Cisco C3650 layer 3 - Sophos XG310 in HA mode

[JackyHo]

Hi All,

My current network is:

Firewall Sophos XG310 (IP: 10.10.80.250) <-> Switch C3650 Layer 3 (IP: 10.10.80.249) Inter-vlan routing <-> Layer 2 access switch <-> Users.

Currently, on the C3650 all the vlans are route through 10.10.80.250 to access internet by this command: ip route 0.0.0.0 0.0.0.0 10.10.80.250. 

I'm looking to put the 2nd firewall XG310 to establish HA mode. So how the configuration for the 2nd XG310 on the C3650? 

Thank you for reading my post.

[ngkin2010]

Hi,

Assume that you are going to configure active-standby HA on XG310, then you don't need to change the routing on C3650. Because the 10.10.80.250 will belong to the HA cluster of XG310. Whenever active unit go down, the 10.10.80.250 will moved to secondary unit automatically.

The only configuration that you need to cater is the switch port's configuration. Make sure both XG310 connecting to C3650 with the identical port's setting on C3650. 

[JackyHo]

Thank you for your reply @ngkin2010 

"The only configuration that you need to cater is the switch port's configuration. Make sure both XG310 connecting to C3650 with the identical port's setting on C3650. "

On port 1 of the C3650 connecting with the XG310 (let say it node1) the configure it is:

interface gi 0/1

no switchport

ip address 10.10.80.249 255.255.255.248

I've tried configure port 2 of the C3650 connecting with XG310 node 2 with the same config of port 1 but cannot, the C3650 said 10.10.80.248 overlaps with gi0/1

I'm stuck at that point.

[ngkin2010 · Accepted solution]

Hi,

You need to change the routed port to SVI. It's require down time to reconfigure.

interface gi0/1   [connecting to node1]
  no ip address
  switchport
  switchport mode access
  switchport vlan [NEW-VLAN]
  spanning-tree portfast

interface gi0/X    [connecting to node2]
  no ip address
  switchport
  switchport mode access
  switchport vlan [NEW-VLAN]
  spanning-tree portfast

vlan [NEW-VLAN]
  name  [vlan-name for the Transit-VLAN]

interface [NEW-VLAN]
  no shutdown
  ip address 10.10.80.249 255.255.255.248

[JackyHo]

thank you for your quick reply.

After I configured the SVI. The HA on both XG can establish. I've tried to unplug the LAN cable connecting XG node1 <-> C3650, all system down ^^, it didn't auto switch to the XG node2. 

[JackyHo]

it's my fault on config on XG. Then it's ok now. Thank you @ngkin2010 for saving my life ^^