Connecting to Amazon VPC on

Sophos Firewall

Sophos Firewall
Version: 19.0v1

[Additional Information]
Sophos Firewall
FW7540: Connecting to Amazon VPC on Sophos Firewall

April 2022
Version: 19.0v1

© 2022 Sophos Limited. All rights reserved. No part of this document may be used or reproduced
in any form or by any means without the prior written consent of Sophos.

Sophos and the Sophos logo are registered trademarks of Sophos Limited. Other names, logos and
marks mentioned in this document may be the trademarks or registered trademarks of Sophos
Limited or their respective owners.

While reasonable care has been taken in the preparation of this document, Sophos makes no
warranties, conditions or representations (whether express or implied) as to its completeness or
accuracy. This document is subject to change at any time without notice.

Sophos Limited is a company registered in England number 2096520, whose registered office is at
The Pentagon, Abingdon Science Park, Abingdon, Oxfordshire, OX14 3YP.

Connecting to Amazon VPC on Sophos Firewall - 1

 Connecting to Amazon VPC on Sophos Firewall
In this chapter you will learn how RECOMMENDED KNOWLEDGE AND EXPERIENCE
to connect Sophos Firewall to an ✓ Sophos Firewall Deployment Scenarios on AWS
Amazon VPC.

DURATION

3 minutes

In this chapter you will learn how to connect Sophos Firewall to an Amazon VPC.

Connecting to Amazon VPC on Sophos Firewall - 2

 Amazon VPC

You can import AWS VPN connection configuration files on Sophos Firewall to simplify the setup.
When downloading the configuration file, select Sophos as the vendor, Sophos Firewall as the
platform, then select the SFOS version, and the version of IKE you want to use.

Connecting to Amazon VPC on Sophos Firewall - 3

 Amazon VPC

Once the configuration file has been imported, a pair of VPN connections to the AWS VPC will be
established - two connections are always created for redundancy.

The import also automates the setup of related routing and IPsec policies for the tunnels.

If your Sophos Firewall is behind a NAT, you will need to edit the configuration file so that the
customer gateway outside IP address matches your WAN IP, otherwise the configuration will fail to
import.

Connecting to Amazon VPC on Sophos Firewall - 4

 Amazon VPC

Importing the Amazon VPC will configure BGP; however, you will need to add the local networks
that you want to share over the VPN to the BGP configuration.

Connecting to Amazon VPC on Sophos Firewall - 5

 Amazon VPC

Alternatively, you can enter AWS security credentials to import the VPN configuration. To do this
you will need to create AWS IAM credentials so that Sophos Firewall can connect to retrieve the
configuration.

Connecting to Amazon VPC on Sophos Firewall - 6

 Chapter Review

You can import AWS VPN connections on Sophos Firewall, either by downloading a
configuration file from AWS, or entering AWS IAM credentials so that Sophos Firewall
can connect to download the configuration

When you download the configuration file you select the vendor, platform, version, and
IKE version. The configuration file will create two connections for redundancy and
configures BGP. You still need to add local networks to the BGP configuration

If your Sophos Firewall is behind a NAT, you will need to edit the configuration file so
that the customer gateway outside IP address matches your WAN IP, otherwise the
configuration will fail to import

Here are the main things you learned in this chapter.

You can import AWS VPN connections on Sophos Firewall, either by downloading a configuration
file from AWS, or entering AWS IAM credentials so that Sophos Firewall can connect to download
the configuration.

When you download the configuration file you select the vendor, platform, version, and IKE
version. The configuration file will create two connections for redundancy and configures BGP;
however, you still need to add local networks to the BGP configuration.

If your Sophos Firewall is behind a NAT, you will need to edit the configuration file so that the
customer gateway outside IP address matches your WAN IP, otherwise the configuration will fail to
import.

Connecting to Amazon VPC on Sophos Firewall - 9

Connecting to Amazon VPC on Sophos Firewall - 10