Site-To-Site Sophos <-> AWS VPC: BGP Issues

Hi Sebastian Becker , 

From the output it appears that the device is considering the 10.81.234.0/24 as not reachable.

To confirm and to check for resolution, can you pls share the support access-id of the device to me in private message to me?

Thanks,

Hi, thanks. I am afraid I cannot share support credentials at this stage.

I can confirm this because I added a non-existing network for testing purpose and it behaves the same.

All other networks except the OpenVPN network can be added / removed from the BGP networks and the change is immediately visible in AWS routing tables.

Could you point out what may be the reason why the OpenVPN network is considered not reachable by the firewall?

thanks again, best regards

Sebastian

Hi, thanks. I am afraid I cannot share support credentials at this stage.

I can confirm this because I added a non-existing network for testing purpose and it behaves the same.

All other networks except the OpenVPN network can be added / removed from the BGP networks and the change is immediately visible in AWS routing tables.

Could you point out what may be the reason why the OpenVPN network is considered not reachable by the firewall?

thanks again, best regards

Sebastian

Hi Sebastian Becker , 

A network is considered reachable if it is either directly connected or if there is a valid route for that network in the kernel. 

To make BGP advertise a non-existing/unreachable network, we can use the command "no bgp network import-check" in CLI as below: 

bgp(config-router)# no bgp network import-check

This would make BGP advertise a network *always*, even when it not reachable. 

Would this help in your scenario? 

Thanks,

Hi, thanks, this sounds promising. Before I try, could you please share the command to re-enable the import-check?

best regards

Sebastian

Hi, I tried the command but it won't work: It says Unknown command: no bgp network import-check

thanks

Hi, this helped! Thanks.

I was a little bit confued because I tried to enter no bgp network import-check one level too high.

I had to enter "router bgp XXXX" first and then it worked.

Thanks again, best regards

Hi Sebastian Becker ,

To re-enable the check we can use the same cli, without "no" as below : 

bgp(config-router)# bgp network import-check

Thanks,

Hi, 

We have to apply the command in the "config-router" prompt.  And pls save the config after applying the command for it to persist after device/process restarts. 

Thanks,

Yes that helped. First I did not go into “router config” mode , that’s why the command did not work. Problem solved, thank you very much.

Maybe Sophos firewall should not consider OpenVPN network as unreachable in the first place. Then it would not be necessary to skip the network check.

Hi,

how do I save the config to persist? You mean in the CLI?

We are running a HA cluster. Will this automatically propagate to the other node?

Thanks

Hi Sebastian Becker , 

After the cli "no bgp network import-check"(or any other cli) , please issue the cli "write" - this would save the config and make it persist between the reboots. It also propagates the config to other aux device in the HA setup.  

For usage of "write", pls refer to the config sample that I had shared earlier. 

Thanks,