Sophos XG - access one internal network to another

Hi GernotMeyer,

Thank you for reaching out to the Community! 

Have you configured the Alias IP on the WAN interface with the subnet mask /32? 

If not, try to change it to /32 and see if that helps. 

Thanks,

Hi GernotMeyer,

Thank you for reaching out to the Community! 

Have you configured the Alias IP on the WAN interface with the subnet mask /32? 

If not, try to change it to /32 and see if that helps. 

Thanks,

Thanks for answer but no success ;-(

Hi GernotMeyer,

Thank you for the update. 

In that case, could you please provide the screenshots of the configured rules? Did you try to add a User zone in the source zone along with the MAIL? 

Have you configured email protection on the XG firewall? If yes, what did you configure for SMTP operation mode?

Thanks,

WAN Port

Mailserver

SMTP is configured in MTA Mode.

IMAP Rule

Corresponding DNAT Rule

Any more Infos needed?

This is not /32 IP alias... /32 = 255.255.255.255

I wrote that  also tried /32:

Also no Success:

This will still not work if I understand your network I think you still have misconfiguration...

You have for example WAN IP:

246.222.141.200/27(Port8:0) USER ZONE

246.222.141.199/32(Port8:1) MAIL ZONE

So

246.222.141.200/27 USER ZONE:

HostMin:   246.222.141.193
HostMax:   246.222.141.222

246.222.141.199/32 MAIL ZONE:

HostMin:   246.222.141.199
HostMax:   246.222.141.199

So USER ZONE think that IP from MAIL ZONE is in same network.

Did you try setup also 246.222.141.200/32 ? With both on /32 they will look on router for routes to know where they must reply...

If you use domain to connect to 246.222.141.200 you can also maybe solve connection and routing issue if you make static DNS host entry which show to internal IP of mail server like this:

And then make some local firewall rule and NAT rule to connect locally...

In your case I will first try both WAN IP set to /32(255.255.255.255) and check logs/packets what happen...

OK. I try again:

Mail Zone: 10.11.28.8/29, Sophos .9,Mailserver .10 external IP (DNAT Rule) .199

Terminalserver Zone: 10.11.29.1/29, Sophos .1,Terminalserver .10 external IP (SNAT Rule) .195

Because System is productive: I can make these changes the next evening and set Alias IPs to /32 then.

After that I come back to you.

What I do not understand: The Web Connection (from Termnalserver to Mailserver is fine. Also SMTP.

"Only" DNAT is in trouble.

Hi,

I changed Alias WAN IPs to /32. Still works as before;-)

But nothing becomes better with my DNAT Rules.

WAF is working, DNAT rules not (from same server).

I also changed DNAT Rule for to both internal Networks to use IP (.199).

I also created Routing-Rules to go directly from one network to the other. That works! So I get it running without accessing the external interface.

Hi, coming back to this. I am trying to understand how the XG works, when using /32 mask for alias.

When configuring an alias I normally use same subnet as the IP based on the port itself (usually/often aliases are defined on WAN interface, when the provider provides an IP range on the iternet). This is also decribed here: https://support.sophos.com/support/s/article/KB-000035684?language=en_US.

I wonder why also /32 works.