Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 28 subscribers
  • Views 1723 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How can I configure Sophos / Dell devices to work well together

Daniel James3

I have two dell switched (s4148s) that I want to use in conjunction with Sophos XG310s.

 

I want to be able to route from a stack of dell N3000's through the Sophos device to the dell switches.

 

I have 2 Sophos devices and have them configured in HA. I want to be able to connect each of my Dell S4148s to each Sophos device. To do this I have created a LAG on ports 11/12 on the Sophos devices with an IP of 10.10.10.1 and then on the S4148s I have created a port channel with VLT setup for ports 51 and 52 on each switch. I then allow VLAN over these and assign the VLAN an IP address of 10.10.10.2

Once I setup the routing sometimes the pings work and sometimes it doesn't, all I can think of is that the 2 spare ports from the S4148 port channel that is plugged in to the HA unit is causing packets to drop. I expected the 2 ports on each switch that was active to only allow packets and then if the Sophos device failed over the other 2 ports would come online with connections to the 2 dell switches allowing for seamless failover. However I am having issues setting this up.

If I take the 2 ports that are connected to the HA device out of the port channel, the pings are perfect and I cant see any packets dropped.

Any help is appreciated with what I should do or if I should look at a different solution etc! I have attached a really bad picture to show setup.



This thread was automatically locked due to age.
Parents
  • 0

    I think you should make two port channels on the switch side and make a LAG on each firewall.

    You should also verify how the decision is made through which line the return packets are send back. AFIK the port does not go down on the passive switch so the retung packets might be send to a dead end (the passive sophos)

     Or make a complete mesh and try to use some spanning tree protocol to disable redundantant paths.

Reply
  • 0

    I think you should make two port channels on the switch side and make a LAG on each firewall.

    You should also verify how the decision is made through which line the return packets are send back. AFIK the port does not go down on the passive switch so the retung packets might be send to a dead end (the passive sophos)

     Or make a complete mesh and try to use some spanning tree protocol to disable redundantant paths.

Children