(XG) VLAN traffic showing up on unexpected interfaces

If someone detaches an APX120 and connects a different company's device then it will not seen by XG management, only be seen as a connected device. Your setup appears to be overly complex for a small XG.

Please identify for usage type, business or home?

You can lock devices by using clientless users and static IP address assignments so any unauthorised devices will not get an IP address that is in a valid user group and therefore no internet access.

Ian

Hello Ian, 

thanks for your reply - even if it’s not directly related to the routing error in question ;) 

As for your question: 
It’s a small business case, used in a holiday house with four apartments. 
The appliance has to provide WAN access, four separated networks (privacy reasons) and some QoS for bandwidth distribution. No other tasks beyond that. 
Both switch and firewall are in a locked tech room. Each apartment has an own APX due to a few reasons (coverage being one). 
If someone decides to pull the APX and hook his own device, I’m totally fine if he’s getting internet access, as long as he’s forced into the defined VLAN. 

So - I wouldn’t say it’s really overly complex?

But what’s really unnecessary is the bridge over hardware Port1-3.
Unfortunately, I realized that quite late in my setup. Means I’d have to rework all VLANs and related rule sets to get rid of that piece of beginner misconfiguration…

Hi,

thank you for the detailed answer. Using a bridge will allow traffic between segments as you have found. You can still use VLANs just without the bridge. Setup new VLANs on a spare interface add that to your rule base for each VLAN, after you are happy  with the new configuration move the cable the new interface and disable the each bridge VLAN one by one to ensure you still have connectivity via the APXs.

Ian

That is actually normal. It will be more likely a app issue. Check the app, if there is a problem. Invalid traffic is not a problem, instead just a symptom. 

Not App specific. 
E.G.: Mail App on iOS fetching Mail from four mail boxes via IMAP/port 993 - three work and keep their traffic on the VLAN interface, while the fourth shows the behavior described above. 

Hi there, 

so, i’ve removed the bridge, moved the VLANs to a spare Port without IP. 
This part has worked out so far. 

I’m still experiencing some odd behavior as stated to LuCar Toni  below.
Added a ”allow all” rule (Source zone LAN, networks any, time any / Destination WAN, network any, Service any) with all security options disabled or set to “none” to make sure I’m not blocked by my own rules. Linked NAT ist set to MASQ. 
Still, the connections behave as if there’s HTTPS scanning going on and certain sites don’t like man-in-the-middle (e.g. banking, IMAPS servers, iCloud and other Apple systems)

Do i really have to set up exceptions for these, even though I’ve completely removed the security features on my test rule?  

What about SSL/TLS Inspection. Check the destination server via logviewer and go to detailled view. 

I’ve had SSL inspection completely turned off on the rules and the respective tab (under “rules”) for testing. Same results….

p.s.: 
I‘ll set up a new try tomorrow with completely disabled SSL-engine.

Hi,

if I was setting this site up I would have a seperate firewall rule for each VLAN that makes debugging issues like this one simpler. I would not use linked NAT unless you have multiple ISP/RSP connections.

Ian