Sophos XG Wireless Controller

It was working as follows:

Configuration on the XG:

1 interface with a dummy IP address for untagged traffic.

1 subinterface on the above with an IP address configured in the MGMT Vlan.

1 static route 0.0.0.0/0.0.0.0 because no default gateway can be configured on the subinterface.

1 rule: any to any for any

2 wlan networks: 1 for guest (bridge to vlan) and 1 for users (bridge to vlan)

Configuration on the interfaces to the AP:

Trunk with No untagged vlan and 3 VLAN's tagged.

It works but it's oh so slow and I don't think it's the way to go..

It was working as follows:

Configuration on the XG:

1 interface with a dummy IP address for untagged traffic.

1 subinterface on the above with an IP address configured in the MGMT Vlan.

1 static route 0.0.0.0/0.0.0.0 because no default gateway can be configured on the subinterface.

1 rule: any to any for any

2 wlan networks: 1 for guest (bridge to vlan) and 1 for users (bridge to vlan)

Configuration on the interfaces to the AP:

Trunk with No untagged vlan and 3 VLAN's tagged.

It works but it's oh so slow and I don't think it's the way to go..

I got it working on reasonable speed.

1 Interface on the XG firewall configured VLAN 10 (MGMT)

AP's configured on trunk link with untagged VLAN 10 and tagged VLAN 20 and 30

2 Wireless networks (SSID's), 1 for VLAN 20 and 1 for VLAN 30

Configured magic IP static route and dhcp option to the XG firewall on my DHCP server

What I don't understand is the option to tag VLAN ID for the access points or access point groups. I've tagged them with another VLAN (40) but the are still communicating with the XG on VLAN 10 MGMT. My confusion was with the obligated configuration of this option when using 'bridge vlan to wlan'

It looks like the option doesn't do anything. Can anyone confirm?

So the traffic doesn't pass the XG. Only mgmt traffic between the AP and the XG is happening. VLAN 20 and 30 are not configured on the XG.

To reply: yes, you can use the XG as a wireless controller only. Perfect.

VLAN Tagging in Sophos Wireless is used for everything, after enabling.

There is the Management VLAN (in your case 10). And you could use per SSID one VLAN, after switching to Bridge to AP VLAN. 

If you use Bridge to LAN or Separate Zone, both mode will tag the traffic on the management VLAN. 

Hi LuCar Toni,

I understand. But can you force the AP to communicatie to the XG (for provisioning etc) over a tagged VLAN?

What is the use of the AP VLAN ID?

I saw you already answered this: https://community.sophos.com/products/xg-firewall/f/wireless-networking/115624/what-does-ap-vlan-id-actually-do-in-access-point-groups

But this does not work. If I enter AP VLAN ID 10, it will still communicate over the untagged VLAN on the trunk to the AP.

It should use the Management Port of the Group for everything? 

Are you 100% sure, it does not use VLAN ID 10? 

A Group with VLAN10 will let the APX communicate with VLAN10 as management. 

Use this tool to login into the APX to check. 

https://community.sophos.com/products/xg-firewall/f/wireless-networking/114322/sophos-xg-ap-reboot---awetool

Hi LuCar Toni,

Yes, I'm 100% sure it doesn't use the right vlan for communication. No matter what I configure as AP VLAN ID, it always uses the untagged vlan on the trunk.

Best regards,,