BGP and multiple AS?

Hi,

please explain your requirement for BGP at home?

The XG is primarily a firewall with extensive policy and rule making functions.

Ian

The GUI possibility are very "limited". 

Because most of our customers does not use BGP, and if they do, they use the CLI.

https://community.sophos.com/kb/en-us/132891

The Console covers a bunch of configuration. 

I'm using BGP both for dynamic routing to/from my AWS VPC, and I'm running MetalLB in BGP mode  for my Kubernetes cluster at home.

Thanks for the link. I'll check it out. So multiple AS'es are possible when using the commandline?

On the other hand, I'm not forced to get rid of the EdgeRouter. I really like the Sophos XG firewall possibilities, so I might experiment with bridge-mode to combine EdgeRouter and Sophos.

Tagged VLAN traffic doesn't seem to work in bridged mode?

- https://community.sophos.com/products/xg-firewall/f/network-and-routing/92248/bridged-mode-vlan-trunking-between-router-and-managed-switch

Is that still an issue? Or is that fixed in most recent firmware?

It is not an issue. It is a simple limitation, you cannot use XG as a Layer 3 Router in Case of VLAN on Bridge.

XG can see all traffic, it can block everything etc. But it cannot, lets say, route VLAN2 to VLAN10 on the Bridge. 

So you cannot tag more than one VLAN on the Bridge. This one VLAN is for management (XG Appliance IP). 

https://community.sophos.com/kb/en-us/123508

https://community.sophos.com/kb/en-us/123098

Ah, this makes sense. If I understand correctly this won't be an issue in my case, as routing happens on the EdgeRouter.

One more question: If I put the XG in bridged mode, between my router and my managed switch, how would I create different fw rules per VLAN (example: allow VLAN 100 to access the internet, but not VLAN 200)? Zones are tied to an interface if I'm not mistaken, so you can't use that in bridge mode. 

You are right, you cannot use the Zone Basis in this case. But you can use Zone ANY and still specify with network objects everything.

You are not forced to use the Zone concept. 

Probably a stupid question, but how could I create a network object that indicates "the internet"? :-)

It's easy for my own VLAN's and corresponding IP ranges (VLAN 100 is 192.168.30.0/24, for example), but I cannot create subnet groups for all public IP ranges out there :-D

It is called any.

Ian