Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 2 answers
  • Subscribers 28 subscribers
  • Views 5827 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Question regarding VLANs

Seth Malchow

My limited experience with networking involves Cisco, so bare with me on this.

 

I'm not understanding why I need to IP an interface after I've created a VLAN on that same interface.The only way I can get this to work is if I put some bogus IP on the physical interface.

My actual DMZ network below is 10.0.41.0/24. What I'm used to is creating a subinterface, IPing that, and leaving nothing on the actual physical interface. I'm sure I'm missing something here but I'm not sure of what.

 



This thread was automatically locked due to age.
Parents
  • 0

    Hi Seth,

    What you are doing is the correct way to implement a VLAN on an interface that does not have a native VLAN (or isn't used) on a Sophos XG device. The 'primary/physical' interface must have an IP address set, however it does not need to be valid (or used). I believe we have used IPs in the 127.0.0.10-40 range before, or at least a range that is never used. Your example, including a 255.255.255.255 subnet mask is perfect.

    I would also consider creating a separate zone for the physical interface for the ultimate security - no services bound under appliance access, and no rules created.

    Kind Regards;

    Dave

Reply
  • 0

    Hi Seth,

    What you are doing is the correct way to implement a VLAN on an interface that does not have a native VLAN (or isn't used) on a Sophos XG device. The 'primary/physical' interface must have an IP address set, however it does not need to be valid (or used). I believe we have used IPs in the 127.0.0.10-40 range before, or at least a range that is never used. Your example, including a 255.255.255.255 subnet mask is perfect.

    I would also consider creating a separate zone for the physical interface for the ultimate security - no services bound under appliance access, and no rules created.

    Kind Regards;

    Dave

Children
No Data