Distribute IPSec site-to-site network via OSPF

Hi Patrick's ,

Thank you for reaching out to the community, I recommend you to refer the KBA - Sophos Firewall: Configure OSPF over IPsec VPN And Sophos XG: OSPF Over IPSEC VPN (youtube.com)

It's about IPsec connections to other companies. I have no access to the other site. The option with a GRE tunnel is not a solution that I can use.

Patrick's , you can go with route based IPsec VPN if the other end of IPsec gateway supports and have OSPF over xfrm interface on SFOS to redistribute routes from SFOS and vice-versa.

We have a lot of policy-based IPsec connections with external companies. Unfortunately, we can't change them. Is it safe to use redistribute kernel for policy-based IPsec connections or is there another solution?

Patrick's ,  With the approach mentioned in your initial post, do you see OSPF neighbourship established between SFOS and other gateway? I doubt the session comes up; unless the session is up, how will the networks be distributed over OSPF?

What local and remote subnets you have in you policy based IPsec tunnel?

Yes I see OSPF neighbourship established between SFOS and other gateway on the local (LAN) Interface. The OSPF session is established. Currently I do not need OSPF via IPsec, I want the many IPsec subnets to my routers on the LAN side. Sorry for the confusion.

I have

redistribute kernel
redistribute connected
redistribute static

in a test environment to local OSPF neighbours.

With ‘redistribute connected’, all local subnets are distributed. With ‘redistribute static’, all static subnets from the GUI list are distributed. With ‘redistribute kernel’, the policy-based IPSec subnets are distributed. This works fine, but I can't find any documentation or indication if it is ok to use ‘redistribute kernel’. So everything works in my test environment. My only question is if it is allowed to use it in a sophos production environment?

 Hi Patrick's ,

Yes, "redistribute kernel" CLI can be used to advertise such ipsec routes into OSPF domain. The command would include all the routes directly installed in the kernel, as part of the OSPF advertisements.  The routes would be advertised as any other redistributed route(External routes, Type 5). 

Thanks. 

 Hi Patrick's ,

Yes, "redistribute kernel" CLI can be used to advertise such ipsec routes into OSPF domain. The command would include all the routes directly installed in the kernel, as part of the OSPF advertisements.  The routes would be advertised as any other redistributed route(External routes, Type 5). 

Thanks. 

Thanks! In my test with ‘redistribute kernel’ only the ipsec routes are transmitted. When using ‘redistrubute connected’, I was able to prevent unwanted routes (HA-Interface/MGM/WAN-Interface) with route map.