Sophos Firewall 18 to Azure VPN Gateway IPsec connection with BGP

Disclaimer: Please contact Sophos Professional Services if you require assistance with your specific environment.

Prerequisite

1. Sophos Firewall 18 firmware

2. Your On-Prem Sophos Firewall and the following information:

  • The public IP of Sophos Firewall.
  • The IP address space behind your Sophos Firewall

3. Your Microsoft Azure vNet and the following information:

  • IP address space of the vNet

Step 1: Create Azure Local Network Gateway (with Sophos Firewall public IP details)

The local network gateway typically refers to your on-premises location. You will need the public IP address of your On-Prem Sophos Firewall and your On-Prem Private IP address spaces.

Please note that this configuration assumes that the public IP address is directly configured on the On-Prem Sophos Firewall. Your configuration will be slightly different if your On-Prem Sophos Firewall sits behind a NAT device.

  1. Go to the Azure Portal: https://portal.azure.com and sign in with your credentials.
  2. Click Create a resource.
  3. In the search box, type Local network gateway.
  4. Select Local network gateway and click Create.
  5. In the Create local network gateway blade, configure the following and then click on Create:

    • Subscription: Verify that the correct subscription is selected for the deployment.
    • Resource group: Select the resource group that you want to use. You can either create a new resource group or select an existing one.
    • Region: Select the location that this object will be created in.
    • Name: On_Premises_Sophos_XG_Firewall (You can give this any preferred name).
    • Endpoint: IP address
    • IP address: Specify the public IP address of your Sophos Firewall.
    • Address space: Specify the address ranges for the network that your On-Prem local network represents. In our scenario, this is 10.0.0.0/16.
  6. Click Next : Advanced. Configure the following.

    • Configure BGP settings: Yes
    • Autonomous system number (ASN): The ASN of your Sophos Firewall. In this scenario, it is 65510.
      Note: A BGP-enabled connection between two network gateways requires that their ASNs be different. Additionally, the following ASNs are reserved by Azure: 8075, 8076, 12076 (public), 65515, 65517, 65518, 65519, 65520 (private). You cannot specify these ASNs for your on-premises VPN devices when connecting to Azure VPN gateways. While setting up IPsec connectivity from virtual network gateways to Azure virtual WAN VPN, the ASN for Local Network Gateway is required to be 65515.
    • BGP peer IP address: WAN IP of your Sophos Firewall. In this scenario, it is 10.0.1.4.
  7. Click Next : Review + create.
  8. Click Create.

Step 2: Create a Gateway Subnet

The VPN gateway will be deployed into a specific subnet of your network called the 'GatewaySubnet'. The size of the GatewaySubnet that you specify depends on the VPN gateway configuration that you want to create. While it is possible to create a GatewaySubnet as small as /29, it is recommend to create a larger subnet that includes more addresses by selecting /27 or /28 to be able to accommodate future configurations.

  1. In the Azure Portal: https://portal.azure.com, click More services.
  2. In the search box, type Virtual networks and select the Virtual networks option.
  3. Click the virtual network for which you want to create a virtual network gateway.
  4. In the Virtual networks blade, under Settings, click Subnets.
  5. In the Subnets blade, click + Gateway subnet to add a new Gateway subnet.
  6. In the Add subnet blade, configure the CIDR range of the new Gateway subnet and click Save. In this scenario, this is 192.168.1.0/24.

Step 3: Create the VPN Gateway

  1. In the Azure Portal: https://portal.azure.com, click Create a resource.
  2. In the search box, type Virtual network gateway.
  3. Select Virtual network gateway and click Create.
  4. In the Create virtual network gateway blade, configure the following:

    • Subscription: Verify that the correct subscription is selected for the deployment.
    • Instance details
      • Name: This will be the name of the gateway object you are creating.
      • Region: Select the same location as your virtual network (Otherwise the virtual network will not be displayed on the list).
      • Gateway type: VPN
      • VPN type: Route-based (this is a MUST to be able to use IKEv2).
      • SKU: Select the gateway SKU from the dropdown. For more information about gateway SKUs, see Gateway SKUs.
      • Generation: Generation 1
      • Virtual network: Choose the virtual network to which you want to add this gateway (if the virtual network that you want is not displayed on the list, verify that you have selected the right location in the Region parameter above).
    • Public IP address:
      • Public IP address: Create new
      • Public IP address name: Enter a name for the public IP address resource.
      • Configure BGP: Enabled
      • Autonomous system number (ASN): 65515
        Note: Azure virtual network gateways are assigned a default ASN of 65515. Note that a BGP-enabled connection between two network gateways requires that their ASNs be different. If needed, you can change the ASN now or after the gateway has been created.
      • Leave other settings as default.
      • Click on Review + create.
      • Click on Create.
      • Creating a gateway can take up to 45 minutes!
  5. After the VPN gateway creation has been completed successfully, obtain its public IP address (this will be needed in step 6).
    • In the Azure Portal, click More services and search for Virtual network gateways. Then click Virtual network gateways.
    • Click the VPN Gateway that you just created.
    • In the Virtual network gateway blade, in the Overview section, make a note of the public IP address of the gateway.
    • This will be used in step 6.

