Thread Info
  • Locked Locked
  • Replies 14 replies
  • Subscribers 27 subscribers
  • Views 20447 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG in bridge mode with Eero

Nnyan

 Hello all,

I have an Eero Pro mesh wifi system at home.  I want to add an additional layer of protection and I have Sophos running in an ESXi VM on an appliance and would like to set that up in bridge mode.  It is currently not deployed in bridge mode but I would switch it following this guide:  https://community.sophos.com/kb/en-us/123098

I want to put the Sophos XG in front of the Eero so that the extra layer protects the wireless clients and not just the wired ones. If possible I would like to configure it like this:

 

<--INTERNET--> < --FIBER INTERFACE--> <--XG WAN--Sophos XG BRIDGE--XG LAN--> <--Eero WAN || Eero LAN--> <SWITCH>

                                                               <PUBLIC IP>                             <10.0.0.1>  <10.0.0.2>  ||  <10.0.1.1>

 

If I understand this correctly.  The Sophos XG WAN port will pick up the Public IP from my fiber provider.  I will then assign an IP to the XG bridge LAN port (ex: 10.0.0.1).  The Eero WAN would get a static IP of (EX) 10.0.0.2.  The Eero LAN I can do something like 10.0.1.1 and then set up a DHCP server on the Eero to provide IP's the rest.

I would love to run a /21 (.248) supernet so I can segregate my network into subnets down the road.

 

Thank you for your time



This thread was automatically locked due to age.
Parents

  • Hi,

    your suggestion looks reasonable. You would need to review the eero dhcp functions to see if will run with more than one address range.

    If you use eero you are putting extra levels of checking whihc could slow down your throughput, which if the XG is setup correctly will not be used in the eero. You will need to make sure your VM NICs are capable of running at fibre speed as well as the cpu cycles assigned to the XG CPU.

    Ian

  • in reply to rfcat_vk

     

    Eero may be a limit but I don't need more than one range for now.  My biggest questions now are around the Bridge Interface "general settings" when I attempt to add a bridge.

    I understand the Member Interfaces (easy enough, as right now I have a WAN and LAN as it's currently in gateway mode).  After this, I need to put in an IPv4/Netmask.  I had thought this would be any IP that I wanted for the LAN side.  Below this, I need a Gateway Name and IP.  I am getting a DHCP from my ISP do I put in my current WAN public IP?  Or does this need to be two private IPs?  And if two private will Sophos send become invisible to the ISP device and send the public IP to the Eero?  Doesn't make sense to me but I don't see a way to make one interface in the Sophos bridge to be DHCP and the other static private ip if that makes sense.  The hardwar e I'm running on is very capable so I'm not too concerned but I'm willing to live with some impact in exchange for security.

  • in reply to Nnyan

    Hi,

    I have not tried this. The IP address is that of your XG. The XG should pass your IP request from your eero to your modem. Where does the login to the ISP network come from? The Gateway is the address of your modem inside address so the XG knows where to pass the traffic to.

    Where do you want to segment your network, on the XG side or the internal side of the eero?

    Ian

  • in reply to rfcat_vk

    This doesn't work.  If I want the XG to be the first device on my network (from ISP directly to WAN port in XG, LAN port from XG directly into WAN for Eero and LAN port in Eero to Network switch) then the Eero never gets the public routable IP from my ISP.  I think the bridge mode in XG is meant for XG to connect to another gateway device which in my case would not work since this would leave the wireless devices unprotected.

    Of course, now I want to disable the bridge I created and there doesn't seem to be any easy way to revert back from Bridge Mode to Gateway mode.  Other the resetting back to default settings.  

  • in reply to Nnyan

    I have a spare XG lying around here somewhere, I will try out bridge mode as an experiment in learning.

     

    ian

  • in reply to Nnyan

    Hi,

    sorry, this is taking a little longer than expected, 1 NIC died and the wrong disk was in the machine so a rebuild was required. Now waiting for mr3 to install.

     

    Ian

    Update. Just as well I didn't try to put it back in production mb not working well. Replacing with spare mb, then try again. You do need 3 nics to manage bridged mode.

  • in reply to rfcat_vk

    Hi,

    built a new installation on a very old box using the latest mr-2 which updated to mr-3. The new box has 3 NICs which you will require to allow you to finish the configuration of your bridge.

    I am typing this over the test XG bridge mode connected to to my main XG.

    1/. 3 NICs preferable, makes management easier.

    2/. possibly require a restart, did on the first build, but that could have been a motherboard issue.

    3/. the IP address requested is the IP address of the bridged network and becomes the default gateway. I changed the default gateway in the DHCP server so I could access the internet.

    4/. you will need to create a dhcp server for the bridge mode or use static assignments for the connected devices.

    5/. you can't use dhcp or PPPoE on the bridged interface for the wan connection. I cannot test this fully because I don't have a static external IP address.

     

    Still playing with the configuration. Need to put a faster CPU in this test box, takes forever to process changes.

    Ian

  • in reply to rfcat_vk

    When you get a chance could you do a screenshot of your config?  And maybe a diagram of your network.

    If you look at my screenshot, I thought that the IPv4/Mask: was asking for the IP for the LAN/WAN bridge I created.  Reading your post makes me think that this is the IP for the 3rd NIC?

    If I understand this the "Member interfaces" are the two NICs you want to bridge into one?  So that means that the gateway IP is the IP address for the LAN/WAN bridge?

  • in reply to Nnyan

    Hi,

    no the network mask is for the bridge.

    The IP address of the bridge needs to part of the network the bridge is talking to and with that needs to have the same mask.

    I will post some shots shortly.

     

    Ian

  • in reply to rfcat_vk

    Pretty pictures as requested.

     

    Network.

    MAC -> XG internal interface of bridge (LAN) -> bridge -> external interface of bridge -> switch -> internal interface of main XG.

    I don't have an external interface with a fixed P address other than using the internal network address of my main XG.

     

    Ian

Reply
  • in reply to rfcat_vk

    Pretty pictures as requested.

     

    Network.

    MAC -> XG internal interface of bridge (LAN) -> bridge -> external interface of bridge -> switch -> internal interface of main XG.

    I don't have an external interface with a fixed P address other than using the internal network address of my main XG.

     

    Ian

Children