Configure VLAN on Sophos Firewall and UniFi Switch

VLANs logically separate networks from one another, even though they can run over the same switches and cables. In a typical small or medium-sized environment, the Sophos Firewall takes care of routing, firewall rules, DHCP and security policies. The UniFi Switch transports the VLANs via tagging to access points, clients, servers or other switches.

The article shows a practical setup with Sophos Firewall as Gateway and UniFi as a switching platform. The focus is not only on the click path, but also on the typical errors: incorrect Tagged/Untagged behavior, missing firewall rules, forgotten DHCP server or a VLAN on the wrong parent interface.

Target image

Example:

• VLAN Name: Clients.
• VLAN ID: 100.
• Subnet: 10.100.0.0/24.
• Gateway to Sophos Firewall: 10.100.0.1.
• Zone on Sophos Firewall: Client or LAN.
• UniFi Uplink to firewall: Allow VLAN 100 tagged.
• Client port on the switch: VLAN 100 untagged or set as Native VLAN.

In this design, the Sophos Firewall is the default Gateway of the VLAN. Clients in the VLAN get a IP address from the new subnet, send their traffic to the firewall and are controlled there via firewall rules, NAT, web protection, IPS or other policies.

If the basic interface and zone planning needs to be clarified first, Sophos Firewall Configure zones and interfaces will help. For the purposes of these instructions, it is assumed that the VLAN is deliberately planned as its own client, guest, server or management network.

Clarify in advance

Before configuration you should determine these points:

• Which VLAN ID is used?
• Which IP subnet does the VLAN get?
• Should the Sophos Firewall provide DHCP for this VLAN?
• In which Sophos zone is the VLAN?
• Which UniFi ports transport the VLAN tagged?
• Which UniFi ports output the VLAN untagged to end devices?
• Can the VLAN only access the Internet or also internal servers?
• Which local firewall services may be accessible from this zone?

⚠️ A VLAN only separates Layer 2. The Sophos Firewall later decides whether traffic between VLANs is allowed via routing, firewall rules and NAT. A VLAN does not replace regular planning.

Create VLAN in UniFi Network

Depending on the UniFi Network version, individual menu items have slightly different names. The principle remains the same: The VLAN is created as its own network or as a VLAN-only network if the Sophos Firewall takes over the Gateway and DHCP.

Menu path:

Settings > Networks

Procedure:

1. Open New Virtual Network or New Network.
2. Assign a name, for example Clients.
3. Select Third-party Gateway as router or Gateway if the Sophos Firewall takes over routing and DHCP.
4. Enter VLAN ID, for example 100.
5. Leave automatic UniFi-Gateway or DHCP functions disabled when the Sophos Firewall is in charge.
6. Save.

   

   

UniFi Set switch ports correctly

The most important part is the port mapping. The Sophos Firewall and UniFi switch must see the same VLAN ID on the same link.

Typical port design:

• Uplink to Sophos Firewall: Allow VLAN 100 tagged so that the VLAN is transported to the firewall.
• Uplink to another switch: Allow VLAN 100 tagged if the VLAN is to be redistributed.
• Access Point Port: Allow VLAN 100 tagged if an SSID uses this VLAN.
• Client port: Set VLAN 100 as native/Untagged VLAN so that a device without a VLAN tag ends up directly in the correct network.

When a normal client PC is connected to a switch port, it normally sends untagged. The switch then maps this port to the desired Native VLAN. If a Access Point or another switch is to transport several VLANs, the port must allow the VLANs tagged.

Typical errors:

• VLAN created on the UniFi switch, but not allowed on the uplink to the firewall.
• Client port configured tagged instead of untagged.
• Access Point SSID uses VLAN 100, but AP port does not carry VLAN 100.
• Native VLAN and Tagged VLAN are confused.
• VLAN ID is different on UniFi and Sophos.

Plan changes without loss of management

Particular care should be taken when making VLAN changes to uplinks, switch port profiles or management networks. An incorrect Native VLAN or a missing Tagged VLAN on the uplink can cause the switch, Access Point or firewall to disappear from the management network.

Before making productive changes, you should therefore briefly determine:

• UniFi management network: The management VLAN must not be lost when changing the port profile.
• Uplink to Sophos Firewall: Changes to this port often affect multiple VLANs at the same time.
• Local access: For remote changes, a fallback path to the switch and firewall is required.
• Test port: New VLAN profiles can be tested on a reserved port without relocating productive devices.
• Backup: With a secured Sophos and UniFi configuration, you can get back to the last working version more quickly.

We recommend validating new VLANs on a single test port first. Only when DHCP, Gateway, DNS, firewall rule and Log Viewer match should the port profile be rolled out to additional access points, switch uplinks or client ports.

Create VLAN on the Sophos Firewall

The VLAN is created as a virtual interface on the Sophos Firewall.

Menu path:

Network > Interfaces > Add interface > Add VLAN

Procedure:

1. Assign a name, for example Clients VLAN 100.
2. Select the physical port, bridge or LAG where the VLAN arrives tagged as Interface.
3. Select zone, for example Client, LAN, Guest or Server.
4. Enter VLAN ID, for example 100.
5. Under IPv4 configuration usually select Static.
6. Set Gateway address of the VLAN, for example 10.100.0.1/24.
7. Save.

