Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 23 replies
  • Subscribers 30 subscribers
  • Views 44562 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Pfsense + Sophos XG in Bridge Mode (VM ESXi 6.5)

pdaemon

Hi,

I'm having problems getting Sophos XG up and running in Bridge Mode on VMware ESXi 6.5 in my home environment.

My current setup is:
Internet -> Modem (Bridge) -> Wan Interface (public IP) -> Pfsense -> LAN Interface (192.168.1.1) -> 16 Port Switch -> Devices (192.168.1.0/24).

This works nicely.

I would like to setup Sophos in Bridge Mode (Vmware), so I can do Web filtering etc in the following setup:
Internet -> Modem (Bridge) -> WAN Interface (public IP) Pfsense - LAN Interface (192.168.1.1) into WAN Interface Sophos XG (Bridge Mode) - LAN Interface -> 16 Port Switch -> Devices

The VMware box has Quad Port NIC card with 2 x vSwitches, one for Port 1 (LAN) and one for Port2 (WAN) with Promiscuous Mode enabled for both vSwitches.

Following this post:

https://community.sophos.com/products/xg-firewall/f/network-and-routing/76025/bridge-mode-deployment-not-working

Initial setup of the of the VM is fine (using sophos xg ISO) allowing me to access the Web Admin interface in order to continue setup and activation which works in gateway mode...

Continuing I go through the setup wizard and select Bridge Mode and setup the bridge between Port1 (LAN) and Port2 (WAN) and give it an IP (192.168.1.18)

I then remove the LAN interface cable from the pfsense box and and attach the WAN interface (Port2) to the Pfsense (LAN interface). 

I am able to get access to the Bridge IP address on 192.168.1.18, but am unable to ping the Gateway which is setup for the Bridge (192.168.1.1) - pfsense box?
I am unable to access the internet from any device on the LAN or resolve any internet hosts through the diagnostics through the admin GUI.
The status of the Bridge is showing as being red. Port1, Port2 & br0 are showing as being connected in the GUI..

I am using a cross-over cable between pfsense and vmware NIC (Port 2 - WAN)...outcome was no different to when I was using a straight through.

What am I doing wrong here? Do I need to do something on the pfsense box to make this work. I didn't think so as it is meant to be a bridge setup.
Please help.

Thanks!

Regards
pdaemon



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to pdaemon

    As per the packet-capture logs it would seem that XG did not receive any packets , So the issue lies with the client -> XG. You may need to check if the traffic is not diverted to another system instead of XG . Check the Mac address instead of host address of the arp table on your system.

Children
  • 0 in reply to Aditya Patel

    Hi Aditya,

    Thanks for the suggestion...I'll see what I can find.

    Cheers pdaemon

  • 0 in reply to pdaemon

    Please let me know if you still want me to try the VM setup?

    I think Aditya's suggestion sounds like the answer, not a VM XG issue.

    Ian

  • 0 in reply to rfcat_vk

    Hi rfcat_vk,

    I have checked and I couldn't see anything out of the ordinary in regards to the ARP tables on the box that the traffic was coming from.

    I did notice on the XG FW log that some traffic such as request to external DNS were going out of br0 IP when the requests should have been going out on Port2?

    If you have a spare moment then it would be great if you could give the VM setup a go and see if you get the same thing or it just works for you.

    I am also testing the Sophos XG bridge mode using KVM to see if that makes any difference so I'll let you know how that goes. If you get this working with VMware, I'll switch back as I would prefer to use ESXi..

    Thanks!

    Cheers pdaemon

  • 0 in reply to pdaemon

    Hi,

    all requests should be going out the br0 that is why you have setup the bridge network.

    I think you missed a point about the traffic not getting to the XG, something in your network is directing the traffic elsewhere.

     

    Ian

  • 0 in reply to rfcat_vk

    I have the exact problem. Traffic is not being redirected to else where. Enable "Allow Promiscuous Mode" on vSwitches attached to both VMs fixed it.