Does BGP support allow azure internet taffic to pfsense for windows defender updates

abarna

pfSense uses its WAN default gateway (WANGW) to establish and maintain the IPsec tunnel. This never changes because the Azure VPN gateway's public IP must remain reachable via the WAN.
Once the tunnel is up, FRR receives 0.0.0.0/0 from Azure over BGP.
If pfSense installs that BGP default route and prefers it for forwarding traffic, then internet-bound traffic from your LAN (including Windows Defender updates) will be sent through the IPsec tunnel to Azure Virtual WAN.
So these two things happen simultaneously:
Tunnel Establishment
pfSense -------------------------------> WAN Gateway (WANGW)
(IPsec to Azure public IP)
User Traffic
Gateway PC --> pfSense --> BGP default route --> IPsec Tunnel --> Azure vWAN -->Azurefirewall-> Internet

Will this work?
Expalin the steps possible

stephenw10

Yes that can work. The default route added does not replace the specific static route added to the Azure tunnel endpoint.

All other traffic would then be routed via Azure though so that would need to be passed there and routed out correctly.

abarna

@stephenw10 please give the steps for inorder to achieve this will be helpful

stephenw10

Which part? The tunnel should be easy enough: https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/routed-vti.html

I haven't personally tried setting up BGP to Azure directly but I wouldn't anything special to be required there.

abarna

@stephenw10

Unable to connect with Azure BGP dashboard (Azure showing connecting state)
2.TCP handshake is failing while checking with packet packet capture in pfsense.
3.BGP status using FRR is in Active state

stephenw10

@abarna said in Does BGP support allow azure internet taffic to pfsense for windows defender updates:

TCP handshake is failing while checking with packet packet capture in pfsense.

A pcap on the IPSec tunnel I assume?

FRR is sending but Azure never responds? Sounds like a firewall rule in Azure.