XG blocks everything in "bridged" mode

Hello,

If you are using VLAN tagged traffic you need to add VLAN interfaces to the firewall otherwise the tagged traffic will be dropped. See the below KB

https://community.sophos.com/kb/en-us/123127

Let me know if this helps.

I cannot add a VLAN interface to a bridge.

Well, if I take XG out, and connect the switch to the router correctly, both internet- and inter-vlan routing are working fine. So, I guess routing itself is working fine.

OK that's good to hear. 

If you contact support so they can take a look I'm sure we can get this resolved for you.

Thanks, I received my license, and created a support case for it.

Great!

If you private message me the case number I will add some notes for the engineer. 

Sam,

Would it be possible to post screenshots of the firewall rule you are using? I want to be sure that my firewall rule is correct.

Do you have anything configured in NAT&Routing section of the firewall rule?

I have attached a screenshot of the firewall rule I was using to test. No NAT/masquerading was used. 

I can see an engineer has been assigned to your case. Hopefully they can take a look for you. 

Seems identical to mine. There is no need to define an explit "WAN" to "LAN" rule?

Maybe one more question: I've reading some things that a cross-over cable is required between the WAN port and the router? Is this true?

XG is based on Cyberoam, and the Cyberoam documentation mentions this: https://community.sophos.com/kb/en-us/131062

Or is this no longer necessary on XG?

No need for the WAN to LAN rule if you have the any rule.

Yes it's best practice to use a crossover cable to connect same type devices (router to router/switch to switch).

Do you have one you can try?

Hi Jeroen,

It looks like you managed to resolve this issue by re-configuring the firewall is that right?

If the issue has been resolved could you mark this thread as answered?

Thanks. 

What resolved it? I had the same issue, spent seven hours before giving up.

What resolved it? I had the same issue, spent seven hours before giving up.

I never managed to solve it. The only way I got it working with multiple VLAN's is by using gateway mode.

Despite what everyone tells you, you DO need to create a VLAN interface in all the subnets (which is not possible in bridged, at least when I used it).

I've used it gateway mode for a while, but now I've given up and switched back to my Ubiquiti EdgeRouter, which seems to be a far superior product for my use-case. It might not have the same QoS or webfiltering, but at least it does routing and IpSec right...