Sophos UTM - AWS VPN: Connecting with multiple VPCs

Question

I have seen several discussions within this community regarding multiple Amazon AWS IPsec VPNs to a single Sophos UTM but still see no definite resolution or procedure for how best to set it up. Rather than hijack and existing discussion I am asking this question again. 
 In the past I used a pfSense firewall and had two separate IPsec VPN tunnels to two separate AWS VPCs. This worked fine because the pfSense allowed me to terminate an IPsec tunnel on ANY public interface. When we retired the pfSense and replaced it with the Sophos UTM we had an issue where we were unable to terminate a tunnel to anything but the default WAN IP on the Sophos and AWS would not allow two separate VPN tunnels to the same public termination endpoint. 
 While AWS provides a few different approaches to this ( Direct Connect, Shared Services, or Transit VPN ) I'm still curious why we still do not have the option to pick the public interface on the Sophos where we want to terminate the tunnel. 
 I really have a need to reestablish the 2nd IPsec tunnel to better manage continuous deployment of our applications. My temporary workaround was to setup an OpenVPN server to allow developer access but that is not a good solution for this use case.

Kipland Iles · Accepted Answer

The selection of "Dynamic Routing (BGP)" was required at AWS to even see a configuration file for the Sophos so that should be part of the initial AWS setup in the article. I ran across that little tidbit on one of my searches but regret that I did not capture where I saw that and document it here. If I chose "Static Routing" I never saw a configuration option for Sophos. You can do static routing and download a "generic" configuration file but then you need to setup everything manually on the Sophos, Maybe selecting FreeSwan or OpenSwan configuration would work for the Sophos but did not have the time to test and this was production. This was my first crack at this as my son set this up initially and the existing tunnel he setup is using static routing. I did use the "Import Single Connection File" from the article you referenced. I did not want to risk breaking the existing tunnel so I chose that approach over "Import from AWS Account". Attaching a REDACTED configuration file that I got from AWS for this tunnel so you can see what one actually looks like. Note that this is the only place where I can actually see my details of the tunnel on the Sophos. Fullscreen vpn-config-redacted.txt Download cgw-FFFFFFFF vgw-FFFFFFFF ipsec.1 XX.XX.XXX.XX XXX.XXX.XX.XXX 255.255.255.XXX XX 65000 30 XX.XXX.XXX.XX XXX.XXX.XX.XXX 255.255.255.XXX XX 7224 30 sha1 aes-128-cbc 28800 group2 main FFFFFFFFFFFFFFFFFFFFF esp hmac-sha1-96 aes-128-cbc 3600 group2 tunnel true true 1379 10 3 XX.XX.XXX.XX XXX.XXX.XX.XX 255.255.255.XXX XX 65000 30 XX.XX.XX.XX XXX.XXX.XX.XX 255.255.255.XXX XX 7224 30 sha1 aes-128-cbc 28800 group2 main FFFFFFFFFFFFFFFFFFFFFFFF esp hmac-sha1-96 aes-128-cbc 3600 group2 tunnel true true 1379 10 3