Skip to content
Avanet

Configure a VLAN on Sophos Firewall and a UniFi Switch

Sophos Firewall UniFi

VLANs logically separate networks even though they can share the same switches and cables. In this design, the Sophos Firewall provides routing, firewall rules, DHCP, and security policies. The UniFi Switch carries the VLANs with 802.1Q tags to access points, clients, servers, or downstream switches.

This article walks through a complete IPv4 example with Sophos Firewall as the third-party gateway. In addition to the menu paths, it covers the points where these projects commonly fail: the wrong parent interface, confused native and tagged VLANs, a missing network object, an unsuitable NAT rule, or an AP port whose native VLAN conflicts with the wireless client VLAN.

Target design and example values

The example uses the following values throughout:

  • VLAN name: Clients.
  • VLAN ID: 100.
  • Subnet: 10.100.0.0/24.
  • Gateway on Sophos Firewall: 10.100.0.1.
  • Zone on Sophos Firewall: Client or LAN.
  • Network object: NET_Clients_VLAN100.
  • DHCP range: 10.100.0.50 to 10.100.0.200.
  • Firewall rule: Clients_to_WAN.
  • UniFi uplink to the firewall: allow VLAN 100 tagged.
  • Client port on the switch: use VLAN 100 as the native VLAN.

VLAN ID 100 and private network 10.100.0.0/24 are example values. The actual environment needs an unused VLAN ID and a non-overlapping subnet. In this design, the gateway address resides on Sophos Firewall; clients send their traffic there and are controlled through rules, NAT, web protection, IPS, or other policies.

If the basic interface and zone design needs to be clarified first, see Configure zones and interfaces on Sophos Firewall. This guide assumes that the new VLAN has been deliberately designed as a client, guest, server, or management network.

Set up the VLAN in a safe order

For experienced administrators, this is the short workflow:

  1. Back up the Sophos and UniFi configurations and define a test port and alternative management access.
  2. Create the VLAN interface on the correct Sophos parent interface.
  3. Prepare the network object, DHCP or DHCP relay, and the DNS path.
  4. Create firewall rules and verify which SNAT or MASQ rule translates internet traffic.
  5. Create a UniFi virtual network with Third-party Gateway and the same VLAN ID.
  6. Configure the uplink, client port, AP port, or downstream uplink with the appropriate native and tagged VLANs in UniFi Port Manager.
  7. Run positive and negative tests with a real client; verify the expected Firewall Rule ID and, for WAN traffic, the NAT Rule ID in Log Viewer.

⚠️ Before changing the native VLAN of an uplink, make sure a management fallback path is available. An incorrect native VLAN or a missing tagged VLAN can remove the switch, access point, or firewall from the management network.

Decide in advance

Define the following points before configuration:

  • Which unused VLAN ID will be used?
  • Which non-overlapping IP subnet will the VLAN use?
  • Will Sophos Firewall provide DHCP, or is DHCP relay required?
  • Which Sophos zone will contain the VLAN?
  • Which UniFi ports will carry the VLAN tagged?
  • Which ports will deliver it untagged to standard endpoints?
  • Which native VLAN do uplinks and access points require for management traffic?
  • May the VLAN access only the internet or also specific internal servers?
  • Which local firewall services may be reached from this zone?
  • How will the switch and firewall be reached if the new port configuration fails?

⚠️ A VLAN separates only Layer 2. Sophos Firewall decides whether traffic between VLANs is allowed through routing and firewall rules. NAT changes addresses and is not a substitute for rule design either.

Create the VLAN on Sophos Firewall

For a third-party gateway, Ubiquiti recommends preparing the subnet, VLAN ID, and DHCP on the gateway first. On Sophos Firewall, this starts with the VLAN interface.

Menu path:

Network > Interfaces > Add interface > Add VLAN

Procedure:

  1. Enter a name, such as Clients VLAN 100.
  2. For Interface, select the physical port, RED interface, bridge, or LAG on which VLAN 100 arrives tagged.
  3. Select a zone, such as the custom zone Client or the existing zone LAN.
  4. Enter 100 under VLAN ID.
  5. Under IPv4 configuration, select Static for this example.
  6. Set the IP address to 10.100.0.1/24.
  7. Save the interface.
Sophos Firewall Add VLAN interface selection
Create the VLAN on the parent interface where the UniFi switch sends the tagged VLAN to the firewall.
Sophos Firewall VLAN interface with VLAN ID and IPv4 configuration
The VLAN ID, zone, and IP address must match the switch and subnet design.

