OSPF over IPSec with Sophos UTM

Wow, that's a very sophisticated setup!  If there's an easy answer, ich habe keine Ahnung.  I would open a case with Sophos Support and escalate it immediately.  I suspect your client will need to invest in a Sophos consultant.  Please let us know your result.

Cheers - Bob

In general the answer is that no you can not run OSPF over just an IPSec connection. You need some kind of tunnel to transport the multicast traffic. Historically that has been solved by using GRE tunnels with IPSec. Cisco has introduced a feature called VTI (Virtual Tunnel Interface) which allows running dynamic routing protocols without requiring the processing of GRE (and without requiring the crypto map configuration required with GRE tunnels). I have configured quite a few VTI tunnels and they work quite well.

Here is a link with some additional information about VTI.

http://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd8029d629.html

Source: https://community.cisco.com/t5/vpn/ospf-over-ipsec/td-p/1770787

Maybe this helps to solve your use case in another way:

https://support.sophos.com/support/s/article/KB-000034749?language=en_US

Hey JP,

you think there is a way to transport the OSPF-Multicast via Multicast-Routing (PIM-SM-Feature)?
Could this help in this special scenario?

Greetings

Franz

Thanks for the Tip with the VTI.

My Problem is, that the customer doesn't want to change to Cisco or Fortinet.
Here i would have solutions prepared (GRE & VTI).

The customer redirects its Network-Setup to Juniper.
But than that's the End for me.

Here's a 10-year-old tip on using GRE with UTM.  I have one very-sophisticated client that also did this on his own - I haven't tried it.

Cheers - Bob

Here's a 10-year-old tip on using GRE with UTM.  I have one very-sophisticated client that also did this on his own - I haven't tried it.

Cheers - Bob

Hi Bob, i already tried this (ignoring the last post - Should have tried that).

By your anwer i'd suspect the last post is from your "sophisticated client" ;-)

Will have to try this, if i get another chance by my customer. Hope so.
As this is a live environment, those "Tests-Windows" are equaly rare as having a sit in with the famous Yeti.

After reading that post i'm a little confused about what adress assigning for the IPSec-Tunnel over GRE.
Next I believe that the network-stack on Sophos UTM ist hard coded meaning there is no option to allow OSPF using that GRE-IPSec-Tunnel. (at least i don't know one).
Please let me know any clue any one of you all community-members might have.

Sorry,BAlfson  that for now i cannot mark one Answer as a solution but your Input (also from PhilippRusch jprush) is greatly apreciated - always!

CYA - Franz