How to set up VLANs for Cisco SG500 - 28 switch

Question

Hi,
First of all, this is my first post in here, I hope someone can help me, and please be patient since I am very little experienced.
OK, so let me explain you the scenarion that I am facing and hopefully someone will be able to help me.
We have a Cisco SG500 - 28 port gigabit switch in our workplace.
Our goal, is to create 3 VLANs and seperate the networks between different departements.
VLAN1 (which is the default VLAN in the switch) - will be used for IT department and the management.
VLAN100 - will be used for business .
VLAN200 - will be used for guests who need to connect to the internet through WiFi.
I have created VLAN100 and VLAN200, and VLAN1 is there by default.
I want to use port 13 for VLAN200 and to connect the Wifi access-point there.
The uplink is in port 25.
I would be glad if you could explain me the stuff first in a abstract more general level, and then we can look at the specific scenario that we have.
The Cisco SG500 - 28 gets internet from a Sophos UTM 9 router.
I will need to take care of inter-VLAN routing as well, and subnet, and DHCP
Thanks in advance,
Kindest regards,
D

Answer 1

Hello Desmond,
You have two different options:
Option 1:
Configure Sg500 switch as a Layer 2 switch and let the Sophos firewall do all the Layer 3 routing along with internet access. If you choose this option, then, you need to configure your uplink port as a trunk port and allow all 3 vlans to pass through. Also, you need to make sure that the Sophos device supports VLANs and trunking (or at least sub interfaces and create sub interfaces for each vlan). Also, all LAN devices will have the respective sub-interface/VLAN interface IP on the Sophos as their default gateway.
Option 2:
Configure SG500 switch as a Layer 3 device and configure intervlan routing to manage internal network traffic locally and send just the internet traffic to Sophos device.
You need to create Layer 3 interfaces for VLAN1, VLAN100, and VLAN200 on SG500 and then make those Layer 3 interfaces default gateway for respective VLAN.
You can configure the uplink port as an access port in one of the VLANs.
Make sure that the Sophos device has an IP on the same subnet as the VLAN you chose for the uplink port.
You also need to enter static routes on the Sophos device for the remaining two subnets on the SG500 (next hop address pointing to the IP address of the VLAN that the uplink port belongs to).
Also, on the SG500, you need to configure a default route, next hop address pointing to the Sophos interface IP address.
Hope this helps.
Nagaraja