Wednesday, December 24, 2014

GET VPN - part ten (HA)

Today I would like to talk about high availability. The second KS is one example how we can increase its availability. Let’s think about GMs. If there are more paths than one to a KS we should consider using a loopback interface for communication with the KS.
  


 

We can add following command on the GM:

crypto map MAP-NAME local-address INT-NAME

We have to ensure that:
  • the loopback interface is reachable from KS’
  • FW access list accepts traffic from and to this IP
ISAKMP SA from a KS before change:

R2#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
6.6.6.2         4.4.4.2         GDOI_IDLE         1002 ACTIVE
3.3.3.2         6.6.6.2         GDOI_IDLE         1030 ACTIVE
7.7.7.2         6.6.6.2         GDOI_REKEY           0 ACTIVE
7.7.7.2         6.6.6.2         GDOI_REKEY           0 ACTIVE
6.6.6.2         5.5.5.2         GDOI_IDLE         1073 ACTIVE

IPv6 Crypto ISAKMP SA

R2#
 
R3#sh crypto session
Crypto session current status

Interface: FastEthernet0/0.2
Session status: UP-NO-IKE
Peer: 0.0.0.0 port 848
  IPSEC FLOW: permit ip 10.0.0.0/255.0.0.0 10.0.0.0/255.0.0.0
        Active SAs: 2, origin: crypto map

Interface: FastEthernet0/0.3
Session status: UP-NO-IKE
Peer: 0.0.0.0 port 848
  IPSEC FLOW: permit ip 20.0.0.0/255.0.0.0 20.0.0.0/255.0.0.0
        Active SAs: 2, origin: crypto map

Interface: FastEthernet0/0.1
Session status: UP-IDLE
Peer: 6.6.6.2 port 848
  IKEv1 SA: local 7.7.7.2/848 remote 6.6.6.2/848 Active
  IKEv1 SA: local 7.7.7.2/848 remote 3.3.3.2/848 Active
  IKEv1 SA: local 7.7.7.2/848 remote 6.6.6.2/848 Active

Interface: FastEthernet0/0.1
Session status: UP-IDLE
Peer: 6.6.6.2 port 848
  IKEv1 SA: local 7.7.7.2/848 remote 6.6.6.2/848 Active
  IKEv1 SA: local 7.7.7.2/848 remote 6.6.6.2/848 Active

R3#

Let’s do it:

crypto map MAPA-GREEN local-address Loopback10
crypto map MAPA-RED local-address Loopback10

to force GET VPN to use the new settings you need to re-apply these crypto map:

interface FastEthernet0/0.2
no crypto map MAPA-GREEN
crypto map MAPA-GREEN
!
interface FastEthernet0/0.3
no crypto map MAPA-RED
crypto map MAPA-RED

I cleared all keys on the GM1 and now I check the current ISKAMP SA:

R3#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
7.7.7.2         6.6.6.2         GDOI_REKEY        1089 ACTIVE
7.7.7.2         6.6.6.2         GDOI_REKEY        1085 ACTIVE
7.7.7.2         6.6.6.2         GDOI_REKEY        1088 ACTIVE
6.6.6.2         7.7.7.2         GDOI_IDLE         1084 ACTIVE
7.7.7.2         6.6.6.2         GDOI_REKEY        1087 ACTIVE

IPv6 Crypto ISAKMP SA

R3#

Hm, as you see it doesn’t work. I still use 7.7.7.2 instead of 11.11.11.11. I think it is related to VRF. In the documentation I can’t find any example of this command for VRF aware GET VPN. I think I should change this line:

 client registration interface FastEthernet0/0.1

Let’s try:
 
crypto gdoi group GDOI-GROUP-GREEN
no client registration interface FastEthernet0/0.1
 client registration interface loopback10
!
crypto gdoi group GDOI-GROUP-RED
no client registration interface FastEthernet0/0.1
 client registration interface loopback10

On the ASA I see:

%ASA-4-106023: Deny udp src spoke1-mng:11.11.11.11/848 dst keys2:6.6.6.2/848 by access-group "SPOKE1-MNG" [0x0, 0x0]