   

   

   Sophos allows VLAN IDs from 1 to 4094. The same VLAN ID cannot be used multiple times on the same physical interface. The same VLAN ID can technically appear again on a different parent interface, but in practice this should only be done if the network design is clearly documented.

Set up DHCP for the VLAN

If clients in the VLAN should automatically receive IP addresses, a DHCP server or DHCP relay is required.

On the Sophos Firewall, DHCP is under:

Network > DHCP

Typical DHCP values:

• Interface: Clients VLAN 100.
• Range start: 10.100.0.50.
• Range end: 10.100.0.200.
• Gateway: 10.100.0.1.
• DNS server: Firewall-IP or internal DNS server.
• Domain name: internal search domain, if required.

If the Sophos Firewall is to be used as a DNS resolver for this VLAN, DNS must also be permitted under Administration > Device access for the appropriate zone. DHCP options for specific devices are described in article Sophos Firewall DHCP Options (SFOS).

Create firewall rules

After VLAN and DHCP, the appropriate firewall rule is usually missing. Without a rule, the client can get a IP address, but cannot automatically communicate with the Internet or other networks.

Typical first rule of the internet:

• Rule name: Clients_to_WAN.
• Source zones: Client or LAN.
• Source networks and devices: Network object of the VLAN, for example net_Clients_10.100.0.0_24.
• Destination zones: WAN.
• Destination networks: Any.
• Services: HTTP, HTTPS, DNS, NTP or deliberately defined services.
• Log firewall traffic: activated.

You should create separate rules for access to internal servers and only allow the required destinations and services. A guest or IoT VLAN should generally not be allowed to access the server or management network.

The details on rule order, Source Zone, destination zone, security features and logging can be found in Understanding and correctly configuring Sophos Firewall rules.

Check Device Access

Device Access controls local services of the firewall itself, not the traffic through the firewall. This is important for new VLANs.

Examples:

• Clients should use the firewall as a DNS server: allow DNS for the zone.
• Monitoring should ping the firewall: specifically allow Ping/Ping6.
• Normal clients, guests or IoT devices should not access WebAdmin or SSH.
• Management access should be from a dedicated admin network or via Local Service ACL Exception Rules.

Sophos Firewall Securing access: configure Device Access correctly helps for precise hardening.

Testing and validation

After configuration, you should not only check whether a client has internet. A short, reproducible test plan is better:

1. Connect the client to the designated UniFi port.
2. Check whether the client gets a IP address from the correct VLAN.
3. Check default Gateway and DNS server.
4. Ping firewall-IP in VLAN if ping is allowed.
5. Test internet access.
6. Test access to internal networks that should be allowed.
7. Test access to internal networks that should be blocked.
8. In the Sophos Log viewer check which firewall rule matched.
9. Control usage counter of the rule.

If a rule does not work as expected, Sophos Firewall Test rule with Log Viewer and Packet Capture helps.

Typical errors

• VLAN is not allowed to be tagged on the UniFi uplink to the firewall: Clients do not receive a IP address or do not reach the firewall.
• VLAN is on the wrong parent interface on the Sophos: The Sophos Firewall does not see the traffic.
• Client port is tagged instead of untagged: Normal clients do not end up in the VLAN.
• DHCP missing: The client does not get a IP address or an APIPA address.
• DNS Device Access missing: The client can reach IPs but cannot resolve names.
• Firewall rule missing: The client gets a IP address, but traffic is blocked.
• Allow rule too broad: VLAN separation is practically removed again.
• Wrong zone selected: Rule, Device Access or web policy take effect differently than expected.
• Native VLAN on Trunk unclear: Untagged traffic ends up in the wrong network.

Troubleshooting

If the VLAN does not work, you should check from Layer 1 to Layer 7:

1. Cable and Link: Does the UniFi port show link and expected speed?
2. UniFi port profile: Is VLAN 100 tagged allowed on the uplink?
3. Client Port: Is VLAN 100 set untagged/native for normal clients?
4. Sophos Interface: Is the VLAN visible, connected and in the correct zone under Network > Interfaces?
5. DHCP: Is there a DHCP server or relay for the VLAN?
6. Gateway: Is the Sophos VLAN-IP the default Gateway?
7. Device Access: Is DNS or Ping allowed for the zone if needed?
8. Firewall Rules: Are Source Zone, Source Network, Destination Zone and Services correct?
9. Log Viewer: Is the traffic allowed, dropped or hit by another rule?
10. Packet Capture: Are packets arriving on the correct interface and with the expected VLAN configuration?

In cases that are difficult to understand, Packet Capture is often crucial. If no packets arrive at the Sophos Parent Interface, the problem is usually on the UniFi side, the cable, port profile, Tagged/Untagged design or the wrong uplink.

Checklist

• VLAN ID is the same on UniFi and Sophos.
• UniFi Uplink to the Sophos Firewall allows the VLAN to be tagged.
• The end device port is untagged/native in the correct VLAN for normal clients.
• Sophos VLAN is on the correct parent interface.
• Sophos VLAN has the scheduled zone and Gateway-IP.
• DHCP or DHCP Relay is set up.
• DNS is set appropriately and allowed when using the firewall via Device Access.
• Firewall rule for internet access is present and logged.
• Internal access is only permitted where it is really needed.
• Log Viewer and Packet Capture were tested for a test client.

Frequently Asked Questions