This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

MS Azure - IPSec Tunnel (S2S) with BGP Routing

So I have borrowed the subject line from another post that was not answered in hopes that someone has some new information. Here is my setup. Changed IP for discussion.

HQ (Sophos XG 450) 1.1.2.1 >> IPSEC >> Azure Region A 1.2.2.1 >> Azure Peering >> Azure Region B 1.3.2.1

1. Region A to HQ using Sophos XG 450 and Azure site-to-site IPSEC - Connected and Working

2. Azure peering from Azure Region A to Azure Region B - Connected and Working

3. I CAN ping Region A from HQ.

4. I CANT ping Region B from HQ.

5. I CAN ping Region B from Region A.

I am thinking I need to setup BGP and I have this setup on Azure but I can't find any documentation on how to set this up from Sophos XG to Azure IPSEC anywhere.

Any assistance is greatly appreciated.

This thread was automatically locked due to age.

0 Keyur over 4 years ago

Hi CyberEagle

The requested feature is not available as of now for the Sophos XG firewall.

I would request you to vote for this feature on the given link - https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/5933414-native-microsoft-azure-site-to-site-vpn

Regards,

Keyur
Community Support Engineer | Sophos Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link
Cancel
Vote Up 0 Vote Down

Cancel
0 RickardNordahl over 4 years ago

You need to add routing tables to your VNET Peers to get it working. My guess is that is missing.

Add the HG network to a static route in your VNet peers and that should do it. As long as you have the B network in the tunnel in the XG as well.

//Rickard
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to RickardNordahl

Also you would need VTI i guess? Tunnel interface should be ok.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 RickardNordahl over 4 years ago in reply to LuCar Toni

If they do not need Dynamic Routing It should work with the "old way" as well. Since this setup do work in V 17 as well.

But if you have V 18 VTi is the way to go.

//Rickard
Cancel
Vote Up 0 Vote Down

Cancel