The parent interface is not an interchangeable example value. It must be the exact Sophos port, bridge, or LAG that is physically connected to the UniFi uplink. Sophos supports VLAN IDs from 1 to 4094; the same ID cannot be used more than once on the same physical interface.

Create a network object for the VLAN

A dedicated network object makes firewall and NAT rules readable and prevents the new VLAN from being allowed accidentally through an overly broad object.

Menu path:

Hosts and services > IP host > Add

Use the following values for the example:

  • Name: NET_Clients_VLAN100.
  • IP version: IPv4.
  • Type: Network.
  • IP address: 10.100.0.0.
  • Subnet: 255.255.255.0 or /24.

The object name can be chosen freely, but it should identify the network and its purpose clearly. The address and subnet mask must match the VLAN interface exactly; gateway address 10.100.0.1 is not a replacement for network object 10.100.0.0/24.

Configure DHCP and DNS for the VLAN

Clients that should receive addresses automatically require a DHCP server or DHCP relay.

Menu path:

Network > DHCP

Typical DHCP values are:

  • Interface: Clients VLAN 100.
  • Range start: 10.100.0.50.
  • Range end: 10.100.0.200.
  • Gateway: 10.100.0.1.
  • DNS server: firewall IP or an internal DNS server.
  • Domain name: internal search domain, if required.

The range deliberately leaves addresses below .50 and above .200 available for infrastructure or fixed assignments. In an existing environment, adapt the range to reservations, servers, and the local address plan.

If Sophos Firewall is used as the DNS resolver for this VLAN, DNS must also be allowed for the corresponding zone under Administration > Device access. An internal DNS server instead requires a suitable firewall rule and a working return path. Sophos Firewall DHCP Options (SFOS) explains special DHCP options.

Prepare firewall rules and NAT

A successful DHCP lease does not prove that the data path works. Traffic through the firewall requires suitable rules.

A deliberately simple internet rule can start as follows:

  • Rule name: Clients_to_WAN.
  • Source zones: Client or LAN.
  • Source networks and devices: NET_Clients_VLAN100.
  • Destination zones: WAN.
  • Destination networks: Any.
  • Services: the services actually required, such as HTTP, HTTPS, DNS, and NTP.
  • Log firewall traffic: enabled.

When clients use the firewall itself as their DNS resolver, DNS traffic to that local firewall address is a Device Access matter. When an external DNS server is used, the DNS service must instead be allowed through the applicable firewall rule and NAT path.

Create separate rules for access to internal servers and allow only the required destinations and services. A guest or IoT VLAN should not have unrestricted access to server or management networks. Understand and configure Sophos Firewall rules explains rule order, zones, security features, and logging.

Do not forget NAT or create it twice

Internet traffic from a private VLAN normally requires source NAT, often MASQ to the WAN address. An existing rule such as Default SNAT IPv4 often already covers new internal networks, but this must be checked against its match criteria and then verified in Log Viewer. Adding a second SNAT rule without evidence can unnecessarily change a working rule order.

Traffic between internal VLANs with unique routed networks normally does not require address translation. Routing and firewall rules decide that path. Designs with overlapping networks or special peers must be planned separately.

During testing, read the Firewall Rule ID together with the NAT Rule ID for WAN traffic. The Firewall Rule ID identifies the access decision, while the NAT Rule ID identifies the translation that was actually used. Understand NAT on Sophos Firewall explains the complete processing order.

Create the VLAN in UniFi Network

After preparing the VLAN on Sophos Firewall, create it in UniFi as a virtual network with the same VLAN ID.

Menu path:

Settings > Networks

Procedure:

  1. Open New Virtual Network or New Network.
  2. Enter a name, such as Clients.
  3. Under Router, select Third-party Gateway.
  4. Enter VLAN ID 100.
  5. Do not assign UniFi gateway or DHCP functions to this network because Sophos Firewall provides them.
  6. Apply the changes.
UniFi Network settings with existing networks
UniFi lists the VLAN as a virtual network; the gateway, subnet, and DHCP remain on Sophos Firewall in this design.
UniFi Network with a new VLAN and third-party gateway
With a third-party gateway, the VLAN ID must match the Sophos interface that was prepared previously.

