Anyone has experience on VPN IPsec ( site to site ) beetwen XG 17.x and Azure ?

Hi MarcoCaserio 

Microsoft Azure supports both types types of VPN Gateways (Route-based and policy-based) and both are compatible on the XG, so you should have no issue.

Take a look at the following articles and use them for reference during your migration:

• Sophos XG Firewall v17: How to establish a Site-to-Site IPsec VPN to Microsoft Azure
• Sophos XG Firewall v17: How to configure a site to site IPsec VPN with multiple SAs to a route based Azure VPN gateway

Please let us know how your migration goes!

Regards,

If you are doing more than one network don't follow the KB above for Multiple SAs its wrong Sophos is about to rewrite this KB or release a new one due to this. 

There is a problem if you add more than two networks to local it will break.

As far as i know, the second KBA should work. 

XG supports IKEv2 but only  Policy Based VPN. 

Maybe another XG in Azure with base License is cheaper in the long run? 

You would buy only the appliance license (1C2) and the Compute price for running XG. 

If you are running Azure VPN Gateway you need to run its IKEV2 route based. The only azure gateway that supports policy base ikev1 is the dev/basic VPN gateway if you are using this for production its very slow and the throughput of gateway is very poor. 

We have just done the same as you gone from SG to XG  Azure side from basic gateway to vpngw1 that is route based. 

The problem we were having was with all the networks added for the ipsec tunnel for some reason this doesn't work. The recommendation for azure was to set this to ANY and they were planing to redo the Mutli SA KB due to this. 

As far as i know, the way how Azure VPN gateway works, should not be affect the XG at all.

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps

So basically you can connect a Policy based or Route Based Product to Azure. 

It should work to select a Route Based VPN Gateway in Azure and connect a (Policy based) XG to it. 

That is the reason for using IKEv2 - The Azure site requires IKEv2 in Route based mode. 

The KBA uses the same technique (Route based Azure vs Policy Based XG). 

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#multi-site-and-vnet-to-vnet-connectivity

But i can be wrong. This should be covered by the Microsoft Support. 

Only the Basic VPN gateway will work like this the new ones don't. This is why everyone is screaming for Sophos to bring Ikev2 to the UTM. 

Azure support for policy-based VPN

Currently, Azure supports both modes of VPN gateways: route-based VPN gateways and policy-based VPN gateways. They are built on different internal platforms, which result in different specifications:

I am still not sure about this.

The Microsoft KBA even writes:

With the custom IPsec/IKE policy, you can now configure Azure route-based VPN gateways to use prefix-based traffic selectors with option "PolicyBasedTrafficSelectors", to connect to on-premises policy-based VPN devices. This capability allows you to connect from an Azure virtual network and VPN gateway to multiple on-premises policy-based VPN/firewall devices, removing the single connection limit from the current Azure policy-based VPN gateways.

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps

So basically you can connect 10/30 VPNs to one Azure VPN Gateway, if you use Routebased on the Azure site. 

Cheers for the info. Will have to look at this as our Cloud software provider said this wasn't supported and all the documentation back then pointed to this. Looking at the KB above this must be done as it was written 30/11/18 

So I wonder if MS updated this. 

Basically it should not be any difference. 

You can easily connect a Policy based device to a Route based device. (no matter what device are involved).

So basically this should be possible a long time ago. 

Our KBA builds the same mechanics and as far as i know, DavidOkeyode wrote this KBA. I guess, if he reads this topic, he can give us more insight. 

But i am pretty sure, this is possible. 

Interesting part about this.

http://web.archive.org/web/20171110000509/https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps

If you check this revision of this KBA, the same is clearly stated in 2017. 

Maybe David or yourself can check out our support ticket and make comment on that. As we were told the Multi SA KB needed to be re written. 

happy to supply the support case and we can take this of this channel to talk about and get your feed back and David who wrote it feed back. 

I am only basing the whole KB is wrong from what Sophos support said and also going through our channel manager. If it is wrong then needs to be corrected so other don't go through our pain. 

Send me a PM and I will send you the case number to have a look at. 

PS sorry to the OP for hijacking his question. 

Thanks