Let’s fix it:
 
access-list SPOKE1-MNG ext permit udp host 11.11.11.11 host 6.6.6.2 eq 848
access-list SPOKE1-MNG ext permit udp host 11.11.11.11 host 3.3.3.2 eq 848

I found another one:
 
%ASA-4-106023: Deny udp src keys2:6.6.6.2/848 dst spoke1-mng:11.11.11.11/848 by access-group "KEYS2" [0x0, 0x0]
access-list KEYS2 exte permit udp host 6.6.6.2 host 11.11.11.11 eq 848
access-list KEYS1 exte permit udp host 3.3.3.2 host 11.11.11.11 eq 848

Ok, let’s check the KS:
 
R2#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
6.6.6.2         3.3.3.2         GDOI_IDLE         1012 ACTIVE
6.6.6.2         4.4.4.2         GDOI_IDLE         1016 ACTIVE
11.11.11.11     6.6.6.2         GDOI_REKEY           0 ACTIVE
11.11.11.11     6.6.6.2         GDOI_REKEY           0 ACTIVE

IPv6 Crypto ISAKMP SA

R2#

As you see the KS2 registered the GM1 with IP of 11.11.11.11. I think the new command is not required for VRF aware GET VPN. It is needed only for non VRF instances.

I try to remove it:
 
no crypto map MAPA-GREEN local-address Loopback10
no crypto map MAPA-RED local-address Loopback10

The KS2 still sees the GM1 with 11.11.11.11:
 
R2#sh crypto gdoi ks members

Group Member Information :

Number of rekeys sent for group GDOI-GROUP-RED : 4

Group Member ID    : 4.4.4.2     GM Version: 1.0.4
 Group ID          : 2
 Group Name        : GDOI-GROUP-RED
 Key Server ID     : 3.3.3.2
 Rekeys sent       : 2
 Rekeys retries    : 1
 Rekey Acks Rcvd   : 3
 Rekey Acks missed : 0

 Sent seq num : 0       14      1       1
Rcvd seq num :  0       14      1       1

Group Member ID    : 5.5.5.2     GM Version: 1.0.4
 Group ID          : 2
 Group Name        : GDOI-GROUP-RED
 Key Server ID     : 3.3.3.2
 Rekeys sent       : 4
 Rekeys retries    : 1
 Rekey Acks Rcvd   : 3
 Rekey Acks missed : 0

 Sent seq num : 12      13      1       1
Rcvd seq num :  0       13      1       1

Group Member ID    : 11.11.11.11         GM Version: 1.0.4
 Group ID          : 2
 Group Name        : GDOI-GROUP-RED
 Key Server ID     : 3.3.3.2
 Rekeys sent       : 3
 Rekeys retries    : 0
 Rekey Acks Rcvd   : 3
 Rekey Acks missed : 0

 Sent seq num : 0       13      1       1
Rcvd seq num :  0       13      1       1

Number of rekeys sent for group GDOI-GROUP-GREEN : 4

Group Member ID    : 4.4.4.2     GM Version: 1.0.4
 Group ID          : 1
 Group Name        : GDOI-GROUP-GREEN
 Key Server ID     : 6.6.6.2
 Rekeys sent       : 1
 Rekeys retries    : 1
 Rekey Acks Rcvd   : 1
 Rekey Acks missed : 1

 Sent seq num : 0       0       2       1
Rcvd seq num :  0       0       0       1

Group Member ID    : 11.11.11.11         GM Version: 1.0.4
 Group ID          : 1
 Group Name        : GDOI-GROUP-GREEN
 Key Server ID     : 3.3.3.2
 Rekeys sent       : 1
 Rekeys retries    : 1
 Rekey Acks Rcvd   : 2
 Rekey Acks missed : 0

 Sent seq num : 0       0       2       1
Rcvd seq num :  0       0       2       1

R2#

Conclusion: for non VRF we have to use the new:
 
crypto map MAP-NAME local-address INT-NAME

but for VRF aware this one:

client registration interface loopback10

No comments:

Post a Comment