Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 20824 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Getting WiFi Users in a Separate Zone to access the Internet

oliver.braun

Hi everyone,

I've recently setup a Sophos XG 210 Firewall in our company's network. Before this, we were using two Sophos UTM appliances.

To re-enable our users to access the internet through our WiFi, I created two WiFi-Networks:

-> INTERNAL - for our Devs and IT personnell, to access out internal network and the internet. Briddged to AP LAN. Works fine.

-> GUEST - for our employees that want to use our WAN for their phones, etc. Set to be in a Separate Zone. Client isolation is enabled. DHCP server is set up and working. I also created a firewall rule allowing traffic from the WiFi zone to the WAN zone. With those settings, internet access is not possible.

I tried some different settings, but without any success. As the concepts behind XG and UTM are a little different, maybe I'm missing out something?

I hope someone can point me into the right direction here.

Thank you very much in advance!

Best regards,

Oliver



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to lferrara

    Hi Luk,

    this is my configuration so far:

     

    The DHCP server is configured on the XG, and the connected clients are receiving IP-Addresses without problems.

     

    Best regards

    Oliver

  • 0 in reply to oliver.braun

    Add an Allow DNS rule at the top which allows dns requests from ALL internal zones to the WAN zone to pass through. Also enable NAT policy for the Wifi to WAN rule

    These are the three pre-requisites when configuring a separate zone:
    •Create a DHCP server for the wireless network on that interface
    •Add the interface to the allowed networks for DNS if it is a guest network
    •Create firewall and NAT rules that include Web protection, IPS policies, and any other security modules to protect the users