Can't access any other devices on LAN using XGS136

hi,

they shouldn't be going through the xgs, just routed via the switch. sounds like a switch configuration issue.

ian

Thanks for the reply rfcat_vk,

The switch doesn't have any routing abilities, it only has L2 capabilities:

https://store.ui.com/collections/unifi-network-switching/products/usw-24-poe

You define vlans to match the sophos, you can then assign any port to that vlan.

But that's it.

No routing abilities, that's handled by the Unifi Security Gateway in the Ubiquiti ecosystem, or the Sophos in my case:

Hi,

at this stage you don't need the linked NAT, but that is not the cause of the inter VLAN connection failures.

When you review logviewer while trying to connect what if any errors do you see?

Ian

Hi Ian,

I'm seeing the following errors in logviewer"

I followed your advice in another thread and created a LAN to LAN firewall rule, but that didn't help:

https://community.sophos.com/sophos-xg-firewall/f/discussions/130523/cannot-access-other-machines-within-the-lan-zone

One curious thing, in all videos I've seen the VLANS appear in "ALL" in Interfaces, however mine don't? They only appear on the VLAN tab?

I have the latest V18 Firmware.

Many thanks, Martin

Hi,

those logviewer entries indicate that your firewalll rule for internet access has issue. Try deleting the linked NAT rule and that should provide access to the internet.

The logviewer is not showing any failures for connections within the vlAN.

Ian

Thanks Ian,

I deleted all the linked nat rules and just left the default nat rule.

All the laptops on the vlan 30 work in that they can get to the internet.

But some devices can be pinged, but others can't:

Synology 172.16.30.3 Can't be pinged.

Brother Printer 172.16.30.4 Can be pinged, but can't be seen by laptops to be added as printer.

Inspiron 172.16.30.5 Can't be pinged.

XPS 172.16.30.6 Can be pinged.

So none of the laptops can get to the Synology or the Printer.

Absolutely maddening

Thanks for all your efforts

Cheers, Martin

Thanks Ian,

I deleted all the linked nat rules and just left the default nat rule.

All the laptops on the vlan 30 work in that they can get to the internet.

But some devices can be pinged, but others can't:

Synology 172.16.30.3 Can't be pinged.

Brother Printer 172.16.30.4 Can be pinged, but can't be seen by laptops to be added as printer.

Inspiron 172.16.30.5 Can't be pinged.

XPS 172.16.30.6 Can be pinged.

So none of the laptops can get to the Synology or the Printer.

Absolutely maddening

Thanks for all your efforts

Cheers, Martin

Hi,

that appears to be a wifi AP configuration issue. Is the AP in the same network as the lan devices or a seperate network?

Ian

Hi Ian,

All devices are connected via ethernet, nothing via AP.

I've disconnected the AP to simplify testing.

Thanks, Martin

Hi Martin,

please check the firewall settings on the laptops that fail to respond to ping.

Ian

Thanks Ian, changing endpoint windows firewall didn't help.

To take the vlans out of the equation I did the following:

Bridged Ports 11 and 12 and gave it a range of 192.168.100.1/24.

Connects to the internet but the 2 laptops on these interfaces can't ping each other even though they have address .2 and .3 on that subnet.

So I've obviously messed up a firewall rule?

Cheers, Martin

Hi. I know it's been a couple months, but what was the solution? What was isolating some hosts but not others? Thanks

Hi Samuel,

I've no idea what caused the problem, I just nuked everything and started again,

Which fixed it :)