Step 4: Create the VPN connection (Azure)

  1. In the Azure Portal: https://portal.azure.comclick More Services and search for Virtual network gateways. Then click Virtual network gateways.
  2. Select the VPN gateway that you created earlier.
  3. In the Virtual network gateway blade, in the Settings section, click Connections, then click + Add.
  4. In the Add connection blade, configure the following:
    • Name: Sophos_Xg_OnPrem_To_Azure (Input your preferred name)
    • Connection type: Site-to-site (IPSec)
    • Virtual network gateway: The value is fixed because you are connecting from this gateway.
    • Local network gateway
      • Click Choose a local network gateway.
      • In the Choose a local network gateway blade, select the local network gateway that you created earlier.
    • Shared key (PSK): Input a complex shared key. The value here must match the value that we will use on our on-premises Sophos Firewall.
    • Enable BGP: Enabled
    • IKE Protocol: IKEv2
    • The remaining values for Subscription, Resource Group, and Location are fixed.
    • Click OK to create your connection. You will see Creating connection flash on the screen.

Step 5: Download and extract needed information from the configuration file (Azure)

  1. In the Azure Portal: https://portal.azure.comclick More services and search for Virtual network gateways. Then click Virtual network gateways.
  2. Select the VPN gateway that you created earlier.
  3. In the VPN Gateway blade, in the Settings section, click Connections, then select the connection that you created earlier.
  4. Click the Download configuration button. This configuration file contains the needed information to configure the VPN connection on Sophos Firewall.
  5. In the Download configuration blade, select the following:
    • Device vendor: Generic Samples
    • Device family: Device Parameters
    • Firmware version: 1.0
    • Click Download configuration.
  6. Open the downloaded file and make a note of the following:
    • Scroll down to the Tunnel interface (VTI) configuration section.
    • Make a note of the interface tunnel IP address and subnet mask
    • Also, make a note of the MSS value.
    • Both values will be needed for the configuration of the xfrm tunnel interface on Sophos Firewall.

Step 6: Create the VPN connection (Sophos Firewall)

  1. Sign in to the WebAdmin of your On-Premises Sophos Firewall.
  2. Under Configure, click VPN → IPSEC connections → Add.
  3. Configure the following settings:
    • General settings
      • Name: Input any preferred name.
      • Connection type: Tunnel interface
      • IP version: Dual
      • Gateway type: Respond Only
      • Activate on save: Selected
      • Description: Add a description of the connection.
    • Encryption
      • Policy: Microsoft Azure
      • Authentication type: Preshared key
      • Preshared key: Enter the same preshared key that you entered when creating the VPN connection on Azure.
      • Repeat preshared key: Confirm the preshared key.
    • Gateway settings
      • Listening interface: Select the WAN interface of Sophos Firewall.
      • Gateway address: Input the public IP of the Azure VPN gateway that you noted in Step 3 (5).
      • Local ID type: IP Address
      • Remote ID type: IP Address
      • Local ID: Enter the public IP of the On-Prem Sophos Firewall.
      • Remote ID: Input the public IP of the Azure VPN gateway that you noted in Step 3 (5).
      • There is no option to configure the Local subnet and Remote subnet. It will both be set to 0.0.0.0/0.
    • Advanced
      • Leave default settings.
    • Click Save.
    • Click OK when prompted about the Preshared key.
    • The connection should now be active. Click on the red button under Connection to enable the connection.

    • When prompted if you are sure that you want to connect, click OK.

