Sophos XG Firewall and Firebox Branch Office VPN Integration Guide

Deployment Overview

WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, go to the documentation and support resources for that product.

This integration guide describes how to configure a Branch Office VPN (BOVPN) tunnel between a WatchGuard Firebox and a Sophos XG firewall.

Contents

• Sophos XG Firewall and Firebox Branch Office VPN Integration Guide
• Deployment Overview
• Contents
• Integration Summary
• Topology
• Configure the Firebox
• Configure the Sophos XG Firewall
• Basic Settings
• Add IPSec Profiles
• IPSec VPN Connection Settings
• Test the Integration

Topology

This diagram shows the topology for a BOVPN connection between a Firebox and a Sophos XG Firewall.

Configure the Firebox

On the Firebox, configure a BOVPN connection:

1. Log in to Fireware Web UI.
2. Select VPN > Branch Office VPN.
   The Branch Office VPN configuration page opens.
3. In the Gateways section, click Add.
4. In the Gateway Name text box, type a name to identify this Branch Office VPN gateway.
5. From the Address Family drop-down list, select IPv4 Addresses.
   
6. In the Credential Method section, select Use Pre-Shared Key.
7. In the adjacent text box, type the pre-shared key.

8. In the Gateway Endpoint section, click Add.
   The Gateway Endpoint Settings dialog box opens.
9. From the External Interface drop-down list, select External.
10. From the Interface IP Address drop-down list, select Primary Interface IPv4 Address.
11. Select By IP Address.
12. In the adjacent text box, type the primary IP address of the External Firebox interface.
    

13. Select the Remote Gateway tab.
14. Select Static IP Address.
15. In the adjacent text box, type the IP address of your Sophos XG firewall WAN connection.
16. Select By IP Address.
17. In the adjacent text box, type the IP address of your Sophos XG firewall WAN connection.
    

18. Click OK.
19. In the Gateway Endpoint section, select the Start Phase 1 tunnel when Firebox starts check box.

20. Select the Phase 1 Settings tab.
21. From the Version drop-down list, select IKEv2.
22. Keep all other Phase 1 settings as the default values.

23. Click Save.
24. In the Tunnels section, click Add.

25. From the Gateway drop-down list, select the gateway. In our example, the name of the gateway is gateway.1.
26. In the Addresses section, click Add.

27. In the Local IP section, from the Choose Type drop-down list, select Network IPv4.
28. In the Network IP text box, type the local IP segment. This is the local network protected by the Firebox.
29. In the Remote IP section, from the Choose Type drop-down list, select Network IPv4.
30. In the Network IP text box, type the remote IP segment. This is the local network protected by the Sophos XG Firewall.
31. From the Direction drop-down list, select bi-directional.

32. Click OK.

33. Keep Phase 2 Settings as the default values.

34. Click Save.

Configure the Sophos XG Firewall

From the Sophos XG Firewall Web UI, configure the Sophos XG firewall.

Basic Settings

1. Log in to the Sophos XG Firewall Web UI at https://<IP address of the Sophos firewall>. The default URL is https://172.16.16.16:4444.
2. Configure the interfaces. For information about how to configure interfaces, go to the Sophos XG Firewall documentation. Our example uses192.168.13.3 for the IPv4 address of PortA.

3. Select Configure > Routing > Gateways.
4. Verify the gateway status is on (green).

Add IPSec Profiles

From the Sophos XG Firewall Web UI, add IPSec profiles:

1. Select System > Profiles > IPsec profiles.
2. Click Add.
3. In the Name text box, type the object name. In our example, the name is BOVPN_IKEv2.
4. For Key exchange, select IKEv2.
5. Select the Re-key connection check box.
6. In the Phase 1 section, from the DH group (key group) drop-down list, select 14 (DH2048).
7. Delete the other default DH groups.
8. In the Phase 2 section, from the PFS group (DH group) drop-down list, select 14 (DH2048).
9. Keep the default values for all other settings.

10. Click Save.

IPSec VPN Connection Settings

From the Sophos XG Firewall Web UI, configure IPSec VPN connection settings:

1. Select System > Hosts and services > IP host.
2. Click Add.
   
3. In the Name text box, type the object name. In our example, the name is Sophos_lan.
4. For Type, select Network.
5. In the IP address text box, type the IP segment.
6. Keep the default values for all other settings.

7. Click Save.
8. Repeat steps 1–7 to create another IP segment.

9. Select Configure > Site-to-site VPN > IPsec.
10. In the IPsec connections section, click Add.
11. In the General settings section, type an object name in the Name text box. In our example, the name is wg_connection.
12. From the Gateway type drop-down list, select Initiate the connection.
13. Select Activate on save.
14. Keep the default values for all other General settings.
15. In the Encryption section, from the Profile drop-down list, select BOVPN_IKEv2. You create this profile in the Add IPsec Profiles section.
16. From the Authentication type drop-down list, select Preshared key.
17. In the Preshared Key text box, type the pre-shared key.
18. In the Repeat preshared Key text box, type the pre-shared key again.

19. In the Gateway settings section, from the Listening interface drop-down list, select PortB - 198.51.100.2.
20. From the Local subnet drop-down list, select Sophos_lan.
21. In the Gateway address text box, type the WAN IP address of Firebox.
22. From the Remote subnet drop-down list, select WG_lan.
23. Keep the default value for all other settings.

24. Click Save.
25. Click OK.
    

Test the Integration

From Fireware Web UI, test the integration:

1. Select System Status > VPN Statistics.
2. Select the Branch Office VPN tab and verify the VPN is established.

3. Verify that Host1 (behind the Firebox) and Host2 (behind the Sophos XG Firewall) can ping each other.