This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VLAN, no WAN access

I looked around at other topics addressing similar issues, but the problems weren't exactly the same so I thought I'd start fresh.

I'm trying to setup a guest wifi using our existing, non-Sophos access points. I've created the VLAN, created a DHCP server for it, put it in a custom zone (Guest_WiFi). The clients are able to connect to the wifi and obtain a valid IP address, but they cannot access the internet. They can also not ping the XG

Here is the summary for the firewall rule I created:

Rule

Accept any service going to "WAN" zone, when in "Guest_WiFi" zone, and coming from any network

Source & Schedule

Guest_WiFi

Source Networks and Devices : Any
During Scheduled Time : All the Time

Destination & Services

WAN

Destination Networks : Any
Services : Any

Advanced

Synchronized Security

Source : Minimum Heartbeat is No Restriction, Clients with no heartbeat allowed
Destination : Minimum Heartbeat is No Restriction, Request to destination with no heartbeat allowed

Masquerading is ON

This thread was automatically locked due to age.

0 Keyur over 6 years ago

Hi Jeremy Hunt

Thank you for contacting us.

Did you configure DHCP on XG firewall?

Please add a static route from Configure >> Routing >> Static Routing for VLAN.

Please use packet capture and verify when you ping XG Interface IP address for "Guest_wifi" and check whether request coming to the XG or not.

For packet capture use given article - https://community.sophos.com/kb/en-us/123189 https://community.sophos.com/kb/en-us/127647
Cancel
Vote Up 0 Vote Down

Cancel
0 Jeremy Hunt over 6 years ago in reply to Keyur

Thanks, Keyur.

Yes, I configured DHCP on the XG. I'm able to get a valid IP address when I connect up.

When setting up the static route, what would I use for the destination and gateway? Would the interface be my VLAN or the phyiscal port?
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 6 years ago in reply to Jeremy Hunt

Hi Jeremy Hunt

You need to use the Interface IP through the VLAN configured.

Is your VLAN and "Guset_Wifi" zone configured on the different interface?

If it is, you required to configure VLAN zone to Guest_wifi zone firewall rule and vice versa.

It would be great if you can share the network diagram with IPschema.
Cancel
Vote Up 0 Vote Down

Cancel