Hello, I have a Sophos UTM 110 with devices connected to eth0, eth2 and eth3. The devices are configured to use VLAN 13. I found that I had to bridge eth0, eth2 and eth3 in order to allow the devices connected to those interfaces communicate using VLAN 13. Note that the devices are hypervisors (ESXi) and virtual machines running inside of them will be communicating on a different VLAN. This allows me to use the ESXi servers for a security testing without worrying that the malicious software can undermine my ESXi hosts, or other virtual machines hosting web sites etc. So here's the steps I took: [LIST=1] Got the Sophos UTM 110 device (aka router) Configured public IPv4 address and verified I can connect to WebAdmin over eth1. Bridged eth0, eth2 and eth3 Configured a VLAN 13 on br0, named Orion (aka the Constellation) Configured L2TP VPN Added firewall rule to allow all traffic from VPN Pool (L2TP) to the Orion Network (aka VLAN 13) Defined a DHCP server for the Orion Network (aka VLAN 13) Connected servers to router configured to use DHCP and VLAN 13. Servers reporting DHCP errors, sometimes getting an IP, but often reporting issues. Configured server to use static IP addresses 172.16.13.2, 172.16.13.3 and 172.16.13.4. Verify connection works by pining each server from router. This was done in parallel. Everything seemed ok. At home configure L2TP VPN on OS X 10.8.3. Connect to Sophos UTM 110 using VPN on OS X from home. Connect to servers over VPN from home. Intermittent issues; connection timeouts and disconnected when working on multiple machines at the same time. Open three terminal windows in OS X 10.8.3 and ping 172.16.13.2, 172.16.13.3 and 172.16.13.4 in parallel. Seems I can only ping to one device at a time, the other time out [Request timeout for icmp_seq 739]. Leaving it running for a while indicates that if ping works for one server, it fails for the other two. Every now and then, ping will start working for another server and then timeout on the one where it worked. SSH into each server (problematic due to intermitted disconnects) From within the SSH session, ping another server. Ping fails. From within the SSH session, ping router. Ping succeeds. [/LIST] At this stage, no traffic to the internet is permitted, so I didn't even bother to ping Google or another external site. Questions: [LIST=1] Is creating a bridge to support a VLAN across eth0, eth2 and eth3 the right way to do this? It would have been easier if I could just specify the "Orion Network" to be spanning eth0, eth2 and eth3 like some other routers. But it doesn't seem to be possible using Sophos UTM. If creating a bridge is the right way to achieve this, is there something I'm missing configuration wise that prevents all three devices from being accessed at the same time (aka ping all 3 without time outs) If creating a bridge isn't the right way to achieve this, then how does one support a VLAN across multiple interfaces? [/LIST] I know that usually one will connect another switch to eth0 which takes care of the VLAN, but at this stage I do not have enough space at the data centre to add another switch. In essence, I was hoping the Sophos UTM would be sufficient. Sincerely, Werner

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Configuring a VLAN across eth0, eth2 and eth3.

Hello,

I have a Sophos UTM 110 with devices connected to eth0, eth2 and eth3. The devices are configured to use VLAN 13. I found that I had to bridge eth0, eth2 and eth3 in order to allow the devices connected to those interfaces communicate using VLAN 13.

Note that the devices are hypervisors (ESXi) and virtual machines running inside of them will be communicating on a different VLAN. This allows me to use the ESXi servers for a security testing without worrying that the malicious software can undermine my ESXi hosts, or other virtual machines hosting web sites etc.

So here's the steps I took:

[LIST=1]

Got the Sophos UTM 110 device (aka router)
Configured public IPv4 address and verified I can connect to WebAdmin over eth1.
Bridged eth0, eth2 and eth3
Configured a VLAN 13 on br0, named Orion (aka the Constellation)
Configured L2TP VPN
Added firewall rule to allow all traffic from VPN Pool (L2TP) to the Orion Network (aka VLAN 13)
Defined a DHCP server for the Orion Network (aka VLAN 13)
Connected servers to router configured to use DHCP and VLAN 13.
Servers reporting DHCP errors, sometimes getting an IP, but often reporting issues.
Configured server to use static IP addresses 172.16.13.2, 172.16.13.3 and 172.16.13.4.
Verify connection works by pining each server from router. This was done in parallel. Everything seemed ok.
At home configure L2TP VPN on OS X 10.8.3.
Connect to Sophos UTM 110 using VPN on OS X from home.
Connect to servers over VPN from home. Intermittent issues; connection timeouts and disconnected when working on multiple machines at the same time.
Open three terminal windows in OS X 10.8.3 and ping 172.16.13.2, 172.16.13.3 and 172.16.13.4 in parallel. Seems I can only ping to one device at a time, the other time out [Request timeout for icmp_seq 739]. Leaving it running for a while indicates that if ping works for one server, it fails for the other two. Every now and then, ping will start working for another server and then timeout on the one where it worked.
SSH into each server (problematic due to intermitted disconnects)
From within the SSH session, ping another server. Ping fails.
From within the SSH session, ping router. Ping succeeds.

