BGP configuration on Sophos XG/XGS firewalls

Sophos XG firewalls, at the time of writing, do not offer sufficient flexibility for configuring BGP via the web panel (namely, you cannot even set local preference or modify AS paths) and the official documentation for the CLI is scarce at best. Luckily, since 19.5 MR1, the underlying routing engine is the free and open source Free Range Routing/FRRouting, which has plenty of documentation. As of now, the version included with the 19.5 MR1 firmware is the 8.1 stable - here are the docs.

You can enter the CLI configuration via SSH or via the web based terminal, by logging in, selecting Routing Configuration, then Configure Unicast Routing, then BGP Configuration.

Here are some sanitized extracts from a config i did.

router bgp 64512

 

! adding a neighbor

neighbor 10.0.0.2 remote-as 64513

neighbor 10.0.0.2 description Descriptive name

address-family ipv4 unicast

network 172.16.0.0/16

 

! setting prefix list and inbound/outbound route maps for a specific neighbor

neighbor 10.0.0.2 prefix-list PL_COMPANY_A_NET

neighbor 10.0.0.2 route-map RM_COMPANY_A:IN in

neighbor 10.0.0.2 route-map RM_COMPANY_A:OUT out

exit

exit

 

! setting a prefix list whitelist

ip prefix-list PL_COMPANY_A_NET seq 5 permit 172.17.0.0/16

ip prefix-list PL_COMPANY_A_NET seq 50 deny 0.0.0.0/0

 

! setting  local preference for a neighbor (default is 100)

route-map RM_COMPANY_A:IN permit 10

match ip address prefix-list PL_COMPANY_A_NET

set local-preference 230

end

 

! setting as-path prepend for a neighbor

route-map RM_COMPANY_A:OUT permit 10

match ip address prefix-list RM_COMPANY_A_NET

set as-path prepend 64512

exit

Don't forget to "write memory" to save the configuration to disk. This is also necessary to show changes in the web panel.