Nested vSphere Home Lab – Part 1 – Sophos Firewall

intro

Welcome to Part 1 of my Nested vSphere Home Lab Series.  In my previous post, I went over the gist of what I plan to do for my nested Nested vSphere Home Lab.  In this post, I will cover the setup and configuration of a Sophos XG Firewall Home Edition which will serve as the router for my nested lab environment.  My physical Home Lab is configured with Virtual Distributed Switches, or VDS (sometimes seen as DVS) for short, and since this is a nested lab environment that will not have any physical uplinks connected, I will need to create a new VDS without physical uplinks connected to it along with a portgroup for the nested environment and then configure access to the environment from my LAN.  This can also be configured on a Virtual Standard Switch, or VSS for short, in the same fashion.  All network traffic will flow through the virtual router/firewall to communicate to and from the nested lab.  Afterward, I’ll cover the Active Directory Server setup.

Router

Prerequisites:

• VDS and portgroup without physical uplinks
  • Set the VLAN type for this portgroup to VLAN Trunking with the range of 0-4094 to allow all VLANs to trunk through
• Static route to access the nested lab from my LAN
  • Once you determine the subnets you’d like to use for the nested lab, add a static route summary on your physical router

I have a bunch of VLANs created for my physical Home Lab along with a little VMware NSX in there as well, serving physical and virtual network portgroups/segments to my lab.  With that said, one of the VLANs I have is for “lab” work, such as this so I’ll be connecting one uplink from the router to this VLAN which will serve as the WAN interface while the other uplink will be connected to the new nested portgroup to serve as the LAN for the nested lab.  I’ll describe the basics for deploying the Sophos XG firewall, but will not go into full detail as this is pretty trivial and can be deployed using the following guide as a reference.

• OS: Other 6.x or later Linux
• CPU: 1 (add more as needed – max supported is 4 in the home edition)
• RAM: 4GB (add more as needed – max supported is 6GB in the home edition)
• Disk: 16GB thin (you may make this smaller if you’d like)
• Network Adapter 1: LAN portgroup (nested)
• Network Adapter 2: WAN portgroup
• Boot: BIOS (will not boot if you keep as EFI)

Once the VM has been deployed, the Sophos XG will be configured with a 172.16.16.16 address by default.  This will need to be changed to the subnet you’re using for your nested LAN interface.  Login to the console with the default (admin – admin) credentials, and choose the option for Network Configuration to change the IP for your nested LAN port.

Once this is done, you would normally navigate to that address on port 4444 to access the admin GUI.  Unfortunately, this will not work since the LAN side has no physical uplinks.  So what do we do?  We need to run a command to enable admin access on the WAN port.  To do so, choose option 4 to enter the device console and enter the following command:

system appliance_access enable

The WAN port is set to grab an address from DHCP so you’ll need to determine which IP address this is either by going into your physical router, or using a tool like Angry IP.  Once in the Admin GUI, navigate to Administration > Device Access and tick the box for WAN under the HTTPS column.  See this post for reference.

Now, we can create our VLANs for our nested environment.  I’m using the following for my lab:

Navigate to Networking and select Add Interface > VLAN to create each of your networks.

With our VLANs created, we’ll need to create two firewall rules to allow traffic from the WAN port to access the LAN, as well as to allow traffic from LAN to LAN. Navigate to Rules and policies > Add firewall rule and create the following rules.  Choose something easy to label them as which makes sense to you.

This is where the static route will now be useful to access your nested lab.  I’ve configured a route summary of 10.100.0.0/16 to go through the IP address of the WAN interface as the gateway so that I can access the Admin UI at https://10.100.1.1:4444 as well.  I’ll now also be able to access the ESXi UI and VCSA UI, once they are stood up.

The final thing I will be doing is enabling the native MAC Learning functionality that was introduced in vSphere 6.7, so that I do not need to enable Promiscuous Mode, which has normally been a requirement for the Nested portgroup and nested labs in general…and in some cases it still is!  To learn more about how to do this, see this thread.  In my setup, I ran the following to enable this on my nested VDS portgroup:

Set-MacLearn -DVPortgroupName @("vds1-nested-trunk") -EnableMacLearn $true -EnablePromiscuous $false -EnableForgedTransmit $true -EnableMacChange $false

To check that it was indeed set correctly, I ran the following:

Get-MacLearn -DVPortgroupName @("vds1-nested-trunk")

Alternatively – now available in vSphere 8.0, you have the ability to enable MAC Leaning directly via the vCenter UI as well!!

 And there you have it!  In the next post, I will go over configuring an Active Directory server for the nested lab!

–virtualex

Nested vSphere Home Lab – Part 1 – Sophos Firewall by virtualex is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.