[/LIST]

At this stage, no traffic to the internet is permitted, so I didn't even bother to ping Google or another external site.

Questions:
[LIST=1]

Is creating a bridge to support a VLAN across eth0, eth2 and eth3 the right way to do this? It would have been easier if I could just specify the "Orion Network" to be spanning eth0, eth2 and eth3 like some other routers. But it doesn't seem to be possible using Sophos UTM.
If creating a bridge is the right way to achieve this, is there something I'm missing configuration wise that prevents all three devices from being accessed at the same time (aka ping all 3 without time outs)
If creating a bridge isn't the right way to achieve this, then how does one support a VLAN across multiple interfaces?

[/LIST]

I know that usually one will connect another switch to eth0 which takes care of the VLAN, but at this stage I do not have enough space at the data centre to add another switch. In essence, I was hoping the Sophos UTM would be sufficient.

Sincerely,
Werner

This thread was automatically locked due to age.

Parents

0 bloudraak_01 over 12 years ago

The subnet for VLAN 13 is 172.16.13.0/24.

Lets step back for a moment.  I have three ESXi servers which hosts web servers, mail and some development servers [at least they did before buying the UTM device]. The physical server and virtual machines were directly connected to the internet and being attacked, consuming computer resources and my time.

I decided to buy a Sophos UTM to act as the firewall, VPN and IPS so that administration interfaces (SSH, ESXi, Windows, OS X and Ubuntu administration) can only be accessed via the VPN.

I installed the virtual appliance of Sophos UTM in ESXi.  It pretty much stopped attacks against virtual machines.  When I ran some vulnerability scanners, I noticed that they effected servers I really didn't want to be attacked. In essence, it was recommended I look at VLANs.  So I did.

However, in Sophos UTM I couldn't specify that a VLAN spanned more than one interface. So when I moved a virtual machine from interface to another, I had to reconfigure its networking, firewall etc. It had challenges. I screwed up connectivity on several occasions. Fortunately everything was virtual so I could start again.

When I bridged the adapters, everything started to work well. I configured 5 VLANs. I could move a machine from one interface to another and everything worked, without having to reconfigure networking etc. Some of the VLANs spanned interfaces and machines were able to communicate with each other without a problem.  Security testing was also isolated to a VLAN.

But my ESXi hosts were still vulnerable. I needed hardware.

I bought the Sophos UTM with the intent to connect the three ESXi servers to eth0, eth2 and eth3, bridge the adapters and have them run in VLAN 13 (similar to the setup I had in the virtualization environment). Once I had this configured, I'll create a couple more VLANs to isolate mail servers from security lab from development servers.

So on Friday someone at the datacenter spent the time to hook up the ESXi servers to the Sophos UTM and configure each one to run on VLAN 13. Everything seemed fine.  We never tested communication between the ESXi servers, only from the router to the ESXi servers.

So this morning it came as a surprise that connections are being dropped. As mentioned in previous posts, I noticed that only one server can be pinged at a time.  TCPDUMP dumps seems to confirm that.

Hope it makes sense.

Werner
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 bloudraak_01 over 12 years ago

The subnet for VLAN 13 is 172.16.13.0/24.

Lets step back for a moment.  I have three ESXi servers which hosts web servers, mail and some development servers [at least they did before buying the UTM device]. The physical server and virtual machines were directly connected to the internet and being attacked, consuming computer resources and my time.

I decided to buy a Sophos UTM to act as the firewall, VPN and IPS so that administration interfaces (SSH, ESXi, Windows, OS X and Ubuntu administration) can only be accessed via the VPN.

I installed the virtual appliance of Sophos UTM in ESXi.  It pretty much stopped attacks against virtual machines.  When I ran some vulnerability scanners, I noticed that they effected servers I really didn't want to be attacked. In essence, it was recommended I look at VLANs.  So I did.

However, in Sophos UTM I couldn't specify that a VLAN spanned more than one interface. So when I moved a virtual machine from interface to another, I had to reconfigure its networking, firewall etc. It had challenges. I screwed up connectivity on several occasions. Fortunately everything was virtual so I could start again.

When I bridged the adapters, everything started to work well. I configured 5 VLANs. I could move a machine from one interface to another and everything worked, without having to reconfigure networking etc. Some of the VLANs spanned interfaces and machines were able to communicate with each other without a problem.  Security testing was also isolated to a VLAN.

But my ESXi hosts were still vulnerable. I needed hardware.

I bought the Sophos UTM with the intent to connect the three ESXi servers to eth0, eth2 and eth3, bridge the adapters and have them run in VLAN 13 (similar to the setup I had in the virtualization environment). Once I had this configured, I'll create a couple more VLANs to isolate mail servers from security lab from development servers.

So on Friday someone at the datacenter spent the time to hook up the ESXi servers to the Sophos UTM and configure each one to run on VLAN 13. Everything seemed fine.  We never tested communication between the ESXi servers, only from the router to the ESXi servers.

So this morning it came as a surprise that connections are being dropped. As mentioned in previous posts, I noticed that only one server can be pinged at a time.  TCPDUMP dumps seems to confirm that.

Hope it makes sense.

Werner
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data