Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 19 replies
  • Subscribers 7 subscribers
  • Views 18596 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM 9 and layer 3 switch, what's the best way of doing it

Andrea Peccerillo

Hi everyone, i've been using Sophos UTM 9 and my L3 switch (dlink dgs 1510)  that i only bought for connecting my workstation to my nas via 10Gbit SFP+.  Everything is working fine as my setup is very straight forward:

Sophos acts as a gateway, handles the dhcp of the network and gives the network internet access via the ISP modem

The Dlink switch didn't do any of what a L2 or L3 switches are made for as it was only used as a switch connecting all the devices of my network.

As I'm about to move in to a new house and as i wil be impementing a new server, video surveillance and ip phones to the network I decided to dig deeper and did some research.

 

Here is what I think my new setup will be like_

VLAN 1 Freenas, Workstations, Home wifi and so on

VLAN 10 Guest WIFI

VLAN 20 Video surveillance

VLAN 99 MGT

VLAN 150 ip phone

 

Sophos ---> Gateway and Firewall of the networ-->ISP modem-->Internet

Dlink switch ---> L3 Switch will handle VLANS  and the routing in case i wanted some vlans to communicate with each other

 

Now is this a good way of doing things?

Do I have to setup a trunk between the router and the switch?

Does the sophos have to be the gateway or it can just be a firewall and provide me VPN etc?

 

Thanks a lot for helping figureing it out



This thread was automatically locked due to age.
Parents
  • 0

    Firstly, try and keep it simple. Forget about the L3 on the switch. Stick with L2 and let the UTM take care of the L3.

    You will need a trunk from the UTM to the switch which will carry all of your vlans. You then connect your clients individually to the desired vlans.

    And good practice is..... keep everything off vlan 1 which is generally where management traffic sits eg CDP, ARP etc.

    Generally, each vlan will need a router to break out which in your case would be the UTM with multiple interfaces supplying dhcp, dns etc.

    That's it, in it's simplest form.....

  • 0 in reply to Louis-M

    Thanks a lot for the advice, i might actually go for that route.

    Im going to Disable DHCP on the switch create all the VLANS on both the switch and the switch and the sophos, then create a trunk between them and i should be good to go right?

    Something like that

    VLAN 1 mgt traffic

    VLAN 10 most the clients

    VLAN 20 video surveillance

    VLAN 30 wifi

    VLAN 99 mgt

    VLAN 150 IPPHONES

     

    then i will have to create interfaces on the sophos for each vlan ex:

    192.168.1.1 255.255.255.0

    192.168.10.1 255.255.255.0

    192.168.20.1 255.255.255.0

    192.168.30.1 255.255.255.0

    192.168.99.1 255.255.255.0

    192.168.150.1 255.255.255.0

    Create the VLANS on the switch and assign ports as access mode

    Then how can i make the sophos only accessible from the 192.168.99.1 ip address and not from all the vlans?
    Also, could i make 1 or 2 Ip addresses access all the vlans without having the VLANS communicating? If so how routing? firewall? 

     

    Many thanks for your help and your time!

Reply
  • 0 in reply to Louis-M

    Thanks a lot for the advice, i might actually go for that route.

    Im going to Disable DHCP on the switch create all the VLANS on both the switch and the switch and the sophos, then create a trunk between them and i should be good to go right?

    Something like that

    VLAN 1 mgt traffic

    VLAN 10 most the clients

    VLAN 20 video surveillance

    VLAN 30 wifi

    VLAN 99 mgt

    VLAN 150 IPPHONES

     

    then i will have to create interfaces on the sophos for each vlan ex:

    192.168.1.1 255.255.255.0

    192.168.10.1 255.255.255.0

    192.168.20.1 255.255.255.0

    192.168.30.1 255.255.255.0

    192.168.99.1 255.255.255.0

    192.168.150.1 255.255.255.0

    Create the VLANS on the switch and assign ports as access mode

    Then how can i make the sophos only accessible from the 192.168.99.1 ip address and not from all the vlans?
    Also, could i make 1 or 2 Ip addresses access all the vlans without having the VLANS communicating? If so how routing? firewall? 

     

    Many thanks for your help and your time!

Children
No Data
Share Feedback
×

Submitted a Tech Support Case lately from the Support Portal?