This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Router - UTM - Layer 3 Switch

Hi all,

Just got my Sophos UTM SG210... am struggling to setup properly.. so any advice would be great.

Here's the setup

Internet ----> Cisco router 2901 ----> Sophos UTM -----> Dell Powerconnect 6248 -----> Client computers/server

I've read through a few configuration types and posts. Some suggested that i replace the cisco router all together with the UTM. At the moment, i can't do that yet as the router have 2 VPN connections to our branch's cisco routers. (That's right, only our HQ is using the sophos UTM for now)... anyway conceptually this is the network design

Router (192.168.100.1) ---> UTM (192.168.100.2) ---> L3 Switch (192.168.100.3)

Hence, all my traffic will be routed from the switch 0.0.0.0 to 192.168.100.2...

How do i route traffic from UTM to the router itself ?

Bridge mode or static router ?....

Thanks for input again..

This thread was automatically locked due to age.

0 skm over 10 years ago

What is the purpose of L3 on that Switch?

I would delete L3 Interface on Switch and move L3 border on UTM. Then between cisco and UTM make another Segment to connect UTM with Cisco. VPN with branch routers can also be configured on UTM, it is standard and is fully supported independently of vendor, the only thing you should configure is NAT on Cisco to Forward IPSEC traffic between branch Routers and UTM, also NAT for user traffic to Internet.

Above is in case when you need to leave cisco router. If not, then move L3 on UTM and configure all Services (DHCP, NAT etc)
Cancel
Vote Up 0 Vote Down

Cancel
0 hbcict over 10 years ago

The L3 switch handles inter-vlan functions.
Cancel
Vote Up 0 Vote Down

Cancel
0 gregd over 10 years ago

How do i route traffic from UTM to the router itself?

On the UTM, you should be to add a default route of 0.0.0.0 192.168.100.1 or is it balking because of similar subnet?

As for design, it is ok.  If you make any design changes, I would do this;

Internet >>> (eth0) UTM (eth1) >>> L3 Switch
                                       (eth2) >>> Tunnels to Cisco 2901
                                       (eth3) >>> Terminated Clients to L3 switch

At home, each segment has it's own subnet:

172.29.0.0/24 = LAN side of cable modem and risky personal home wireless devices such as the WII and Blu-Ray player.  In addition, the UTM and OOMA is plugged in here.
172.29.1.0/24 = More risky wireless such as work computers
172.29.5.0/24 = Wireless Internal Network
172.29.6.0/24 = Wired Internal Network
172.29.7.X/24 = Windows Server directly connected.

Cable Modem/Router (Bridge is a work in progress) >>> (eth0) UTM
                                                                                  >>>  (eth1) Ooma
                                                                                 >>>  (LAN Wireless)-Personal Appliances
                                                                                 >>> (Guest Wireless)-Work
UTM (eth 1)  >>> Wired LAN vlan trunk to Cisco Catalyst 2950
        (eth 2)  >>>  Wireless LAN vlan trunk to Cisco 1811W (PDAs, Personal laptop,printer)
        (eth 3) >>> Directly connected to Windows Server

Converting to a bridge is my attempt of owning my own cable modem and getting rid of Double NAT (masquerading).  It is not an issue now but do not need to be in the future.

If I can get it to bridge, it will look like this;

Cable Bridge (Internet) >>> (eth0) UTM (eth1) Wired LAN/Server (vlan 6)
                                                                (eth2) Wireless Lan (Vlan 5)
                                                                (eth3) Wireless DMZ - Work computers and Riskier Wireless Personal Appliances.

After you bridge the cable modem, it can not be used for anything else but a bridge between networks.
Cancel
Vote Up 0 Vote Down

Cancel
0 hbcict over 10 years ago

Thanks for the input and help.

Manage to get it working by bridging the eth ports and placing it between my router and switch.

I guess the next phase is to do some detail configuration in web filters/mail protect/av...

cheers !!
Cancel
Vote Up 0 Vote Down

Cancel

Router - UTM - Layer 3 Switch

Submitted a Tech Support Case lately from the Support Portal?