Update to GET VPN - part four (multicast) - http://myitmicroblog.blogspot.com/2014/12/get-vpn-part-four-multicast.html On one of my GMs I found a problem. It was registered but I didn’t see any ‘rekeys received’: R3 #sh crypto gdoi gm rekey Group GDOI - GROUP - GREEN No rekey info available Group GDOI - GROUP - RED ( Multicast ) Number of Rekeys received ( cumulative ) : 0 Number of Rekeys received after registration : 0 Multicast destination address : 239.192 . 1.190 R3 # I saw following messages: R3 # * Dec 20 06 : 06 : 04.404 : % GDOI - 4 - GM_RE_REGISTER : The IPSec SA created for group GDOI - GROUP - RED may have expired / been cleared , or didn 't go through. Re-register to KS. R3# *Dec 20 06:06:04.412: %CRYPTO-5-GM_REGSTER: Start registration to KS 3.3.3.2 for group GDOI-GROUP-RED using address 7.7.7.2 *Dec 20 06:06:05.000: %GDOI-5-SA_KEK_UPDATED: SA KEK was updated *Dec 20 06:06:05.008: %GD...
Posts
For an enterprise solution some of my current setting can be ineffective. For example re-keying method via an unicast. GET VPN allows on a multicast re-keying method. Let’s try to configure it. On KSs we need to add: ! access - list 1 permit 239.192 . 1.190 0.0 . 0.0 ! ip multicast - routing ip pim ssm range 1 ! interface fa0 / 0 ip pim sparse - mode ! ip access - list extended GETVPN - MCAST permit ip any host 239.192 . 1.190 ! crypto gdoi group GDOI - GROUP server local no rekey transport unicast rekey address ipv4 GETVPN - MCAST rekey retransmit 10 number 3 Once I applied the configuration I can see: * Dec 15 01 : 03 : 10.979 : % PIM - 5 - DRCHG : DR change from neighbor 0.0 . 0.0 to 6.6 . 6.2 on interface FastEthernet0 / 0 * Dec 15 01 : 03 : 11.355 : % SYS - 5 - CONFIG_I : Configured from console by console * Dec 15 01 : 03 : 11.355 : % GDOI - 5 - POLICY_CHANGE : GDOI group GDOI - GROUP policy has changed . Use 'crypto ...