Sophos XG Firewall BOVPN Virtual Interface Integration Guide

Deployment Overview

WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product.

This integration guide describes how to configure a BOVPN Virtual Interface tunnel between a WatchGuard Firebox and a Sophos XG Firewall.

Integration Summary

The hardware and software used in this guide include:

  • WatchGuard Firebox T55
    • Fireware v12.7.1
  • Sophos XG Firewall SFVUNL
    • SFOS 18.0.5 MR-5

Topology

This diagram shows the topology for a BOVPN virtual interface connection between a Firebox and a Sophos XG Firewall.

Topology diagram

Configure the Firebox

On the Firebox, configure a BOVPN Virtual Interface connection, from Fireware Web UI:

  1. Select VPN > BOVPN Virtual Interfaces.
    The BOVPN Virtual Interfaces configuration page opens.
  2. Click Add.
  3. In the Interface Name text box, type a name to identify this BOVPN virtual interface.
  4. From the Remote Endpoint Type drop-down list, select Cloud VPN or Third-Party Gateway.
  5. From the Gateway Address Family drop-down list, select IPv4 Addresses.
  6. In the Credential Method section, select Use Pre-Shared Key.
  7. In the adjacent text box, type the pre-shared key.
  8. In the Gateway Endpoint section, click Add.
    The Gateway Endpoint Settings dialog box opens.

Screenshot of Firebox, diagram20

  1. From the Physical drop-down list, select External.
  2. From the Interface IP Address drop-down list, select Primary Interface IPv4 Address.
    The Primary Interface IP Address is the primary IP address you configured on the selected external interface.
  3. Select By IP Address.
  4. In the adjacent text box, type the primary IP address of the External Firebox interface.

Screenshot of Firebox, diagram21

  1. Select the Remote Gateway tab.
  2. Select Static IP Address.
  3. In the adjacent text box, type the IP address of your Sophos XG Firewall WAN connection.
  4. Select By IP Address.
  5. In the adjacent text box, type the IP address of your Sophos XG Firewall WAN connection.

Screenshot of Firebox, diagram22

  1. Click OK.
  2. In the Gateway Endpoint section, select Start Phase 1 tunnel when it is inactive.
  3. Select Add this tunnel to the BOVPN-Allow policies.

Screenshot of Firebox, diagram23

  1. Select the VPN Routes tab.
  2. Click Add.
  3. From the Choose Type drop-down list, select Network IPv4.
  4. In the Route To text box, type the Network IP address of a route that will use this virtual interface.

Screenshot of Firebox, diagram24

  1. Click OK.
  2. Select the Assign virtual interface IP addresses (required for dynamic routing) check box.
  3. In the Local IP address and Peer IP address or netmask text boxes, type the virtual interface IP addresses.

Screenshot of Firebox, diagram25

  1. Select the Phase 1 Settings tab.
  2. From the Version drop-down list, select IKEv2.
  3. Keep all other Phase 1 settings as the default values.

Screenshot of Firebox, diagram26

  1. Keep Phase 2 Settings as the default values.

Screenshot of Firebox, diagram27

  1. Click Save.

For more information about BOVPN virtual interface configuration on the Firebox, see BOVPN Virtual Interfaces.

Configure the Sophos XG Firewall

Basic Settings

  1. Log in to the Sophos XG Firewall Web UI at https://<IP address of Sophos>. In our example, the default IP address is 172.16.16.16:4444.
  2. Configure the interfaces. For information about how to configure interfaces, see the Sophos XG Firewall documentation.

Screenshot of Sophos, diagram32

  1. Select Configure > Routing > Gateways.
  2. Verify the gateway status is on (green).

Screenshot of Sophos, diagram33

Configure IP hosts

  1. Select System > Hosts and services > IP host.
  2. Click Add.
  3. In the Name text box, type the object name. In our example, the name is Sophos_lan.
  4. For Type, select Network.
  5. In the IP address text box, type the IP segment.
  6. Keep all other settings as the default values.

Screenshot of Sophos, diagram34

  1. Click Save.
  2. Repeat steps 1–7 to create another IP segment.

Screenshot of Sophos, diagram35

Policy Settings

  1. Select Configure > VPN > IPsec policies.
  2. In the IPsec policies section, click Add.
  3. In the Name text box, type the object name. In our example, the name is WG with Sophos.
  4. In the Phase 1 section, from the DH group drop-down list, select 14 (DH2048).
  5. Delete the other default DH groups.
  6. Keep the default values for all other settings.

Screenshot of Sophos, diagram36

Screenshot of Sophos, diagram37

  1. Click Save.

Screenshot of Sophos, diagram38

IPSec VPN Connection Settings

  1. Select Configure > VPN > IPsec connections.
  2. In the IPsec connections section, click Add.
  3. In the General settings section, type an object name in the Name text box. In our example, the name is wg_connection.
  4. From the Connection type drop-down list, select Tunnel interface.
  5. For IP version, select IPv4.
  6. From the Gateway type drop-down list, select Initiate the connection.
  7. Select Activate on save.
  8. In the Encryption section, from the Policy drop-down list, select WG with Sophos.
  9. From the Authentication type drop-down list, select Preshared key.
  10. In the Preshared key text box, type the pre-shared key.
  11. In the Repeat preshared key text box, type the pre-shared key again.
  12. In the Gateway settings section, from the Listening interface drop-down list, select PortB - 198.51.100.2.
  13. In the Gateway address text box, type the WAN IP address of Firebox.
  14. Leave the default values for all other settings.

Screenshot of Sophos, diagram39

  1. Click Save.
  2. Click OK.

Edit the xfrm Interface

  1. Select Configure > Network > Interfaces.
  2. Expand the WAN interface (PortB in our example).
  3. Select and click the xfrm interface. In our example, the xfrm interface name is xfrm1.

Screenshot of Sophos, diagram40

  1. In the IPv4/netmask text box, type the xfrm IP address.

Screenshot of Sophos, diagram41

  1. Click Save.
  2. Click Update interface.

Configure static route

  1. Select Configure > Routing > Static routing.
  2. In the IPv4 unicast route section, click Add.
  3. In the Destination IP / Netmask text box, type the destination IP address.
  4. From the Interface drop-down list, select xfrm1-10.0.11.10.

Screenshot of Sophos, diagram42

  1. Click Save.

Configure Firewall Rules

  1. Select Protect > Rules and Policies > IPv4.
  2. Click Add firewall rule > New firewall rule.
  3. In the Rule name text box, type a rule name. In our example, the name is rule1.
  4. Select the Log firewall traffic check box.
  5. In the Source zones section, click Add new item and select VPN.
  6. In the Source networks and devices section, click Add new item and select WG_lan.
  7. In the Destination zones section, click Add new item and select LAN.
  8. In the Destination networks section, click Add new item and select Sophos_lan.
  9. Keep the default values for all other settings.

Screenshot of Sophos, diagram43

  1. Click Save.
  2. Repeat steps 1–10 to create another firewall rule.

Screenshot of Sophos, diagram44

Test the Integration

To test the integration, from Fireware Web UI:

  1. Select System Status > VPN Statistics.
  2. Select the Branch Office VPN tab and verify the VPN is established.

Screenshot of Firebox, diagram28

  1. Verify that Host1 (behind the Firebox) and Host2 (behind the Sophos XG Firewall) can ping each other.