Step 7: Create firewall rules to allow inbound and outbound traffic through the VPN (Sophos Firewall)

  1. Sign in to the WebAdmin of your On-Premises Sophos Firewall.
  2. Under Protect, click on Rules and policies → Add firewall rule → New firewall rule.
  3. In the Add firewall rule window, configure the incoming firewall rule as follows:
    • Rule status: None
    • Rule name: azure_to_onprem
    • Action: Accept
    • Rule position: Top
    • Rule group: None
    • Log firewall traffic: Selected
    • Source
      • Source zones: LAN and VPN
      • Source networks and devices: Any
      • During scheduled time: Leave the default setting
    • Destination & services
      • Destination zones: LAN and VPN
      • Destination networks: Any
      • Services: Any
    • Leave other settings as default.
      • You can configure the security checks of Sophos Firewall for the traffic if required.
    • Click on Save.

Step 8: Configure the xfrm tunnel interface (Sophos Firewall)

  1. Sign in to the WebAdmin of your On-Premises Sophos Firewall.
  2. Under Configure, click Network → Interfaces. Click the WAN interface so that the xfrm interface will be displayed then click the xfrm interface.
  3. Under General settings, configure the following:
    • IPv4/netmask: Enter the IP address and select the subnet mask that you made a note of in Step 5 (6).
    • Expand Advanced settings.
      • Select Override MSS and enter the MSS value that you made a note of in Step 5 (6).
    • Click Save.
    • In the Update interface prompt, click Update interface.

Step 9: Configure static routing to the Azure VNET Gateway (Sophos Firewall)

  1. Sign in to the WebAdmin of your On-Premises Sophos Firewall.
  2. Under Configure, click Routing → Static routing.
  3. Under IPv4 unicast route, click Add and configure the following:
    • Destination IP / Netmask: The Default Azure BGP peer IP address of the Azure Virtual network gateway. You can use a subnet mask of /32. In this scenario, it is 192.168.1.254/32.
      Note: To see the Default Azure BGP peer IP address, go to Virtual network gateway, select your VPN gateway, and click Configuration.
    • Gateway: You can either leave this empty or enter the second IP address in the network that you made a note of in Step 5 (6). For example, the Sophos Firewall's tunnel interface in this scenario is 169.254.0.1 in a /30 network, so the only other IP in that network is 169.254.0.2. This can be entered optionally.
    • Interface: Select the Sophos Firewall's xfrm tunnel interface.
    • Distance: Leave default setting.
  4. Click Save.

Step 10: Configure BGP routing to the Azure network (Sophos Firewall)

  1. Sign in to the WebAdmin of your On-Premises Sophos Firewall.
  2. Under Configure, click Routing → BGP.
  3. Under Global configuration, configure the following:
    • Router ID: The WAN IP address of your Sophos Firewall. In this scenario, it is 10.0.1.4.
    • Local ASThe ASN of your Sophos Firewall. In this scenario, it is 65510.
  4. Click Apply
  5. Under Neighbors, click Add and configure the following:
    • IPv4 address: The Default Azure BGP peer IP address of the Azure Virtual network gateway. In this scenario, it is 192.168.1.254.
      Note: To see the Default Azure BGP peer IP address, go to Virtual network gateway, select your VPN gateway, and click Configuration.
    • Remote AS: The ASN of the Azure Virtual network gateway. In this scenario, it is 65515.
  6. Click Save.
  7. Under Networks, click Add and configure the following:
    • IPv4/netmask: The LAN network and subnet mask of your Sophos Firewall. In this scenario, it is 10.0.0.0/16.
  8. Click Save.

Step 11: Verify the VPN connection

  1. Do a connectivity test from an on-premise instance to an Azure VM.
  2. Do a connectivity test from an Azure VM to an on-premise instance.
  3. In the Azure Portal: https://portal.azure.com, go to Virtual network gateways and select the virtual network that you connected to.
  4. In the Virtual network gateway blade, in the Settings section, click on Connections.
  5. In the Virtual network gateway | Connections blade, ensure that the status of the connection is Connected.



  6. Click the connection and ensure that you are seeing data flow.
    • If you see 0B does not mean that the connection is not working, it just means that there is no data flow detected on the Azure side.

Things to watch out for

  1. Network Security Groups in Azure
    • If there is a network security group that is configured to block ports that you are attempting to connect on. This will cause issues.
  2. Route Table configuration in Azure
    • By default, the VPN Gateway automatically advertises the VPN subnets to the vNet route tables but watch out if you have user-defined routes that could override this.


Fixed Table of Contents
[edited by: DominicRemigio at 4:42 AM (GMT -7) on 19 Oct 2021]