Configure UniFi switch ports in Port Manager

Sophos Firewall and the UniFi switch must see the same VLAN ID on the same link. In current UniFi Network versions, port assignment is located here:

Devices > [Switch] > Ports > Port Manager

Two fields define the VLAN path:

  • Native VLAN / Network: receives untagged traffic on this port.
  • Tagged VLAN Management: specifies which tagged VLANs may pass through the port.

Allow All permits every tagged VLAN known to UniFi. Block All turns the port into an access port that carries only the native VLAN. Custom permits a deliberately selected set of VLANs and is often the clearer choice for documented uplinks and AP ports.

Four common port roles

  • Uplink to Sophos Firewall: The native VLAN must match the existing untagged management or uplink design. Under Tagged VLAN Management, select Custom with VLAN 100 and every other VLAN actually required. Use Allow All only when the link is intentionally meant to carry every UniFi VLAN.
  • Client port: Select Clients under Native VLAN / Network and set Tagged VLAN Management to Block All. A standard client sends untagged traffic and therefore joins VLAN 100.
  • Access point port: Keep the AP management network as the native VLAN. Under Tagged VLAN Management, select Custom and allow VLAN 100 for the corresponding SSID.
  • Uplink to another switch: The native VLAN and all tagged VLANs allowed under Custom must match the downstream design. If VLAN 100 is missing, no downstream AP or client port can use it.

⚠️ On an AP port, the client VLAN used by the SSID must not also be configured as the native VLAN. Ubiquiti identifies VLAN 1 as an exception; in this example, VLAN 100 must be carried tagged while the AP management network remains native.

Common mistakes include a missing tagged VLAN on the firewall uplink, a client port using Custom instead of Block All, an AP port without the SSID VLAN, or different VLAN IDs on Sophos and UniFi.

Plan changes without losing management access

Take particular care when changing uplinks or management networks. Include the following safeguards before making the production change:

  • UniFi management network: The management VLAN must remain available when the port configuration changes.
  • Uplink to Sophos Firewall: Changes to this port often affect several VLANs simultaneously.
  • Alternative access: Remote changes require a fallback path to the switch and firewall.
  • Test port: New assignments can be validated on a reserved port without moving production devices.
  • Backup: The Sophos and UniFi configurations must be saved at the last known working state.

We recommend validating the new VLAN with a single test client first. Roll out the port assignment to additional access points, switch uplinks, or client ports only after DHCP, gateway, DNS, Firewall Rule ID, NAT Rule ID, and the intended blocks all match the design.

Check Device Access

Device Access controls local services on the firewall itself, not forwarded traffic. This matters for new VLANs:

  • If clients use the firewall as their DNS resolver, allow DNS for the corresponding zone.
  • If monitoring needs to check the firewall, allow Ping/Ping6 only where required.
  • Standard clients, guests, and IoT devices should not access WebAdmin or SSH.
  • Management access belongs in a dedicated admin network or narrow Local Service ACL Exception Rules.

Secure access to Sophos Firewall with Device Access explains the detailed hardening steps.

Test and validate

Do not test only internet access after configuration. Use a reproducible test plan:

  1. Connect the test client to the intended UniFi port or the intended SSID.
  2. Verify that its address is between 10.100.0.50 and 10.100.0.200.
  3. Check default gateway 10.100.0.1 and the expected DNS server.
  4. Generate an allowed internet connection.
  5. Test an allowed internal connection if the design includes one.
  6. Test access to an intentionally prohibited internal network; it must fail and must not match an unexpected allow rule.
  7. In Sophos Log Viewer, verify rule Clients_to_WAN, the Firewall Rule ID, the NAT Rule ID, and the Out interface for WAN traffic.
  8. Check the rule usage counter.
  9. For a wireless SSID, also confirm that AP management remains reachable while the client joins VLAN 100.

If a different rule matches, the NAT Rule ID is missing, or the interfaces do not match the design, the test has not passed. Test a Sophos Firewall rule with Log Viewer and Packet Capture shows the next diagnostic steps.

Common mistakes

  • The VLAN is not allowed tagged on the UniFi uplink to the firewall: Clients receive no address or cannot reach the firewall.
  • The VLAN uses the wrong Sophos parent interface: The firewall does not see the traffic on the expected VLAN interface.
  • The client port is not a clean access port: Standard clients join the wrong native VLAN or receive no address.
  • The SSID VLAN is also the native VLAN on the AP port: Wireless clients cannot connect correctly.
  • DHCP or relay is missing: The client receives no address or falls back to APIPA.
  • The network object is wrong: The rule does not cover the entire VLAN or matches a different network.
  • DNS Device Access is missing: The client can reach IP addresses but cannot resolve names through the firewall.
  • The firewall rule is missing or ordered incorrectly: The client receives an address, but the required traffic is blocked.
  • The NAT rule does not match: Internal targets work, but internet traffic leaves the firewall without a suitable translation.
  • The allow rule is too broad: Internal access effectively defeats the intended VLAN separation.
  • The native VLAN on the uplink is wrong: The switch or access point disappears from the management network.

