Sophos XG and Unifi USG

sophos Nov 12, 2020

Previously I was using a Sophos UTM and Unifi USG for my home lab. Why? Anyone in the Ubiquiti Unif Environment will understand, the Unifi GUI looks much nicer when all the services are filled in and you get DPI info. However i felt the USG wasnt good enough as a firewall, IPS, IDS system so i decided to implement a Sophos UTM firewall. Fast forward a few years an I am now looking to move from the out dated UTM to the XG.

As the previous guide - https://blog.awelswynol.co.uk/2020-01-sophos-utm-infront-of-unifi-usg/

A few services need to be configured to allow them to play nicely together.

In theory enabling OSPF and using Dynamic Routing would have been a quick and easy set up, however OSPF isnt really needed for a small, simple network and the overhead of CPU and memory utilisation wasnt worth it.

Ok so how do we do it? First lets visualise it.


USG WAN is my backup link to the internet incase my Sophos goes down.

USG WAN2 connects to the Sophos LAN port

Sophos WAN port connect to the Internet.


Unifi

Let's start with the Unifi USG and Unifi Controller.

If you are familiar with config.gateway.json - this file is used for when a USG re-provisions. Normally the config doesnt survive the process without a json file.

On the USG you have WAN, LAN and WAN2/LAN2. eth0,eth1 and eth2 respectively. In my case I use WAN (eth0) as my main connection to the internet, LAN (eth1) connects to my LAN Switch and then WAN2 (eth2) will be the connection to the Sophos XG before it connects to the internet.

The json below adds a NAT masquerade rule to eth2 port (WAN2)

{
"service": {
	"nat": {
		"rule": {
			"5999": {
				"exclude": "''",
				"outbound-interface": "eth2",
				"type": "masquerade"

			}		
			}
			
		}
	}
}

Save the file as config.gateway.json and save it in your Unifi Controller folder

...data/sites/**site name**/config.gateway.json

In your Unifi Controller create a new network

Settings > Networks > Create New

Choose WAN and then WAN2

Create a network that will connect your USG to the Sophos XG

Static IP

10.0.0.2 - IP of USG

10.0.0.1 - IP of Sophos XG

255.255.255.252 - subnet or CIDR /30

10.0.0.1 or 1.1.1.1 or 8.8.8.8 as DNS.


Head over to your Unifi Devices list and select the USG

Ports > Configure Interface

Set Port WAN 2 / LAN 2 to use WAN 2


USG Firewall.

Finally on the USG we need to create a Firewall Rule on WAN IN. This allows the Sophos XG to communicate with LAN Devices.

Settings > Routing & Firewall > Firewall > WAN In

Name = WAN2 to Internal Subnets

Rule Applied = After predefined rules

Action = Accept

IPv4 Protocol = All

Source = IP 10.0.0.1 (Sophos XG LAN IP)

Destination = IPv4 address group = All LAN Subnets (you have to create a group with all LAN subnets listed)

Port Group = Any

Save


Sophos XG

Now lets log into the Sophos XG admin page https://**IP**:4444

First lets configure the Network Interfaces

Network > Interfaces

Port 1 LAN

Port 2 WAN

Make sure they are in the correct Zones.

Port 1 LAN

IP assignment = Static

IP Address = 10.0.0.1/30

Network > Routing > Static Routing

A static route is required to inform the Sophos XG that to reach your LAN subnets it needs to send traffic via in the interface that is connected to your USG.  In IPv4 Unicast route create new routes, 1 for each of your LAN subnets

example

Destination IP = 192.168.40.0/26

Gateway = 10.0.0.2 (The IP of your USG WAN 2 interface)

Interface = Port 1 - LAN

Distance = 1


Network > Routing > Gateways

Configure a Gateway Health Check. Add a new IPv4 Gateway

Name = LAN Gateway

IP = 10.0.0.2 (USG WAN 2 IP)

Interface = Port 1 - LAN Interface

Health Check = Ping 10.0.0.2


Firewall Rules

Finally we need to create 2 firewall rules.

Protect > Rules & policies > Firewall rules

First Rule creates a Masqurade NAT.

· Name = Masq NAT

· Action = Accept

· Source = LAN

· Source Networks = ** List of your LAN Subnets**

· Destination Zone = WAN

· Desintation Networks = any

· Services = any

Create a Linked NAT Rule

Linked NAT

Just change Translated source (SNAT) to MASQ

Firewall Rule 2

This next rule is only for testing. it will basically turn off your firewall and allow all traffic from all destinations and all sources.

Name = Allow Everything

Action = Accept

Source Zone = Any

Source Network = Any

Destination Zone = Any

Destination Network = Any

Services = Any


If everything is correct above you should now be able to test your connection by disconnection WAN 1 on the USG.

Tags

Great! You've successfully subscribed.
Great! Next, complete checkout for full access.
Welcome back! You've successfully signed in.
Success! Your account is fully activated, you now have access to all content.