System Generated Traffic with BGP
-
We use iBGP to peer with one of our own upstream routers. From there we peer with an external upstream provider.
We have a SNAT Rule for things behind the PfSense to go out via the external IP being advertised. So for the upstream routers this server traffic for all intents and purposes of BGP gets marked as coming from the external IP.
The issue we have is system generated traffic, i.e. where the PfSense goes to check for updates, will use the routing table, look at the default route and send requests to pkg.pfsense.org from the IP assigned to the iBGP interface. As the source IP is this internal iBGP IP, our own upstream router accepts the traffic because it has an equivalent IP on that subnet, but then the upstream provider black holes the traffic as it's not an accepted prefix (the external IP range we're advertising to them).
I had this issue on a Sophos XG firewall and their support had to log in to the CLI and set some advanced firewall config specifically for system generated traffic. Sadly I don't know what command to run on a PfSense to do the same.
Does anyone have any idea what the equivalent PfSense command would be to force system generated traffic to use a particular IP address?