked NAT - everything set as Original

     

    3. "Example traffic to internal zones". If I turn it off it shuts off internet to LAN

    Source zones Source networks Dest zones Destination networks Services
    ANY Any WAN DMZ, LAN, VPN, WiFI ANY

     

    4. "Example traffic to WAN"

    Source zones Source networks Dest zones Destination networks Services
    ANY Any WAN ANY ANY

     

    5. #Default_Network_Policy

    Source zones Source networks Dest zones Destination networks Services
    LAN Any WAN ANY ANY

     

    Scan for HTTP and decrypted HTTPS and use zero-day protection checked. 

    5.1 Linked NAT with "Translated source SNAT set as MASQ

    This NAT rule has the most Usage by far.

    Thank you very much for your help.

  • If you only have one WAN interface you do not need a linked NAT which will cause you issues when debugging. Please show the definition of DHSP service?

    Concentrate on  getting your outgoing working for the moment. What is the range of the WAN addresses (/xx) you have been supplied with by your ISP?

    Ian

    XG115W - v20.0.3 MR-3 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • Thank you very much for your response. 

    I have disabled all NAT rules and indeed my main LAN internet is still working fine. No change with XG - still can't ping outside of modem gateway.

    I'm not certain if that's what you're looking for when asking about DHCP service. I don't have any entry in "Network/DHCP" menu as my bridge is static IP.

    The only thing I've set up is DHCP server as IP host that is then referenced in firewall rules:

    The 192.168.100.1 is my Arris S33 modem gateway.

    The "Hosts and Service/Services" tab provides the following DHCP port setup. I can't edit it as far as I can tell

    "System services/Services" menu shows the following under DHCP server

    Regarding the WAN address, my setup is a residential cable internet by Spectrum. It's a dynamic IP and they provide absolutely nothing on their portal in terms of details. "whatismyip" site says my IP is within the following range

    AS20115 24.151.0.0/16 CIDR and IP Range Summary

    I hope that helps. Thank you again.

    Kindest regards,

    Jakub

  • So,

    what address range doers your Arris modem handout and why are you using the modem a DHCP source when it is only a modem?

    I recommend you use the XG in router mode and ignore your modem for providing any network security..

    Ian

    XG115W - v20.0.3 MR-3 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • I followed the instructions I found for bridged interface within some Sophos KB and a couple of youtube guides. I really have a hard time understanding this as I'm not proficient in network engineering.

    I thought that my dynamic IP comes somewhere from within Spectrum server and my Arris modem is the gateway. Thus I point traffic to that gateway and call it DHCP server (although I believe Arris is just a "dumb" signal converter and doesn't generate any IPs on its own. It just passes dynamic IP from Spectrum). 

    I started with XG in router mode, and it worked fine on its own with PC connected directly to it but then when I connected it to my router, then it broke my router, which is Unifi UDM-SE, and nothing on LAN had internet. I learned that UDM can't be downstream of another router :-(

    I really like UDM and don't want to get rid of it, so was hoping Bridged XG would provide me a sophisticated but "transparent" FW.

    I messed around quite a bit and I think these are the issues with possible solutions that unfortunately I don't know how to execute:

    1. XG in bridge mode with static IP

    I think the issue is that the bridge has it's own IP. Bridge passes traffic from UDM 192.168.1.1 in fully transparent mode but then when I want to update firmware, or do something from within the XG, it introduces its own Bridge IP and Arris doesn't recognize it. Thus, I can't only ping as far as gateway.

    Solution would be for the Bridge to "mimic" 192.168.1.1 but I don't know how.

    2. XG in bridge mode with dynamic IP

    Here the Wan Link Manager says the gateway is 128.0.0.1. Through modem resets I'm able to see an external dynamic IP here temporarily with correct gateway but then my UDM loses that IP and my LAN doesn't have internet. Almost like XG and UDM are fighting for that single IP.

    Solution would be again to somehow mimic that Bridge as a part of LAN traffic under UDM. 

    Not sure if my conclusions are correct but that's the only thing that makes sense to me. 

  • Hi,

    you have just changed the configuration. The UDM provides the IP addresses not the modem. Please provide a diagram of the network setup. Your configuration sounds very similar to an earlier thread asking the same question using the same devices?

    Ian

    XG115W - v20.0.3 MR-3 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • Not sure what the "order" of devices is now, but I think you should have the UDM as the first device after your internet setup (just as you had it without Sophos XG).
    Then have the Sophos XG bridged in the UDM LAN environment and only then have all your devices behind the Sophos.

    You can leave Sophos bridge as dynamic IP-address which it will request from UDM. Your clients will also get IP from UDM through Sophos.

    Make sure to create firewall rules to allow traffic to flow through the bridge. To make it easy for testing define a rule to allow all traffic. Something like Source Zone: WAN, LAN; Destination zone: WAN, LAN; service: ANY; Allow. This way you simply allow all traffic over the Sophos interfaces both ways. If it then functions, you can start limiting traffic to suit your needs.


    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.