Adding VLAN to a bridge pair interface?

Hi,

Take a look at this KBA:

https://community.sophos.com/kb/en-us/123508

Cheers

Thanks.

Maybe i should have explained this clearly, i am looking to create sub interfaces on a bridged interface.  This is currently working on a singe port but not when a bridged interface is created.

One of the biggest fondamental missing feature in XG.

No way to create subinterface in a bridge. There is even a post from AlanT who wrote a thread asking for what we need to implement on bridge feature. I really hope they will allow VLAN on bridge into v18.

This is a shame!

Please vote this feature request:

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/16903630-bridge-like-utm9

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/11700537-allow-vlans-to-be-added-to-a-bridge

Thanks

Waghelak,

Unfortunately if you're looking to associate a tagged VLAN to a bridge interface pair this feature is not yet supported on the SFOS XG firewalls. As you have indicated you can associate a tagged VLAN interface to a stand alone interface. We can associate an Address Alias to a Bridged interface pair. We've run in to this when a public IP block is being routed to us over a single gateway, but I don't think this is what you're looking for..

In the event you are looking to actually create a tagged VLAN with a parent bridged interface pair this isn't available on the SFOS v17. However, this is a feature supported in the Sophos SG UTM OS. Including a screen shot of how this would like in SG UTM 9 OS.

Regards,

Firewalls.com Inc.

Get Secure. Stay Secure.

Thanks Luk

Just voted for it, here's hoping.

I had this working on the UTM hence wanted to replicated. 

It's a shame simple features as such is missing from the device.

This is the AlanT's thread:

https://community.sophos.com/products/xg-firewall/sophos-xg-beta-programs/v16beta/f/sfos-v16-beta-feedback/79102/xg-and-vlans-on-bridges---feedback-needed/360690#360690

XG DOES support controlling vlans on bridges today. If you want to web filter, IPS scan, firewall, sandbox, etc.. traffic inside VLANs that are passing over a bridge, XG will do that today, and is far superior to what UTM9 offers, and you do not need sub interfaces on the firewall to do it. you just create whatever rules you want,and they will apply seamlessly to all traffic passing over the bridge. Even when filtering web traffic, showing block pages, etc.. and having the resultant outbound request going out the expected vlan gateway, will all work exactly as you would hope, and is far superior to what UTM9 offers for similar scenarios. If that fits your goals, then you're all set with XG as it stands today. It can sit as a near invisible bump in the wire, and give you all the filtering you might need, and covers the needs of roughly 90% of the customers using VLANs and bridges today, on UTM9.

If you want to have XG sit as a bridge, yet also act as a router between different VLANs, this requires you to create sub interfaces on top of the bridge, and is not possible in v17 today. That functionality and currently targeted for v18. This is a much less common scenario, so depending on your needs, it is very likely that XG will meet your VLAN/bridge needs today. 

Hi AlanT

Thanks for your response, unfortunately i need the XG to act as a bridge and also a router hence i need the functionality to route between VLANs.  I am hoping  v18 brings all the features as promised.  Initially i believe this feature was to be on the v17 but didn't make it.

Thanks

It was considered for v17, but never planned. It's currently planned for v18, along with a number of significant interface improvements.