MS Azure - IPSec Tunnel (S2S) with BGP Routing

Question

Is there any documentation on getting BGP working through an Azure IPSEC VPN tunnel to an onprem Sophos XG 230? 
 I have an IPSEC tunnel established between onprem and Azure and would like to be able to route traffic from vnet peers and the Azure Point to site VPN back to onpremise resources. 
 Any guidance is helpful. 
 
 Thank you!

LuCar Toni · Answer

You should do this with a Route based VPN Tunnel. 
 For the VPN Part, see: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/126356/sophos-xg-firewall-v18-to-azure-vpn-gateway-ipsec-connection 
 For the BGP Part, see the AWS: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/125806/sophos-xg-firewall-set-up-ipsec-tunnel-between-aws-vpn-gateway-and-xg-v18-with-bgp

RickardNordahl · Answer

I do not what config you are using. But i was strugeling with tihs for a long time. To get BGP to work with Azure there is an extra step you need to do from the CLI. Console – Option 3 – Option 1 – Option 3 bgp> enable bgp# configure terminal bgp(config)# router bgp bgp(config-router)# neighbor remote-as bgp(config-router)# neighbor ebgp-multihop bgp(config-router)# end bgp# copy running-config startup-config restart bgp: bgp# clear ip bgp * ebgp-multihop is a requrement for Azure, but now AWS. When i comes the the "hops" part i used 5 and it worked for me, but it depends on you configuration in Azure //Rickard

RickardNordahl · Answer

Hi, no you do not need two tunnels, but the BGP IP in azure needs to match the IP on the VTi interface on the XG. 
 And you also need to enable dynamic routing under device access for the VPN zone. 
 //Rickard

MS Azure - IPSec Tunnel (S2S) with BGP Routing

Top Replies