Troubleshooting

If the VLAN does not work, check from Layer 1 through Layer 7:

  1. Cable and link: Does the UniFi port show a link at the expected speed?
  2. Virtual network: Does VLAN 100 exist in UniFi with Third-party Gateway?
  3. Firewall uplink: Is VLAN 100 allowed under Tagged VLAN Management?
  4. Client or AP port: Are the native VLAN, Block All or Custom, and the permitted tagged VLANs correct?
  5. Sophos interface: Is the VLAN visible and connected under Network > Interfaces, on the correct parent interface?
  6. DHCP: Is there a DHCP server or relay for the VLAN, and does the range match the subnet?
  7. Gateway and DNS: Does the client use 10.100.0.1 and the intended DNS server?
  8. Device Access: Are DNS or Ping allowed for the zone if these local services are required?
  9. Firewall rule: Do the source zone, NET_Clients_VLAN100, destination zone, and services match?
  10. NAT: Does the WAN test show the expected NAT Rule ID and a translated source address?
  11. Log Viewer: Is the traffic allowed, dropped, or matched by another rule?
  12. Packet Capture: Do packets arrive on the correct interface and leave the firewall through the planned path?

If no packets arrive on the Sophos parent interface, the problem is usually before the firewall: the cable, UniFi port, native or tagged assignment, or the wrong uplink. If packets arrive but no appropriate Firewall Rule ID appears, check rule matching first. If the rule and NAT are correct but replies are missing, continue with routing, DNS, and the return path.

Checklist

  • The VLAN ID is identical on UniFi and Sophos.
  • The Sophos VLAN uses the correct parent interface, zone, and gateway address.
  • Network object NET_Clients_VLAN100 exactly represents 10.100.0.0/24.
  • DHCP or DHCP relay is configured, with the correct gateway and DNS server.
  • The UniFi virtual network uses Third-party Gateway.
  • The firewall uplink allows VLAN 100 tagged.
  • The client port uses Clients as its native VLAN and Block All for tagged VLANs.
  • The AP port uses the management network as its native VLAN and VLAN 100 under Custom.
  • Firewall rules allow only the intended destinations and services and write logs.
  • Internet traffic matches the expected SNAT or MASQ rule; internal VLAN paths are not translated unnecessarily.
  • Device Access permits only the required local services.
  • Positive test, negative test, Firewall Rule ID, NAT Rule ID, and Packet Capture have been checked.
  • Backup, test port, and management fallback remain available until validation is complete.

Frequently asked questions

Does every VLAN need its own Sophos zone?

No. Multiple VLANs can share a zone when they have the same trust level, firewall rules, and Device Access requirements. A separate zone is often clearer when a VLAN has different permissions or a different risk profile.

Must DHCP run on Sophos Firewall?

No. DHCP can run on an internal server or be forwarded through a relay. What matters is that clients receive a suitable IP address, gateway, and DNS configuration and that the DHCP path works through the VLAN.

Why does the internet work but internal servers do not?

Usually, a suitable firewall rule between the VLAN and server zones is missing, the rule matches a different network object, or the internal server has no return path. For unique internal networks, do not add NAT as a guess; check the rule, route, and return path.

Why does the client not receive an IP address?

Common causes are a missing tagged VLAN on the uplink, the wrong native VLAN on the client port, the VLAN on the wrong Sophos parent interface, or a missing DHCP server or relay.

Why can a wireless client not join the SSID?

The AP port must allow the SSID client VLAN tagged. In this example, it must not also be the native VLAN; the AP management network remains native. Then verify the SSID assignment, DHCP, and the path to Sophos Firewall.

Should a guest VLAN use DNS through Sophos Firewall?

This can be useful when the firewall should provide or filter DNS for the guest VLAN. DNS must then be allowed for the corresponding zone under Device Access. Alternatively, an internal or external DNS server can be distributed through DHCP, with the associated firewall and NAT path deliberately allowed.