Sophos UTM 9 and layer 3 switch, what's the best way of doing it

Hey Andrea.

Stick with Louis suggestion and keep things simple. Sophos UTM in front of every VLAN with a VLAN interface and subnet to each network. UTM will create the routes between VLANs automatically as long as you have an interface on each VLAN, but will block all traffic by default. That way you can control what will be accessible between VLANs using firewall rules to explicitly allow ports/services/protocols between networks or specific IPs. 

Bear in mind that the speed of the communication between VLANs would depend on your UTM routing capacity, though. If you need some super fast communication (like that 10Gb NAS you mentioned) between VLANs, then using your switch's L3 capabilities might be a better idea.

Regards,

Giovani

giomoda said:

Hey Andrea.

Stick with Louis suggestion and keep things simple. Sophos UTM in front of every VLAN with a VLAN interface and subnet to each network. UTM will create the routes between VLANs automatically as long as you have an interface on each VLAN, but will block all traffic by default. That way you can control what will be accessible between VLANs using firewall rules to explicitly allow ports/services/protocols between networks or specific IPs. 

Bear in mind that the speed of the communication between VLANs would depend on your UTM routing capacity, though. If you need some super fast communication (like that 10Gb NAS you mentioned) between VLANs, then using your switch's L3 capabilities might be a better idea.

Regards,

Giovani

 

Hi, will this actually affect transfer speed? I mean if both the nas and the workstation are connected to the switch via 10gbit but the Sophos which is doing the routing is connected to the switch via 1gbit ethernet will that create a 1gbit bottleneck on the bandwith between ports or is it just something you don't really notice on everyday use?

Thank you very much

If the workstation and NAS are on the same VLAN, UTM will not touch this, as this would be a layer 2 communication and would never traverse UTM. But if a device from another VLAN accesses your NAS, then the speed will be the routing speed from the UTM which would be, in the best case scenario, the speed from the UTM's network interface. It's just a heads up in case you are thinking of accessing your NAS from a device on another VLAN.

As for your previous question:

"Then how can i make the sophos only accessible from the 192.168.99.1 ip address and not from all the vlans?"

Do you mean management? If so, you can achieve that by limiting webadmin management at Management > Webadmin Settings > Gerenal >Allowed Networks. Create a network object with type host and IP 192.168.99.1 there and remove "Any". Just be careful to not lock yourself out by making sure you are already accessing UTM through the management VLAN and IP. =)

In case you enabled shell access, do the same at Management > System settings > Shell access > Allowed Networks

"Also, could i make 1 or 2 Ip addresses access all the vlans without having the VLANS communicating? If so how routing? firewall? "

As long as you have an UTM interface on each VLAN, UTM will automatically create routing between VLANs, but will allow nothing unless your create a firewall rules allowing traffic. So, for example, under Network Protection > Firewall you could create a rule:

Sources: IP1, IP2

Services: Any

Destination: Interface Networks Objects for VLAN 1, 10, 20, 30, 99, 150

Action: Allow

That would allow IP1 and IP2 to access every device on other VLAN subnets. Since UTM is a stateful firewall, you don't need to create rules allowing traffic back from the VLANs to those IPs, the above rule would suffice as long as the traffic is originated from IP1 or IP2.

Edit: I recommend reading Rulz for some best practices and most common questions/issues you might have while setting up this environment. You are leaving a fairy simple configuration and adding some complexity, so this reading would definitely help you.

Regards,

Giovani

Thank you very much indeed, everything is becomeing more and more clear and i will definitely read what you recomended, can't wait to mess up with the actual switch and router.

Thank you very much indeed, everything is becomeing more and more clear and i will definitely read what you recomended, can't wait to mess up with the actual switch and router.