Sophos XG and Layer 3 Switch

Question

Good day everyone, 
 I have been asked to update our network so our data demands can be met. Currently, we run a conventional flat network and our Sophos XG is routing all the traffic. THru my research I think the best solution is to design the network around a Layer 3 switch, and some switch equipment capable of higher speeds or lets say its switching fabric is much higher than currently. 
 However, I have never worked within a Layer3 network, let alone maanage one. Pretty sure the ocmpany is going to end up upgrading to some Ubiquiti equipemtn to accomplish this upgrade due to budget. My biggest questions are does the Layer 3 switch then also become the DHCP server for the various VLANS and what does this look like to the XG. 
 
 Scenario: Create a VLAN on the Layer3 switch VLAN50 with a subnet 192.168.50.0/24 and the XG is on 192.168.10.0/24 do I then have to add the VLANS to the XG plus add a static route for each VLAN? The bad part we have a production network that runs 24/7 so getting things is obviously critical but I do have access to second XG that I can play with and do a mock setup. Will the 2 subnets auotmatically talk to one another as well, inter-vlan communication. 
 Any advice , greatly apprecaited.

Erick Jan · Answer

Hi, 
 Thank you for reaching out to Sophos Community. 
 For the DHCP Question, Either the L3 Switch or XG can be the DHCP Server. 
 For Sophos Configuration the following 
 
 Create a subinterface on the Physical port connecting to your L3 Switch 
 Create DHCP(Set interface to vLAN) 
 Create a FW rule allowing to WAN/LAN 
 
 You may also refer to the following 
 
 https://www.youtube.com/watch?v=SakDwzF1spw 
 www.youtube.com/watch

LuCar Toni · Answer

Essentially this is an outdated scenario. L3 Switches were build in a time of "you need high switching capabilities". But nowadays, Firewall hardware is able to compete in those throughput numbers, making the switching job a job for the FW instead. 
 In the old days, you basically did not care about ACLs or anything "security relevant", instead you needed the speed and essentially build up a flat network. Nowadays, in times of "i want to inspect or block traffic in my network" you need a firewall as a L3 Router in your network. 
 So i would highly recommend not to fallback to the old pattern, instead creating all VLANs on the the firewall and do the routing on the firewall. (given you have a firewall which meets your needs).

Sophos XG and Layer 3 Switch

Top Replies