Installing Sophos XG v20 Firewall home edition and SETTING up ALL ports as a router

Hi Alex,

Thank you for reaching out to Sophos Community.

Have you done bridging all Interfaces to 172.16.16.16, and creating a FW rule to allow it outside the network?

• Sophos XG Bridge Mode
• Bridge Interfaces

It sounds like you have alot of unsupported NIC's, what chipsets are they using?

ok, that did go quite well, I lost access to the sophos. but working on it. (yes I did try setting fixed ip, but still not happy about it)

I had a look in the links you provided and a few documentation.

I'm quite surprised how many steps it requires, I wonder if the hardware version of sophos has already the router capability built-in. I'm struggling to recommend this to my work, but I really have good hopes will come out good, then I can just document for the IT people how to proceed.

We have Zyxel UTM, which by standard all ports are on dhcp for internet use, with basic firewall functions on. Now my choices at the moment were to test PaloAlto, Fortigate and Sophos. Let's hope sophos wins this challenge.

I doubt that, as they are all recognized in the Sophos application. Also I have 2 NICs intel hp branded. one works fine the other connects (changes from unplugged to plugged) but still not finding my way to create a standard router gateway options. Works continues. I might try another reset (re-installation and start from beginning)

My ISP provides internet via ethernet socket in the wall. So I'm not using any modem or switch before the sophos.

Not at home now, but they are all new cards, purchased within the past 6 months.

2x cards are: AXAGON  NIX PCIe 2.0, Gigabit Ethernet, Realtek RTL8111L, 1xRJ-45 

2x cards are HP Intel PCIe  server dual port (will update model soon)

1x internal motherboard ethernet Realtek RTL8111H ASUS LAN Guard

1x intel pcie single port 1gbs (will update model soon)

The default setting for xg is router close where you can setup a bridge but you need firewalls to allow traffic between each leg of the bridge it is not a normal router.
ian

hi, yes I understand the rules that needs to be setup to allow traffic. The only problem I see on the bridge mode is that it limits some functionalities of the Sophos as explained in the video above.

Ideally I would like all ports to have complete functions of the software. It's quite simple 1 WAN, 7 LANs ... all with internet access either with fixed or dhcp access.

But still on setting up, let's see what happens.

--------------- UPDATE ---------------  

2x cards are: AXAGON  NIX PCIe 2.0, 1Gb/s Ethernet, Realtek RTL8111L, 1xRJ-45 (2 ports)

2x HP Intel PCIe D28207-006 Dual 1Gb/s Port - UPDATED (4 ports)

1x Internal Asus Prime B450-PLUS Motherboard 1Gb/s Ethernet Realtek RTL8111H ASUS LAN Guard (1 port)

1x HP Intel Ethernet I210-T1 1Gb/s NIC (E0X95AA) - UPDATED (1 port)

Total = 8 PORTS

--------------- --------------- ---------------

Ok, simplest method would be to create a bridge of all the ports you want, I would suggest you bridge all the other ports first that are available into Br0 and then leave the first LAN port you have setup for management, that way if the system does have any issues setting up the bridge you don't end up with no access, you can then assign the bridge interface a static IP on its own range, setup a DHCP server and you should have internet access based on default rulesets

That's a brilliant idea, will follow that and see where it leads me. I've done about 5 installations today alone, trying things out and loosing access to the UI interface.

ok, let's update this post after 15 hours working on this.

Got all ports working (not on same range, as bridge did not work, yet), but they all work with the following configuration

-----------------------------

STEP 0: Set each port as ipv4 and a static ip address, and subnet mask. i.e. 172.16.17.17 / 255.255.255.0

STEP 1: Create a DHCP server host with the ip in range of the port. (in my case I have each port with a static ip address i.e. 172.16.16.16, 172.16.17.17, 172.16.18.18 ... etc)

STEP 2: Create 2x firewall rules, one for inbound DHCP and other for outbound DHCP. for the inbound add the server host created on step 1, to the source network and devices.

STEP 3: Look for the "Default SNAT IPv4" where there's already port2(LAN) there, just edit and add all the other ports. (not too sure if this step is necessary as I could still get some traffic when turned off, but it's ON just in case.

STEP 4: Go to DHCP and create new one, just like the "DEFAULT_DHCP_SERVER" in my case I did one for each port. i.e. name:dhcp_port3, Port3 - 172.16.17.17 -  range: 172.16.17.18 - 172.16.17.254

-----------------------------

That's it, at the moment I got all ports working. But wasn't that straight forward. I'll update once I can get them all in the same range talking to each other, let's say to share DLNA or Chromecast within all the ports.

It's not stable, well at least in my tests, sometimes it doesn't connect straight away (30 seconds to get internet access) Now this i'm not sure if it's the ACPI of the motherboard, although I turn everything to be ON and no standby what-so-ever.

-----------------------------
What's next, get them all in one ip range. (but this will have to wait, got other projects going on at same time) If anyone knows what's going on here, please let me know.