This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VLAN Routing problem over dark fiber

Hello everybody

I have the following scenario here:

Internal network 10.10.2.0/24 / Sophos XG 210 / SFOS 17.5.11 MR-11
remote network 10.10.4.0/24 / Sophos XG 210 / SFOS 17.5.11 MR-11

We have a static VPN tunnel between the two sites, everything is going very well.

Now we have an additional backup line (Dark Fiber) and we would like to use it for site replication / backup. The Dark Fiber supplier routes all VLAN's transparently.

We have now created a VLAN10 on port 5 at both locations and put the VLAN in a separate zone.

Internal VLAN 10.10.10.254
remote VLAN 10.10.10.253

We can ping each other's remote VLAN interface, but we cannot reach the LAN behind it.

We followed the suggestions from https://community.sophos.com/products/xg-firewall/f/network-and-routing/73278/vlan-traffic-issues#pi394filter=all&pi394scroll=false and https://community.sophos.com/products/xg-firewall/f/network-and-routing/73322/inter-vlan-routing, but without success.

Can anyone give us a tip in the right direction where the problem could be or how we can solve it?

Thanks...

This thread was automatically locked due to age.

0 Keyur over 5 years ago

Hi MarkusSonderegger

You required firewall rule for LAN to Zone to newly added VLAN zone firewall rule, i.e LAN TO VLAN and VLAN to LAN in each firewall.

Please check packet capture to traffic - https://community.sophos.com/kb/en-us/123189
Cancel
Vote Up 0 Vote Down

Cancel
0 MarkusSonderegger over 5 years ago in reply to Keyur

Hi Keyur

We already did that...no luck so far...

Site A

Site B
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to MarkusSonderegger

Hi MarkusSonderegger

Could you please removed #Port5.10 from the source and destination from both firewall rules and try? Please also check with traceroute to remote system IP and share the output.
Cancel
Vote Up 0 Vote Down

Cancel
0 MarkusSonderegger over 5 years ago in reply to Keyur

OK we removed the #Port5.10

Here ist the traceroute from Sophos on site A

Trace target is a host on the LAN site of Site B

same on site B to site A
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to MarkusSonderegger

Hi MarkusSonderegger

Please apply MASQ NAT in the firewall rule and also try traceroute from the user system, please add static routes in the XG firewall if needed and check packet capture using the article shared in the previous response.
Cancel
Vote Up 0 Vote Down

Cancel
0 MarkusSonderegger over 5 years ago in reply to Keyur

Hi Keyur

Thx, i'll give this a try and report back. This could take some days...i m currently absent until the end of the week.
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to MarkusSonderegger

Hi MarkusSonderegger

Sure, please let us know once you check and share the result.
Cancel
Vote Up 0 Vote Down

Cancel