Bridge Wifi Protection to Physical Port

Hi Brian Hawkins,

Have you tried out the steps listed in this KB?

Best,

FloSupport | Community Support Engineer

This is an XG 310, latest OS.  There is no internal wireless card, we have 11 Sophos AP's attached and this is a non primary wireless network it uses the tunnel back to firewall. Our primary network already bridges to AP Lan. When I went into Sophos Bridge configuration there was only physical Ports available for me to setup. I was hoping to not have to setup a VLAN on the switches if at all possible. They are not the easiest to configure. 

Brian,

in order to bridge your external AP, you do not need to bridge internal and AP NIC card (it does not even exist), but go to wireless and crete a Wireless Network (Client Traffic > Bridge to AP LAN), that's all.

Regards

Brian,

in order to bridge your external AP, you do not need to bridge internal and AP NIC card (it does not even exist), but go to wireless and crete a Wireless Network (Client Traffic > Bridge to AP LAN), that's all.

Regards

Quick question and maybe this is just my understanding of that setting, but if I set that would it route the traffic to the same LAN as the access point? Or is all traffic tunneled first to the XG and then routed back to the proper interface? I need to keep this traffic isolated to its own network, and not the network that the AP's are installed to.  Until recently I had just setup a WiFi protection scheme with its own DHCP range and firewall rules that kept this data off our network. 

Brian Hawkins said:

Quick question and maybe this is just my understanding of that setting, but if I set that would it route the traffic to the same LAN as the access point? Or is all traffic tunneled first to the XG and then routed back to the proper interface? I need to keep this traffic isolated to its own network, and not the network that the AP's are installed to.  Until recently I had just setup a WiFi protection scheme with its own DHCP range and firewall rules that kept this data off our network. 

 

This server, I assume is on your LAN in the LAN Zone.

The WiFi is in a separate Zone.

Build a firewall rule between WiFi zone, any and LAN Zone + Server IP only.  Restrict it to the protocols/services you need to pass from WiFi to LAN.

Assuming you get DHCP on WiFi zone from Sophos XG and the Sophos XG is configured as the gateway to the WiFi Zone (on the wiFi Zone IP subnet), then this should work.

Brian,

you need to create a separate zone and create proper firewall rule to allow traffic back and forth. If you bridge the AP to LAN, XG will be not able to filter traffic on the same LAN.

Regards