Pfsense + Sophos XG in Bridge Mode (VM ESXi 6.5)

Ji,

why do you think you need two firewalls in tandem?

You will need a 3rd nic on the XG to be able to access the management functions.

What rules do you have in place?

Ian

Hi rfcat_vk,

I am using Pfsense as my firewall and just want to use Sophos XG for the Web filtering and reporting side of things..

I have a LAN to WAN rule any-any rule in place on XG...this was done during the setup of the bridge-mode.
I'll probably have to see if there is anything being blocked on the FW?

I can post some screenshots a bit later on..

I can access the Sophos Admin GUI via the IP address assigned to the bridged interface (192.168.1.18) or can see the console in VMware ESXi.

Cheers pdaemon

Hi ,

You may take a packet capture on the XG to check if the packets are processed by XG or not. 

You may use a test ip e.g. 103.23.140.55

In XG you may use the command to analyze the connection from your local PC to WAN gateway. 

console>tcpdump 'host 103.23.140.55 and port 80

Post the output. If you have received the packet to XG and not forwarded to WAN interface, check the firewall rules . If the packet is observed then you may need to check your adapters and the settings.

Hi Aditya,

Thanks for the reply. 

I have tried what you suggested, but I am unable to see any packet for the IP I'm using being captured on the XG console when I browse to that address on a computer on my LAN.

203.173.50.151 - iinet.net.au

SFVH_SO01_SFOS 16.05.6 MR-6# tcpdump 'host 203.173.50.151 and port 80'
tcpdump: Starting Packet Dump
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel

I can ping all address on the LAN that are up...for example:

SFVH_SO01_SFOS 16.05.6 MR-6# ping 192.168.1.150
PING 192.168.1.150 (192.168.1.150): 56 data bytes
64 bytes from 192.168.1.150: seq=0 ttl=64 time=7.584 ms
64 bytes from 192.168.1.150: seq=1 ttl=64 time=3.923 ms

But I am unable to ping the gateway (192.168.1.1):

SFVH_SO01_SFOS 16.05.6 MR-6# ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1): 56 data bytes
^C
--- 192.168.1.1 ping statistics ---
4 packets transmitted, 0 packets received, 100% packet loss

It is like the bridge is not passing the traffic through? I shouldn't need to change anything on my LAN side in order for this to work in bridge mode?

I have attached some pics of config:

If I remove the cross-over between the WAN interface vmNic2 and the pfsense LAN port (leaving vmNic1 LAN in - Port1) and plug pfsense straight into switch (as per original config)...it is working fine and sopho xg can ping etc, but isn't in bridge mode as it's just connected into the switch...

Thanks for you help!

Cheers pdaemon

Anymore ideas? Maybe it's a VMware setup issue.

I'm considering wether to just install Sophos in GW mode on my physical Pfsense box...

Why do you need the crossover cable, most modern NICs can auto-negotiate?

Can you ping and traceroute from the XG using the test tools?

Ian

Hi rfcat_vk,

I tried the cross-over to see if that would make any difference (which it didn't) as it was shown in bridge setup diagram in the setup wizard...also as this is a computer to computer connection (pfsense is j1900 mini pc +VMware is a intel i7)...

I have switched back to the straight through CAT cable.

From the XG I can ping/traceroute to all devices on the LAN (192.168.1.X) subnet, but it seems that no traffic is passing through the WAN interface (Port2) out through to pfSense. There are link lights on both sides.

It woudn't be anything on the pfSense side right? The packets should just be getting passed through the bridge as if they were coming straight from the LAN into Pfsense?

Thanks for all your help so far!

Cheers pdaemon

Hi,

two things.

1/. you will need more than 2gb of ram, give it at least 4gb

2/. change your rule (source) any zone -> any host -> (destination) any zone -> any host -> log

Ian

Hi rfcat_vk,

Thanks, I'll increase the RAM and implement the FW rule as you suggest and see what happens.

I'll post the FW logs if I see anything interesting..

I'll send an update later today...

Cheers pdaemon

Make sure the memory is a fixed value.

Ian

OK, will do.

Thanks.

Cheers pdaemon

OK, will do.

Thanks.

Cheers pdaemon

I had the same issue with XG MR5 and MR 6 on Esxi 6.5. I changed over to XEN Server and it worked perfectly. I suspect that its an issue with Exsi 6.5, however I couldn't afford to spend too much time figuring it out. I know this doesn't add much but it may give some clue where to look. I do look forward to hearing if you solve the problem because it caused me untold hours of headaches.

 - Nick

something else to test. Currently have a 6.5 vmserver doing nothing.

Ian

Hi NickKeene,

Thanks for the reply and good (but not good!) to hear I'm not the only one that's had the same problem.

I'm going to do some more investigation shortly.

Cheers pdaemon

Hi rfcat_vk,

Looking forward to seeing if you find anything....maybe it's just something really simple we're missing!

Cheers pdaemon

Hi rfcat_vk,

Increased RAM to 4GB and put ANY-ANY FW rule in place and still no difference.

I have also flushed all ebtables rules just in case there was something there, but nothing...

Cheer pdaemon