Using Dedicated Sophos XG Interfaces for Management and VLAN Traffic

The most useful safety decision in this project was to separate the path used to administer Sophos XG from the path carrying the production VLANs.

The failure scenario

Imagine configuring the firewall through the same trunk being changed. One incorrect VLAN ID, native-VLAN assumption, switch command, or parent-interface selection can make WebAdmin unreachable. The firewall may still be running perfectly, but the only management path has disappeared.

A dedicated physical interface limits that risk. It can remain on a small administration subnet while another port is used as the parent for the VLAN interfaces.

The logical layout

The initial design described the roles as:

Dedicated Sophos port -> direct or restricted administration
Separate Sophos port  -> 802.1Q trunk to managed switch
WAN port               -> internet connection
Optional separate port -> DMZ or another isolated physical segment

Early planning mentioned Port 1 for administration and Port 8 for the VLAN trunk. Later implementation work used another port as the trunk parent. That evolution is worth documenting: port numbers are deployment details; dedicated roles are the durable design decision.

Configure the management port conservatively

The administration interface should use a non-overlapping static subnet. It does not need to be the default gateway for ordinary devices. Restrict physical access and limit the firewall’s local services to the intended source network or host.

Before treating it as the recovery path, test it:

1. Connect an administration client directly or through the intended isolated switch path.
2. Assign a compatible address or verify DHCP, if deliberately enabled.
3. Open WebAdmin using the management-interface address.
4. Verify the client does not unexpectedly reach production networks.
5. Record the cable, port, address, and required client settings.

An untested emergency interface is only a theory.

Keep the trunk focused

The VLAN parent interface should carry the required tags and should not accidentally double as the emergency administration network. If untagged traffic is supported on the trunk, define it explicitly on both the Sophos and switch sides.

Document the mapping:

Restrict services on the firewall itself

WebAdmin and SSH terminate on Sophos XG. They are controlled through device-access and local service ACL settings, not only through normal firewall rules.

The target state is:

• HTTPS administration available from the management path;
• SSH disabled unless needed, or restricted to the same trusted source;
• no WebAdmin exposure from IoT, media, home-automation, or WAN zones;
• explicit exceptions used where a global zone permission would be too broad.

This is independent from policies that allow an administrator to reach switches or hypervisors through the firewall.

A safe change procedure

When modifying the trunk:

1. Confirm the dedicated management path is connected and working.
2. Save or export the current configuration.
3. Record the current switch VLAN membership.
4. Change one VLAN or one port behavior at a time.
5. Test from a client in the affected VLAN.
6. Verify the expected firewall rule and logs.
7. Keep the old path until the new path is proven.

This procedure may feel slow. It is much faster than recovering a firewall whose addressing and switch uplink were changed simultaneously.

When one interface is unavoidable

Virtual appliances and small hardware may not offer a spare port. In that case:

• use a known-good native or tagged management VLAN;
• keep hypervisor console access available;
• stage switch changes carefully;
• schedule an on-site recovery option;
• export the configuration before changes;
• avoid altering both ends of the link without a rollback plan.

The principle is resilience, not a mandatory cable count. In my hardware setup, a spare port made the physical separation an easy and worthwhile choice.

Reference

• Device access — Sophos Firewall 19.0