Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 10 replies
  • Answers 2 answers
  • Subscribers 28 subscribers
  • Views 1263 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Assistant with setting up MPLS

notapplemaxwindows1

Hi All, 

I am having trouble getting my MPLS to working between 2 Sophos firewalls. 

Here is my topology:

I have tried putting routes in place etc.. but cannot get it to work and just getting confused now. Is anyone able to confirm what I need to do to get traffic flowing over the MPLS Circuit?

I have the relevant firewall rules in place for site A subnet to site B subnet, but I would love it if someone could help?

Thanks all!



This thread was automatically locked due to age.
Parents
  • 0

    We have set this up sucessfully. With a) internet breakout at the MPLS Provider and b) with dedicated internet breakout. And c) with default route 0.0.0.0 and breakout on another site. On the central site basically like the setup on the picture: Terminating MPLS on a router/switch that is connected to the firewall.

    You need to set the proper static routes. You need also to define the policies (setting up explicit deny rules on both sides + putting on logging and traceroute from both sides should help).

    You also need to be sure that the local networks are actually transmitted through the MPLS (ask your provider).


  • 0 in reply to BeEf

    Thank you for the response. Would you say putting the following routes in place are correct in my setup above (with only 2 sites)

    SITEA: 

    Destination: 10.0.1.0/24

    gateway: 172.16.11.1

    interface: 172.16.11.2

    SITEB:

    Destination: 10.0.0.0/24

    gateway: 172.16.10.1

    interface: 172.16.10.2

    Then have a LAN to LAN firewall rule for the local subnets 10.0.0.0/24 and 10.0.1.0/24?

    Do I need to do any specific NAT rule or MASQ?

  • FormerMember
    0 FormerMember in reply to notapplemaxwindows1

    Hi ,

    Check out the following Community thread for a more detailed explanation: https://community.sophos.com/xg-firewall/f/discussions/74536/routing-with-mpls

    Thanks,

  • 0 in reply to FormerMember

    Thanks Harsh, I think my next steps will be try another route. I am going to create a new MPLS Zone and assign that to my MPLS port. I will then use SD-WAN policy route to route my traffic over the MPLS (will do the same on both ends) I will enable reply packet's for this and put the necessary rules in place. What are your thought on this method? I will then create a gateway for IPSEC and add that as the secondary. 

Reply
  • 0 in reply to FormerMember

    Thanks Harsh, I think my next steps will be try another route. I am going to create a new MPLS Zone and assign that to my MPLS port. I will then use SD-WAN policy route to route my traffic over the MPLS (will do the same on both ends) I will enable reply packet's for this and put the necessary rules in place. What are your thought on this method? I will then create a gateway for IPSEC and add that as the secondary. 

Children
No Data