Sophos XG v18 IoT security setup and/or suggestion for best practices

Segregating your networks into separate VLANs is a common technique to separate your less secure devices (e.g. IoT devices) from your more secure devices (e.g. computers). However, one issue you will run into is if those IoT devices need to communicate with your secure devices since they're on separate VLANs. Many IoT devices use mDNS and Sophos XG does not have an mDNS or avahi reflector to re-broadcast mDNS from one network to another network.

Knowing this, I simply keep all of my IoT devices that utilize mDNS and need to communicate with my more secure devices locally on the same network (e.g. Apple TVs, Apple HomePods, Home Assistant, etc.). I put the rest of my less secure devices on my guest network which is a separate VLAN. You could technically host an mDNS/avahi reflector on a separate device if you wanted to, but I just haven't found the need (pretty sure if you're on this forum, your home network is probably already more secure than 99% of home networks).

Also, I'm sure you know this but since it wasn't mentioned in your original post I figured I'd just mention it. You will need a managed switch if you plan on using VLANs.

Segregating your networks into separate VLANs is a common technique to separate your less secure devices (e.g. IoT devices) from your more secure devices (e.g. computers). However, one issue you will run into is if those IoT devices need to communicate with your secure devices since they're on separate VLANs. Many IoT devices use mDNS and Sophos XG does not have an mDNS or avahi reflector to re-broadcast mDNS from one network to another network.

Knowing this, I simply keep all of my IoT devices that utilize mDNS and need to communicate with my more secure devices locally on the same network (e.g. Apple TVs, Apple HomePods, Home Assistant, etc.). I put the rest of my less secure devices on my guest network which is a separate VLAN. You could technically host an mDNS/avahi reflector on a separate device if you wanted to, but I just haven't found the need (pretty sure if you're on this forum, your home network is probably already more secure than 99% of home networks).

Also, I'm sure you know this but since it wasn't mentioned in your original post I figured I'd just mention it. You will need a managed switch if you plan on using VLANs.

Here is what I have done so far.

I setup a WiFi network for the IoT devices via UniFi.

I then created a VLAN using the LAN interface and give it a different IP address than the LAN.

I created 3 firewall rules:

One to drop connections from the VLAN to the LAN.

Allow traffic from the VLAN to WAN.

Allow traffic from LAN to VLAN.

Does this sound like an appropriate start?

Hi,

sounds good, you do not need the drop connections from VLAN to LAN.

Basically it sounds a simpler version of what I have created.

Ian

I plan to start testing the setup with one device and make sure I can get it to work.

What do I do with the hard wired cameras? Do I create a VLAN on a switch to separate them?

Hi Jason,

if your switch has the VLAN capability, that is a good way to go. You will need to ensure you have logging enabled on your firewall rules to see which ports are used so you can limit access. I have a rule for almost each device limiting them to their ports and websites.

Ian