Site-To-Site Sophos <-> AWS VPC: BGP Issues

Hi Sebastian Becker , 

From the output it appears that the device is considering the 10.81.234.0/24 as not reachable.

To confirm and to check for resolution, can you pls share the support access-id of the device to me in private message to me?

Thanks,

Hi, thanks. I am afraid I cannot share support credentials at this stage.

I can confirm this because I added a non-existing network for testing purpose and it behaves the same.

All other networks except the OpenVPN network can be added / removed from the BGP networks and the change is immediately visible in AWS routing tables.

Could you point out what may be the reason why the OpenVPN network is considered not reachable by the firewall?

thanks again, best regards

Sebastian

Hi Sebastian Becker

Please take reference of the below link to re verify the configuration :

https://support.sophos.com/support/s/article/KBA-000006289?language=en_US

Go to Administration > Device Access and make sure to Enable Dynamic Routing for the VPN zone as well . Click Apply.

Regards

Hi, thanks for your help. This option was already set.

I also tried to manually add the route to VPN network in AWS routing table. This also did not solve the issue.

Best regards,

Sebastian

Hi Sebastian Becker , 

A network is considered reachable if it is either directly connected or if there is a valid route for that network in the kernel. 

To make BGP advertise a non-existing/unreachable network, we can use the command "no bgp network import-check" in CLI as below: 

bgp(config-router)# no bgp network import-check

This would make BGP advertise a network *always*, even when it not reachable. 

Would this help in your scenario? 

Thanks,

Hi, thanks, this sounds promising. Before I try, could you please share the command to re-enable the import-check?

best regards

Sebastian

Hi, I tried the command but it won't work: It says Unknown command: no bgp network import-check

thanks

Hi, this helped! Thanks.

I was a little bit confued because I tried to enter no bgp network import-check one level too high.

I had to enter "router bgp XXXX" first and then it worked.

Thanks again, best regards

Hi Sebastian Becker ,

To re-enable the check we can use the same cli, without "no" as below : 

bgp(config-router)# bgp network import-check

Thanks,

Hi, 

We have to apply the command in the "config-router" prompt.  And pls save the config after applying the command for it to persist after device/process restarts. 

Thanks,