Static Route zwischen WatchGuard und Sophos XG

I already tried to create a static route on the sophos fw to get access to the 10.44.105.x network. But which gateway address do I have to use?

If I try 192.168.99.1 and the LAN interface with that subnet, I get the message "Gateway IP address must be different from interface IP address"

Hello Florian, 

Could you confirm which network is 10.44.105.x on the given diagram? Gateway settings should be IP address of the next hop or gateway/router to the destination and should not be with the same subnet of your exit interface

Regards,

Hello Raphael,

The 10.44.105.x network is on the diagram the 10.10.1.x . Sorry I used a old screenshot of the diagram. Instead 10.10.1.x it is the 10.44.105.x network which I tried to add a route.

So the gateway IP in this case should be the 10.44.105.1 IP or which would be the next hop in this case?

Thanks and regards,

Florian

Hello Florian, 

Thanks for your response.

Way I'm seeing it is your Sophos Firewall interface/Port2 LAN with IP network 192.168.99.0/24 and the one connected directly to the Cisco switch is on bridge mode and the Cisco Switch is directly connected to Watchguard Port3LAN with IP 192.168.99.2

So, if you want the AP network 192.168.99.0/24 to have internet access, the Default Gateway of clients should be 192.168.99.2 (WG Port3 LAN), with DNS that can resolve and with FW policy on WG that allows outbound traffic.

a bridge interface on SF that are on both LAN zone should be unable to have a Default Gateway (Kindly see the gateway field that is grayed out when creating a bridge interface) so that being, the WG should be the DG of the clients on the network 192.168.99.0/24

With regards to 192.168.99.0 reaching the network 10.44.105.0 , A static route is likely unnecessary since they are directly connected networks on WatchGuard. What you need is to configure a Firewall policy in WatchGuard that allows access to 192.168.99.0 -> 10.44.105.0 and also 10.44.105.0 -> 192.168.99.0

Regards,

Hello Florian, 

Thanks for your response.

Way I'm seeing it is your Sophos Firewall interface/Port2 LAN with IP network 192.168.99.0/24 and the one connected directly to the Cisco switch is on bridge mode and the Cisco Switch is directly connected to Watchguard Port3LAN with IP 192.168.99.2

So, if you want the AP network 192.168.99.0/24 to have internet access, the Default Gateway of clients should be 192.168.99.2 (WG Port3 LAN), with DNS that can resolve and with FW policy on WG that allows outbound traffic.

a bridge interface on SF that are on both LAN zone should be unable to have a Default Gateway (Kindly see the gateway field that is grayed out when creating a bridge interface) so that being, the WG should be the DG of the clients on the network 192.168.99.0/24

With regards to 192.168.99.0 reaching the network 10.44.105.0 , A static route is likely unnecessary since they are directly connected networks on WatchGuard. What you need is to configure a Firewall policy in WatchGuard that allows access to 192.168.99.0 -> 10.44.105.0 and also 10.44.105.0 -> 192.168.99.0

Regards,

Thanks Raphael, I got it work that now the Wireless clients have a internet connection. I changed the gateway for the Wireless DHCP from 192.168.99.1 to 192.168.99.2 and now the clients cant reach the wan.

Unfortunately, I rebootet the AccessPoints and after the reboot they were not able to connect to the sophos fw again and showing as inactive in the wireless ap configuration on the fw.

I was not able to get the two AccessPoints to run again and set it to active, also  the leds on the APs were blinking red.

Then I changed the Gateway back to 192.168.99.1 on the DHCP options and after that the APs were connected again and shown as active on the sophos fw.

How can I solve this problem now, when the APs are rebooting they arent able to connect to the sophos mangement fw as the GW is for the AP the same as for the Clients?

I wasnt able to find a solution to set a static IP and GW for the APs only. Is there a configuration I can change to make them running again with the new gateway adress?

thanks a lot!

Hello Florian,

Thanks for your response.

Seems the Sophos Firewall is the AP controller for your Sophos APs, and the DHCP for the clients and APs.Then by changing the DG to 192.168.99.2 this likely caused the error

By default, access points send the registration request to their default gateway using the magic IP address 1.2.3.4 on port 2712. The gateway must route traffic from the access point sent to 1.2.3.4 to Sophos Firewall, or the DHCP server must use option 234 to change the magic IP address to the address of the Sophos Firewall.

That being said, we should configure DHCP option 234 on Sophos Firewall (Assuming SF is your DHCP for AP network and clients)

Kindly follow the Steps:

1. Go to Configure (Network) > DHCP and then add a DHCP server so that it can lease IP to access points and clients. 

2. Create the DHCP option and bind it.
- Sophos AP works on magic IP address (1.2.3.4) therefore configure the DHCP server to forward all AP registration requests to the IP address of Port2LAN interface on the appliance instead of the magic IP address 1.2.3.4

-This is done by configuring DHCP server option code 234[magic IP] for the interface (Port2) where the AP is connected to.

-Connect through SSH and select option 4. To enter Device Console.
Once you are in the console, run the following command:

system dhcp dhcp-options add optioncode 234 optionname dhcp_magic_ip optiontype ipaddress

3. Apply the created DHCP option on the DHCP server (created in step#2). 

Run the following command: system dhcp dhcp-options binding add dhcpname *ENTER THE DHCP NAME* optionname dhcp_magic_ip(234) value 192.168.99.1

Then - Connect the access point to Sophos Firewall to get the IP address leased by the DHCP server