Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 2 answers
  • Subscribers 29 subscribers
  • Views 462 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Configure and Test Best Practice

JeffCooper

Hi,

(First, apologies. If this question makes more sense in the UTM forums I'll start there, but I imagine doing it wrong would cause problems with my XGS too before I even get started.)

After many years, and some trepidation, I'm moving from a UTM to an XGS. I've given myself what I hope is plenty of time to sort this out, so this will likely be the first of many "stupid questions."

We have a not-very-complex network and I'm planning on setting up the new gateway from scratch rather than any migration tools because I'm sure I have a solid 13 years of garbage/bad-settings sitting in my UTM and I'd like too start clean. Also, I'd obviously like to test things as thoroughly as I can.

I'm thinking I'll set up my XGS with a made-up temporary WAN address that I'll connect to the DMZ of my UTM. I'll also assign different addresses (what the UTM calls "Additional Addresses" in the same DMZ network for my various services (mail, web, etc). Then, after it's all set up, I'll shut off the old UTM, change the WAN addresses of my XGS to the real ones, and plug it in.

Since no real traffic will go to the XGS while it has this temporary "pseudo-WAN,"  I don't see a way to really test things (obviously, I'm limited anyway since my servers are connected the other machine). Is there a better way to do this?

I'm not sure how I can test various things besides coming into work in the middle of the night, swapping out the gateways temporarily just to see what goes wrong, then put there old one back while I work out the issues. 

Thanks,

Jeff



This thread was automatically locked due to age.
Parents
  • 0

    Actually it is quite easy depending on the traffic and network you are working with.

    First of all, it is 2022, you should have VLAN in place by now. If you have VLANs in place, you can simply participate the SFOS Appliance in the same VLAN Segment like UTM. SFOS is not the gateway per default. For example: UTM is doing DHCP for 192.168.1.0/24. UTM is 192.168.1.1, SFOS will get 192.168.1.2. So you could move a client to use 192.168.1.2 as a Gateway and the traffic will transferred to the SFOS appliance. (BTW: Sophos is offereing a small 8 Port switch with VLAN Management, if you do not use VLAN by now. Or get a VLAN capable switch). 

    On WAN, you will do the same approach, if you have a ISP router in front of the UTM. 192.168.0.0/24 etc. If the UTM uses a direct PPPoE, then connect one cable directly from SFOS to UTM. Then MASQ on SFOS to UTM. The UTM will simply forward and MASQ again everything from this Port. 

    Same for Services, the UTM offers like IPsec. You will DNAT on UTM something like IPsec directly to the SFOS. You can do this on a "per peer basis". So one IPsec Tunnel will get transferred directly to the SFOS and SFOS will pickup the tunnel. Same for WAF etc. You can do this service by service. 

    But it all comes down to VLANs. Even in smaller setups (like 8 Port Switches) it is possible to have VLAN and you should by now start to segment networks. (Split IoT and clients etc.). 

    __________________________________________________________________________________________________________________

Reply
  • 0

    Actually it is quite easy depending on the traffic and network you are working with.

    First of all, it is 2022, you should have VLAN in place by now. If you have VLANs in place, you can simply participate the SFOS Appliance in the same VLAN Segment like UTM. SFOS is not the gateway per default. For example: UTM is doing DHCP for 192.168.1.0/24. UTM is 192.168.1.1, SFOS will get 192.168.1.2. So you could move a client to use 192.168.1.2 as a Gateway and the traffic will transferred to the SFOS appliance. (BTW: Sophos is offereing a small 8 Port switch with VLAN Management, if you do not use VLAN by now. Or get a VLAN capable switch). 

    On WAN, you will do the same approach, if you have a ISP router in front of the UTM. 192.168.0.0/24 etc. If the UTM uses a direct PPPoE, then connect one cable directly from SFOS to UTM. Then MASQ on SFOS to UTM. The UTM will simply forward and MASQ again everything from this Port. 

    Same for Services, the UTM offers like IPsec. You will DNAT on UTM something like IPsec directly to the SFOS. You can do this on a "per peer basis". So one IPsec Tunnel will get transferred directly to the SFOS and SFOS will pickup the tunnel. Same for WAF etc. You can do this service by service. 

    But it all comes down to VLANs. Even in smaller setups (like 8 Port Switches) it is possible to have VLAN and you should by now start to segment networks. (Split IoT and clients etc.). 

    __________________________________________________________________________________________________________________

Children
No Data
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?