Bring VLANS from our Datacenter to the Remote-Office (Red 15w)

Hi Manuel and welcome to the UTM Community!

Not possible with a RED 15, I think.  A RED 50 could do what you want, but I would prefer an SG 115 with a Network Protection subscription.  It's more flexible and the total cost is less than a RED 50 with warranty extensions.  Speak with your Sophos reseller - it may be that an SG 105 would work in your situation or even an XG 85.

Cheers - Bob

Thanks Bob!
Do you may know, if it is possible to bring a single VLAN from our datacenter to the RED15W. I am struggeling to find a configuration to attach one single VLAN to an untagged port and a WIFI. It`s not an option to buy a new RED-Device, at the moment.

Hi Manuel,

having multiple vlans on a RED15 is possible, every port is then a trunk Port, you'll need a vlan capable Switch in the remote office to assign clients to the correnct vlans.

Please notice that the red is unable to do routing between vlans, all inter-vlan-traffic is routed by the UTM in your Datacenter which means that the inver-vlan-traffic causes double load on your internet connection.

you can build a transparent L2 if you create a bridge interface between a red interface and one of the local interfaces of the UTM. please do not use this configuration if your UTM is a vmware virtual machine. it will cause high load on your hypervisor (i crashed a Datacenter IAAS environment this way.. vmware bug...)

yours Lukas

Thanks Lukas,

I did the following configuration. Can you help me to find the problem? All “Ether VLANs” are attached to the eth0 Interface. The “Ethernet Bridge – br0” is configured with eth0 and my RED-Device “reds1”. I am able to reach the Internal-Network (192.168.1.0) when I am plugged into one of the RED15W Ports. But there is no connection when I assign a VLAN-Tag to the Network-Card of my Testclient plugged into the RED15W Port. Is there anything more I need to do? Please see the attached screenshots.

PS: Gerne kannst du mich auch direkt kontaktieren.

Your dashboard indicates that the RED 15 has not connected.  What is the topology in the remote office?

Cheers - Bob

Hi Bob,

there is one router between the RED15W an the Internet, but the RED is configured as "Exposed-Host". Why do you think there is no connection? All four LEDs on the RED15W are permanent green and, as mentioned, I can connect with my non-VLAN-Network from the Remote-Office. Is there something else I need to think of?

I hadn't thought of Lukas' idea before, but I would think that you would need to create a bridge of eth0 and reds1 and then move your VLAN interfaces from eth0 to br0.  At the other end, you will need a VLAN switch with a trunk connection to one of the RED 15 ports.  If you can segment the IP addresses, you will want to do in-lab inter-VLAN routing in your VLAN switch.  Interesting question!

Cheers - Bob

I hadn't thought of Lukas' idea before, but I would think that you would need to create a bridge of eth0 and reds1 and then move your VLAN interfaces from eth0 to br0.  At the other end, you will need a VLAN switch with a trunk connection to one of the RED 15 ports.  If you can segment the IP addresses, you will want to do in-lab inter-VLAN routing in your VLAN switch.  Interesting question!

Cheers - Bob