Problem: A simple bgp upstream configuration. A small AS with one IP prefix wants to connect to its upstream using BGP. The BGP peerings are up. Sophos receives the expected routes from its upstream, but the upstream router does not receive the expected single prefix.
Discussion: an outbound filter list is set to prevent sending other than the local prefix x/24. Therefor ae ip filter list is configured in the web gui and connected to the bgp neighbor settings as filter list out. The web gui should generate a quagga bgpd.conf from this and it should look like this:
router bgp 2222
…
neighbor 12.12.12.241 remote-as 1111
neighbor 12.12.12.241 prefix-list REF_BgpFilBgpfiltero_4 outip prefix-list REF_BgpFilBgpfiltero_4 seq 5 permit 13.13.13.0/24 le 32
ip prefix-list REF_BgpFilBgpfiltero_4 seq 10 deny 0.0.0.0/0 le 32
But looking into the actual config file in /var/sec/chroot-quagga/etc/quagga showed that the prefix list was missing. The backup config file bgpd.conf.sav showed the correct prefix list was there before. The only change in the meantime was that I removed an other (not used) “filter list in” in the gui. It seems there is a bug in Sophos UTM that the web gui removes all prefix lists from the config file, when you actually want to remove only one.
Workarround: configure a new fillter list and attach it to the neighbor config.
It’s very good that I actually could log into the Sophos box, because I would have never found this bug without ssh access.
Version: 9.408-4