Greetings.
Today I've faced a problem that just cracks my brain in half.
Assumptions are as follows:
-there is a Sophos unit with total of 8 interfaces
-in that unit there is a LAG covering the last 4 interfaces
-forementioned are connected to a stack consisting of 5 Dell 5548 units
-there is LACP configured, a port group is created that cover 4 interfaces on the stack
-there are numerous VLANs configured on the stack
-there is a number of servers to be NAT-ed to, there are separated LANs
-fun fact: every single UTM interface is connected to that stack.
And some details:
-VLAN 1 connected to eth0 via untagged interface on the stack - LAN#1 - numerous firewall rules, etc., - everything works fine (i.e. 10.1.x.x/16)
-VLAN, say, 2 connected to eth2 via untagged iface - public LAN with restricted accrss to some services - numerous rules, yadayadayada - things that should work do work, things that shouldn't - don't (i.e. 10.10.x.x/16)
-VLAN, say, 3 connected to eth3 via untagged iface - the mystic place with web servers - blahblahblah, NAT works, outbound connections are cut to some point, etc., required inbound connection from one host in VLAN 1 - works (10.0.0.x/24)
-VLAN 4050 - a network with 2 hosts connected, only outgoing connections, not allowed to go past certain hosts - works apparently (10.2.0.x/24)
-VLAN 4050 set on a LAG on the UTM (Ethernet VLAN, UTM says "up", well... works fine).
I wanted to do rather simple thing - to move VLANs 2 and 3 to the LAG, then add some more VLANs (4 of them, to be precise).
So I decided to verify that no definition relies in a particular interface - checked twice, changed 3 defs to "any interface". They were used in NATs, so I checked - works.
Then I've addes mentioned VLANs to the LAG, without having them tested (as no device will be connected there within the next week). VLANs also verified and added to the LAG on the Dell stack, i.e. interface po1 - no errors here. Po1 set to "trunk", every existing VLAN aded there.
After changing definition of an interface to reflect what I want - "webservers", Ethernet Standard, eth3 -> lag0, Ethernet VLAN, tag 3 connectivity is lost.
connections from VLAN1 are no longer accepted, NATs stop working, etc., the VLAN becomes "dead".
What could be a solution to this?
Regards, Kociak
This thread was automatically locked due to age.
