Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 23 replies
  • Subscribers 30 subscribers
  • Views 44572 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Pfsense + Sophos XG in Bridge Mode (VM ESXi 6.5)

pdaemon

Hi,

I'm having problems getting Sophos XG up and running in Bridge Mode on VMware ESXi 6.5 in my home environment.

My current setup is:
Internet -> Modem (Bridge) -> Wan Interface (public IP) -> Pfsense -> LAN Interface (192.168.1.1) -> 16 Port Switch -> Devices (192.168.1.0/24).

This works nicely.

I would like to setup Sophos in Bridge Mode (Vmware), so I can do Web filtering etc in the following setup:
Internet -> Modem (Bridge) -> WAN Interface (public IP) Pfsense - LAN Interface (192.168.1.1) into WAN Interface Sophos XG (Bridge Mode) - LAN Interface -> 16 Port Switch -> Devices

The VMware box has Quad Port NIC card with 2 x vSwitches, one for Port 1 (LAN) and one for Port2 (WAN) with Promiscuous Mode enabled for both vSwitches.

Following this post:

https://community.sophos.com/products/xg-firewall/f/network-and-routing/76025/bridge-mode-deployment-not-working

Initial setup of the of the VM is fine (using sophos xg ISO) allowing me to access the Web Admin interface in order to continue setup and activation which works in gateway mode...

Continuing I go through the setup wizard and select Bridge Mode and setup the bridge between Port1 (LAN) and Port2 (WAN) and give it an IP (192.168.1.18)

I then remove the LAN interface cable from the pfsense box and and attach the WAN interface (Port2) to the Pfsense (LAN interface). 

I am able to get access to the Bridge IP address on 192.168.1.18, but am unable to ping the Gateway which is setup for the Bridge (192.168.1.1) - pfsense box?
I am unable to access the internet from any device on the LAN or resolve any internet hosts through the diagnostics through the admin GUI.
The status of the Bridge is showing as being red. Port1, Port2 & br0 are showing as being connected in the GUI..

I am using a cross-over cable between pfsense and vmware NIC (Port 2 - WAN)...outcome was no different to when I was using a straight through.

What am I doing wrong here? Do I need to do something on the pfsense box to make this work. I didn't think so as it is meant to be a bridge setup.
Please help.

Thanks!

Regards
pdaemon



This thread was automatically locked due to age.
Parents
  • 0

    Ji,

    why do you think you need two firewalls in tandem?

    You will need a 3rd nic on the XG to be able to access the management functions.

    What rules do you have in place?

    Ian

  • 0 in reply to rfcat_vk

    Hi rfcat_vk,

    I am using Pfsense as my firewall and just want to use Sophos XG for the Web filtering and reporting side of things..

    I have a LAN to WAN rule any-any rule in place on XG...this was done during the setup of the bridge-mode.
    I'll probably have to see if there is anything being blocked on the FW?

    I can post some screenshots a bit later on..

    I can access the Sophos Admin GUI via the IP address assigned to the bridged interface (192.168.1.18) or can see the console in VMware ESXi.

    Cheers pdaemon

  • 0 in reply to pdaemon

    I had the same issue with XG MR5 and MR 6 on Esxi 6.5. I changed over to XEN Server and it worked perfectly. I suspect that its an issue with Exsi 6.5, however I couldn't afford to spend too much time figuring it out. I know this doesn't add much but it may give some clue where to look. I do look forward to hearing if you solve the problem because it caused me untold hours of headaches.

     

     - Nick

  • 0 in reply to NickKeene

    something else to test. Currently have a 6.5 vmserver doing nothing.

    Ian

  • 0 in reply to NickKeene

    Hi NickKeene,

    Thanks for the reply and good (but not good!) to hear I'm not the only one that's had the same problem.

    I'm going to do some more investigation shortly.

    Cheers pdaemon

  • 0 in reply to rfcat_vk

    Hi rfcat_vk,

    Looking forward to seeing if you find anything....maybe it's just something really simple we're missing!

    Cheers pdaemon

  • 0 in reply to pdaemon

    Hi rfcat_vk,

    Increased RAM to 4GB and put ANY-ANY FW rule in place and still no difference.

    I have also flushed all ebtables rules just in case there was something there, but nothing...

    Cheer pdaemon

  • 0 in reply to pdaemon

    As per the packet-capture logs it would seem that XG did not receive any packets , So the issue lies with the client -> XG. You may need to check if the traffic is not diverted to another system instead of XG . Check the Mac address instead of host address of the arp table on your system.

  • 0 in reply to Aditya Patel

    Hi Aditya,

    Thanks for the suggestion...I'll see what I can find.

    Cheers pdaemon

  • 0 in reply to pdaemon

    Please let me know if you still want me to try the VM setup?

    I think Aditya's suggestion sounds like the answer, not a VM XG issue.

    Ian

  • 0 in reply to rfcat_vk

    Hi rfcat_vk,

    I have checked and I couldn't see anything out of the ordinary in regards to the ARP tables on the box that the traffic was coming from.

    I did notice on the XG FW log that some traffic such as request to external DNS were going out of br0 IP when the requests should have been going out on Port2?

    If you have a spare moment then it would be great if you could give the VM setup a go and see if you get the same thing or it just works for you.

    I am also testing the Sophos XG bridge mode using KVM to see if that makes any difference so I'll let you know how that goes. If you get this working with VMware, I'll switch back as I would prefer to use ESXi..

    Thanks!

    Cheers pdaemon

  • 0 in reply to pdaemon

    Hi,

    all requests should be going out the br0 that is why you have setup the bridge network.

    I think you missed a point about the traffic not getting to the XG, something in your network is directing the traffic elsewhere.

     

    Ian

Reply Children