Sophos XG(S) Firewall, WiFi connected devices not able to see LAN printers

Question

Hello, I work at a school and we use an XGS 2100 to manage our internet. We have our networks divided for staff, students, etc. 
 We recently changed our connections from LAN to VLAN, so we can run distinct profiles on each SSID. Since then our VLAN WiFi connected devices (laptops, chromebooks etc.) haven't been able to see the LAN connected printers or print anything from anything on the VLAN. The only exceptions are devices that are directly connected. 
 We also moved the connections over the Central since switching to VLAN. Same goes with our AP's. 
 VLAN can't ping LAN, and LAN can't ping VLAN. 
 Any help would be greatly appreciated. 
 Here's our layout

Wayne Folta · Answer

Your printers might advertise themselves via mDNS, which uses multicasts. Multicasts are not transmitted across networks, which includes between subnets or VLANs. I WISH that Sophos would support multicast forwarding for such cases, but it doesn't. 
 The lack of pings could indicate a total lack of routing/permission between them, but if your printers are like my printers, mDNS could be a problem with your new setup, even if you solve the ping issue. 
 We can assume that you added appropriate firewall rules to allow traffic between the various VLANs?

PhilippRusch · Answer

Do the printers and the WiFi connected devices have the Sophos firewall at their default gateway? 
 If not, you need to change the configuration of the LAN-printers to point at the firewall as their gateway. 
 Then you need "Allow"-rules for the traffic from the WiFi devices to the LAN-printers. 
 Once this is done, you should be able to ping the printers.

Sophos XG(S) Firewall, WiFi connected devices not able to see LAN printers

Top Replies