Setting up Bridge mode in XG V19

Hello Chevyavalanche,

Thank you for reaching out to the community, please find the useful docs and KBs below: 

> Setting up Bridge: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Network/Interfaces/NetworkBridgeInterfaceAdd/index.html

> Configure gateway load balancing and failover: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Routing/Gateways/RoutingConfigureGatewayBalancing/index.html

> To turn off NAT, go to Rules and Polices > NAT rules > browse through the NAT rule you wan to turn it off > hover over the 3 dot option > click and toggle off the NAT rule.

> Swapping WAN and LAN ports: You can simply edit the interface and change the zone and IP address information: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Network/Interfaces/NetworkPhysicalInterfacesEdit/index.html

> Regarding the VPN network query, you can control the protection with the Firewall rules, depending upon what zone you configure and which zones you want to be communicating between and what polices, IPS, web or application filter you want to allow !! 

> Firewall rules: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/FirewallRules/index.html

> Create a firewall rule with a linked NAT rule: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/NATRules/RulesPoliciesCreateFirewalRuleWithLinkedNATRule/index.html

Hello Chevyavalanche,

Thank you for reaching out to the community, please find the useful docs and KBs below: 

> Setting up Bridge: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Network/Interfaces/NetworkBridgeInterfaceAdd/index.html

> Configure gateway load balancing and failover: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Routing/Gateways/RoutingConfigureGatewayBalancing/index.html

> To turn off NAT, go to Rules and Polices > NAT rules > browse through the NAT rule you wan to turn it off > hover over the 3 dot option > click and toggle off the NAT rule.

> Swapping WAN and LAN ports: You can simply edit the interface and change the zone and IP address information: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Network/Interfaces/NetworkPhysicalInterfacesEdit/index.html

> Regarding the VPN network query, you can control the protection with the Firewall rules, depending upon what zone you configure and which zones you want to be communicating between and what polices, IPS, web or application filter you want to allow !! 

> Firewall rules: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/FirewallRules/index.html

> Create a firewall rule with a linked NAT rule: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/NATRules/RulesPoliciesCreateFirewalRuleWithLinkedNATRule/index.html

Thank you Vivek! Appreciate the help.

You're welcome Chevyavalanche !!

Hi Vivek, 

Was able to set up the bridge and connect to new IP that was set up so thanks again for the direction. I will say that when trying to save the Bridge configuration, I continued to get an error stating: Could not save the config due to either 1) Could not connect to the device OR 2) Operation was terminated by user. I continued to get this error multiple times but somehow, my Bridge config was saved. Then when I came back to modify this config, this error continues to persist and I have no idea why this happening, especially since I am connected to the XG s/w. 

Concerning firewall rules, do rules have to specifically be set to allow LAN to LAN and WAN to LAN/LAN to WAN connections? I want to be able to connect to all devices in my network via any PC/tablet as well as to the router. Right now, it appears the only way I can connect to XG s/w is directly from a laptop connected to the device running XG and not through the 'normal' connection of Router to XG to switch to devices. So when XG is connected to switch, I can't get to it. Obviously I want to start out very simple and just get devices to talk to one another and then build in the security over time.

Thank you again for the help.

Sure, feel to drop in here whenever you need assistance Chevyavalanche...
------------------------------------------------------------------------------------------------------------
Regarding your concern to firewall rules, making an explicit rules based on your organization requirement is always a best practice.
As everything on the SFOS whether the allow/deny/ polices such as web, application filter, IPS polices, scanning,..etc. is controlled from the FW rule and the priority works from top to bottom.