Real beginner here so need help. UTM was set up originally by somebody else who gave no instructions at all. I am feeling my way, hence this post.
I wish to change the subnet on the management interface eth0 from 192.168.0.1/24, what I assume is the default. I have not yet connected anything to that interface and started to edit it but found that this would disconnect me from the dhcp server and I assume dns. I have other ports being used on other subnets and thought that because I had nothing plugged into port 0 I could change it without compunction but it appears that this network is being used and indeed is the system management subnet.
It is clear I need some guidance here with the basics of how I can change this subnet without disconnecting everything and not being able to get back into the system.
I see that when I log in to the device I am using https://192.168.0.1:4444/ which I was told to use and makes sense now, so how may I change the management interface without making a real mess?
I have no information on the router configuration which lies above the UTM but can seek this information if needed.
Grateful for some help here please.
Budge
Hello Budge,
Thank you for contacting the Sophos Community.
If nothing is connected to eth0 then you can go to Interfaces & Routings >> Interfaces >> eth0 >> Edit and change the IP address from there.
Now if you have configured something, you would need to connect to the UTM using a different IP (192.168.0.1), if you only can access to the UTM on 192.168.0.1 please go to Management >> WebAdmin Settings >> General >> WebAdmin Access Configuration >> Allowed Networks and add the IP of a computer that is not in the 192.168.0.1 subnet. For example
Image eth3 is where I connect to the Web GUI, if I want to edit it, I would need to add the wlan0 (10.10.10.1/24) under the WebAdmin Access Configuration to be able to access using a computer on the 10.10.10.1 network and I would type https://10.10.10.1:4444
In any case before making any change, please take a backup of the configuration under Management >> Backup/Restore >> Create Backup >> Create Backup NOW and download the backup to your computer.
Regards,
Many thanks Emmanuel, excellent answer and just what I needed. A couple of follow up questions for clarification;
You suggest that after changing the management port address I would need to go use a different address but have quoted the default 192.168.0.1. I assume I would use my new address to replace the default and that once I had changed the eth0 subnet that default would not be there. Is that correct or is the default fixed absolutely?
Thanks for getting me sorted out on backing up. Can I set up the UTM to save in a particular directory in future rather than "Downloads?"
If I make an absolute hash of things and can no longer access the UTM in order to upload a backup from my laptop, what then?
Finally in your screenshot on setting up the Allowed Networks I found it contained Any (0.0.0.0). Should I now remove that "Any" as it will be replaced by my other machines, once entered as appropriate.
Many thanks again for your help. You can see I am an absolute beginner but love the system and with your guidance and others no doubt I hope to get the system as it should be.
I am making slow progress and now have management subnet set up (using the default) and fixed devices connected to that subnet using vlans on L2 managed switch. This has created some new problems but I think due to how I have configured the switch but I now have connections between subnets that I didn't set up on the switch. Could it be that the UTM is an L3 device and will route between subnets unless I prevent it at the UTM?
Hello Budgie,
If the Vlans are finishing in the UTM, the UTM will route between them. You would need to create Drop Firewall rules between the subnets to stop this.
Also, check this Community Post about traffic being allowed even a Firewall rule is in place. Check Rule #2https://community.sophos.com/products/unified-threat-management/f/general-discussion/22065/rulz
Hi and thanks. So I now have four subnets set up on the UTM; Management, and three others, one in this case called HOME. The UTM ports are connected to ports on an L2 managed switch with vlans assigned to respectively. The WAP devices have been given fixed management addresses on the management subnet and on the WAPs and are connected to ports set up as Trunks on the L2 switch. I have set up SSIDs for each subnet on each of the working vlans, including my HOME subnet and temporarily an SSID on the management vlan for me to access the management subnet so I may configure WAP devices using wifi connection.
All the WAPs so connected seem to work OK in that logging in to each SSID gives me access to the WAN and if I log in to the management SSID I can access the control page of the WAPs.
My problem is that when logged into my HOME SSID, I cannot access my other devices which reside on my HOME network and when I look at the wifi on my phone I see it is connected to the management subnet, even though I logged in to the HOME SSID.
I have not set up any Vlans on the UTM. It appears that all the routing is taking place in the UTM and that I have work to do but it appears I should now erect a firewall between the subnets. I shall keep reading and will read the thread suggested but if you have time your further guidance would be appreciated.
Many thanks.
Budgie2, (real beginner!)
OK so here is my problem, which may be more of a vlan/managed switch issue than UTM but here it is.
I have kept all tagging off the UTM so all switch ports connected to the UTM have memberships with port U (untagged).
I have created a management (say vlan 900) and web admin for access to the UTM from my private subnet workstation.
I have given all the fixed devices such as WiFi access ports and managed switches static IPs on the UTM management port subnet and and these are connected by trunk connection with membership tagged T.
I am unable to set up vlan 900 on the managed switch which is connected to the UTM management port. If I try the setting is refused.
What is correct way to set up this connection so that I am not locked out of either device and can access all the static devices on the Vlan900 management subnet? Can I do all the work within the managed switch or must I create a vlan on the management port of the UTM?
Hope I have explained?
Hello Budgie2,
Thank you for the follow-up.
Could you please take a screenshot of your interfaces?
Hi, here is my screenshot:-
Hi emmosophos,
Many thanks for your reply. I now have managed to change the default managed switch port to the correct vlan with the port set U_ntagged but now I suspect the switch can no longer get dhcp adresses from the UTM. I can connect to an spare port on correct vlan but using lan connection and can access all the devices because they have static IPs but seek your advice on the correct way to achieve connectivity from my main workstation which sits on another subnet on the switch.
I suspect there are many ways of doing what I want using UTM capability but your advice is really needed here. Thanks again for responding.
Best wishes,
This is as far as I got and now need your advice on how I should access my management vlan!
So your Management interface and Management Vlan are in the same subnet, which will cause issues.
I would recommend you change either of these subnets so they don't overlap.
Maybe try 192.168.2.0/24 for the Management VLAN.
Hi and many thanks for the reply but you have left me very perplexed. I have used the UTM port 0 to connect to my management with dhcp provided by the UTM and the subnet which has all the relevant devices set with static addresses on that subnet and on the management vlan. If I use a different subnet for managing my devices how may I arrange dhcp for the management subnet?
Is there a guide for the correct way to set up the management subnet please.