Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 22 replies
  • Answers 2 answers
  • Subscribers 30 subscribers
  • Views 3630 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

One VLAN on two physical interfaces

Delanius55

Hi,

So I have two physical interfaces and want to have the native VLAN and VLAN 10 on both of them. The first interface is connected to an wireless AP and the second is connected to a switch. The goal here is that wireless devices on VLAN 10 should be able to talk to wired devices connected to the switch on VLAN 10. VLAN 10 is for IOT-devices. 

To achieve this I created a bridge with the two physical interfaces as members. I then added VLAN 10 to that bridge. I also set up two DHCP-servers, one for each VLAN. 

Devices connected to either the VLAN 10 SSID or a VLAN 10 port in the switch are assigned the correct IP-addresses. I've setup a firewall rule that allows any host in IOT-zone to access the WAN-zone. 

The problem is that devices on VLAN 10 cant access the internet. Looking in the log, some packets are going thru but some are labelled "Could not associate packet to any connection." and are denied. Different packages with same source and destination IP are sometimes allowed and sometimes denied. The ones that are allowed have "in interface: bridge.10." The ones that are denied have "in interface: port2.". 

Devices not on VLAN 10 work just fine. 

I'm on version SFVH (SFOS 18.0.5 MR-5-Build586).

Big thanks for any advice. 



This thread was automatically locked due to age.
  • 0 in reply to Delanius55

    So I made some progress on this. Let's recap:

    On firewall port 3 is a wireless AP. On port 2 is a VLAN-capable switch. Port 2 and 3 are bridged. On that bridge are the default VLAN and VLAN 10. On the VLAN switch, port 5 is VLAN 10. Other port are default VLAN. 

    Problem 1: devices on VLAN 10 had trouble connection to internet. It seemed to work sporadically. 

    Fix: installed new firmware SFOS 18.5.1 MR-1-Build318. 

    That led me to problem 2: wired devices on VLAN 10 can not talk to wireless devices on VLAN 10. In log viewer, traffic from same device would have different "In interface" depending on if traffic was to internet or internal. Internal traffic had port 2 or 3 as "In interface". Traffic to web had "Bridge.10". To me, that is strange. I had a firewall rule set up to allow devices in IOT zone and with specific IP-range to talk to each other. That did not work.

    Fix: I changed that firewall rule so that "Zone" was "Any" instead of "IOT" and then it worked. So it seems that if "In interface" was port 2 or 3 that traffic was not in IOT-zone. Even thou it was from same device. 

    Problem 3: Wired devices on VLAN 10 can not talk to chromecast on wireless VLAN 10. If I make that wired device wireless it can talk to chromecast. To make chromecast work between different networks mDNS is needed (I think) and Sophos XG does not have this. So this is a problem because as "problem 2" seems to indicate, not all traffic that should be on VLAN10 is there. 

    Fix: well I suppose to fix this I need a proper fix for problem 2. All traffic by devices on VLAN 10 must be considered by the firewall to actually be on VLAN 10. Since this problem seems similar to problem 1 I am afraid that it's a problem that cannot be fixed by simply changing settings. Instead some firmware tinkering is perhaps needed. 

    A simple way around this is to not use a bridge and instead just use another VLAN switch. But using bridge SHOULD work so this is frustrating and adding a switch SHOULD not be needed. 

    Any thoughts? 

  • 0 in reply to Delanius55

    I'm seeing this issue as well.  Trying to set up a guest network with only access to the web. 

    Most traffic shows up on the br0.100 vlan, but then random packets show up on the physical interface port1 from the same IP.

    I've been fighting it as an issue with my APs, but after plugging into a switch with a port hard set to that VLAN, I get the same issue.  I can ping out fine, but any actual traffic has trouble.  It seems to come and go randomly.