Sophis UTM and Unifi

Question

Hi all, 
 I'm considering installing Sophos UTM at my business. I currently have a unifi setup. Fibre Modem --> Unifi USG --> Unifi Switch --> Unif APs. 
 I have a few questions about the install. Firstly do I install the UTM in between the fibre modem and the USG, or between the USG and Switch? The main reason for using Sophos UTM is to fill in the gaps that the Unifi USG cant do. Mainly keeping a records of Mac addresses and website visited and Web filtering. My plan was to use it in transparent mode. I understand the issue with using it to record HTTPS as i will need to install a custom cert which is fine or live with the HTTPS cert errors. 
 Also i have 4 VLANs setup so if i was to put the UTM in between the USG and switch will the UTM pass all the VLANs i.e. trunking? 
 My other idea was to use the UTM as a VPN server, currently the Unifi one is very buggy. So ideally the UTM will need to be installed between the fibre modem and the USG. if so does the UTM support pppoe? 
 And finally to test the system i will be using an old intel i3 3220 and a 4 port intel nic. will this be ok for web filtering/reporting and VPN? not too concerned about AV and IPS, maybe i can look at this another time. My line connection is currently 100/20 with the option to upgrade to 300/30. 
 Sorry for all the questions

Louis-M · Accepted Answer

The UTM can easily handle the PPPoE. My home setup is like that. You can't install the UTM in bridge mode doing this. Bridge mode is for when your USG is in front and the UTM sits between the USG and LAN. 
 I've never set the UTM up in bridge mode as I normally put the UTM as front facing due to its capabilities. If you want to keep the USG, you will be dealing with a two NAT scenario and routing as the front facing router will not be aware of the inner most lan network and will need guidance particually if you plan on exposing some services from that lan. 
 UTM WAN = 7.7.7.7 UTM LAN = 10.0.0.1/24 
 USG WAN = 10.0.0.2/24 <<<< this has to be on the same subnet as the UTM LAN and has to have the UTM LAN ip as it's gateway. This could be your DMZ network USG LAN = your current LAN 
 The above is one way of doing it. There are others.

Louis-M · Answer

Not sure about bridging mode. You can have your USG at the front too but I think it would be a waste compared to what the UTM can offer you.

Chikondi · Answer

Hello Peter 
 
 Not sure if you still want to do this but I managed to get this setup running 
 Before you start, backup your unifi configuration!!!! 
 
 Step 1: Edit all port forwarding rules to the XG Firewall, create new rule to forward UNIFI ports to the XG Firewall 
 https://help.ubnt.com/hc/en-us/articles/218506997-UniFi-Ports-Used 
 
 Step 2: Connect the XG Firewall to the LAN and to the router using a crossover cable 
 Step 3: From your computer, login to the xg firewall via web browser and configure bridge mode, IP address has to be on the same subnet as your LAN, once this is done users should start browsing internet as normal 
 Step 4: Configure the XG as a DHCP relay, create network rule that allows all traffic between UniFI gateway IP ADDRESS and the Controller PC IP ADDRESS, after this you should be able to see the gateway on the controller 
 STEP 5: recreate your port mapping rules for forward from the XG Firewall to the server 
 
 Hope this helps