BGP Route sharing between IPSec tunnels

amiskell · Mar 6, 2018, 10:23 PM

I'm having some trouble trying to get routes to be shared between networks connected via IPSec tunnels.

I have two Amazon VPCs connecting to a pfSense instance hosted in another AWS VPC (using the Transit VPC model).

VPC A is 10.199.0.0/16
VPC B is 10.198.0.0/16

Transit-VPC (where pfSense lives) is 10.254.0.0/23

Have the tunnels setup properly and BGP is active (the AWS VPC Wizard took care of all that) and I can see the routes in the BGP status on the pfSense machine. However, pfSense isn't sharing the VPC A network route to VPC B and vice versa.

I can ping from pfSense to both VPCs but I can't ping from VPC A to VPC B via the pfSense box and I'm not sure why. I don't see a BGP route for VPC A in the routes for VPC B and vice versa either.

I was able to set all this up and get it working using the Cisco CSR 1000v templates, but I'd prefer to use pfSense since it could be used for a lot of other things (not to mention being cheaper on the licensing).

ultralite · Mar 7, 2018, 9:31 PM

Hello,

maybe you can try route propagation as described here:

https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html#EnableDisableRouteProp

amiskell · Mar 9, 2018, 2:30 PM

Yeah, that's already done. It works great with the Cisco CSR 1000v devices but I can't seem to figure out how to make it work properly within pfSense.