Skip to main content

GET VPN - part ten (HA)

Today I would like to talk about high availability. The second KS is one example how we can increase its availability. Let’s think about GMs. If there are more paths than one to a KS we should consider using a loopback interface for communication with the KS.
  


 

We can add following command on the GM:

crypto map MAP-NAME local-address INT-NAME

We have to ensure that:
  • the loopback interface is reachable from KS’
  • FW access list accepts traffic from and to this IP
ISAKMP SA from a KS before change:

R2#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
6.6.6.2         4.4.4.2         GDOI_IDLE         1002 ACTIVE
3.3.3.2         6.6.6.2         GDOI_IDLE         1030 ACTIVE
7.7.7.2         6.6.6.2         GDOI_REKEY           0 ACTIVE
7.7.7.2         6.6.6.2         GDOI_REKEY           0 ACTIVE
6.6.6.2         5.5.5.2         GDOI_IDLE         1073 ACTIVE

IPv6 Crypto ISAKMP SA

R2#
 
R3#sh crypto session
Crypto session current status

Interface: FastEthernet0/0.2
Session status: UP-NO-IKE
Peer: 0.0.0.0 port 848
  IPSEC FLOW: permit ip 10.0.0.0/255.0.0.0 10.0.0.0/255.0.0.0
        Active SAs: 2, origin: crypto map

Interface: FastEthernet0/0.3
Session status: UP-NO-IKE
Peer: 0.0.0.0 port 848
  IPSEC FLOW: permit ip 20.0.0.0/255.0.0.0 20.0.0.0/255.0.0.0
        Active SAs: 2, origin: crypto map

Interface: FastEthernet0/0.1
Session status: UP-IDLE
Peer: 6.6.6.2 port 848
  IKEv1 SA: local 7.7.7.2/848 remote 6.6.6.2/848 Active
  IKEv1 SA: local 7.7.7.2/848 remote 3.3.3.2/848 Active
  IKEv1 SA: local 7.7.7.2/848 remote 6.6.6.2/848 Active

Interface: FastEthernet0/0.1
Session status: UP-IDLE
Peer: 6.6.6.2 port 848
  IKEv1 SA: local 7.7.7.2/848 remote 6.6.6.2/848 Active
  IKEv1 SA: local 7.7.7.2/848 remote 6.6.6.2/848 Active

R3#

Let’s do it:

crypto map MAPA-GREEN local-address Loopback10
crypto map MAPA-RED local-address Loopback10

to force GET VPN to use the new settings you need to re-apply these crypto map:

interface FastEthernet0/0.2
no crypto map MAPA-GREEN
crypto map MAPA-GREEN
!
interface FastEthernet0/0.3
no crypto map MAPA-RED
crypto map MAPA-RED

I cleared all keys on the GM1 and now I check the current ISKAMP SA:

R3#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
7.7.7.2         6.6.6.2         GDOI_REKEY        1089 ACTIVE
7.7.7.2         6.6.6.2         GDOI_REKEY        1085 ACTIVE
7.7.7.2         6.6.6.2         GDOI_REKEY        1088 ACTIVE
6.6.6.2         7.7.7.2         GDOI_IDLE         1084 ACTIVE
7.7.7.2         6.6.6.2         GDOI_REKEY        1087 ACTIVE

IPv6 Crypto ISAKMP SA

R3#

Hm, as you see it doesn’t work. I still use 7.7.7.2 instead of 11.11.11.11. I think it is related to VRF. In the documentation I can’t find any example of this command for VRF aware GET VPN. I think I should change this line:

 client registration interface FastEthernet0/0.1

Let’s try:
 
crypto gdoi group GDOI-GROUP-GREEN
no client registration interface FastEthernet0/0.1
 client registration interface loopback10
!
crypto gdoi group GDOI-GROUP-RED
no client registration interface FastEthernet0/0.1
 client registration interface loopback10

On the ASA I see:

%ASA-4-106023: Deny udp src spoke1-mng:11.11.11.11/848 dst keys2:6.6.6.2/848 by access-group "SPOKE1-MNG" [0x0, 0x0]

Let’s fix it:
 
access-list SPOKE1-MNG ext permit udp host 11.11.11.11 host 6.6.6.2 eq 848
access-list SPOKE1-MNG ext permit udp host 11.11.11.11 host 3.3.3.2 eq 848

I found another one:
 
%ASA-4-106023: Deny udp src keys2:6.6.6.2/848 dst spoke1-mng:11.11.11.11/848 by access-group "KEYS2" [0x0, 0x0]
access-list KEYS2 exte permit udp host 6.6.6.2 host 11.11.11.11 eq 848
access-list KEYS1 exte permit udp host 3.3.3.2 host 11.11.11.11 eq 848

Ok, let’s check the KS:
 
R2#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
6.6.6.2         3.3.3.2         GDOI_IDLE         1012 ACTIVE
6.6.6.2         4.4.4.2         GDOI_IDLE         1016 ACTIVE
11.11.11.11     6.6.6.2         GDOI_REKEY           0 ACTIVE
11.11.11.11     6.6.6.2         GDOI_REKEY           0 ACTIVE

IPv6 Crypto ISAKMP SA

R2#

As you see the KS2 registered the GM1 with IP of 11.11.11.11. I think the new command is not required for VRF aware GET VPN. It is needed only for non VRF instances.

I try to remove it:
 
no crypto map MAPA-GREEN local-address Loopback10
no crypto map MAPA-RED local-address Loopback10

The KS2 still sees the GM1 with 11.11.11.11:
 
R2#sh crypto gdoi ks members

Group Member Information :

Number of rekeys sent for group GDOI-GROUP-RED : 4

Group Member ID    : 4.4.4.2     GM Version: 1.0.4
 Group ID          : 2
 Group Name        : GDOI-GROUP-RED
 Key Server ID     : 3.3.3.2
 Rekeys sent       : 2
 Rekeys retries    : 1
 Rekey Acks Rcvd   : 3
 Rekey Acks missed : 0

 Sent seq num : 0       14      1       1
Rcvd seq num :  0       14      1       1

Group Member ID    : 5.5.5.2     GM Version: 1.0.4
 Group ID          : 2
 Group Name        : GDOI-GROUP-RED
 Key Server ID     : 3.3.3.2
 Rekeys sent       : 4
 Rekeys retries    : 1
 Rekey Acks Rcvd   : 3
 Rekey Acks missed : 0

 Sent seq num : 12      13      1       1
Rcvd seq num :  0       13      1       1

Group Member ID    : 11.11.11.11         GM Version: 1.0.4
 Group ID          : 2
 Group Name        : GDOI-GROUP-RED
 Key Server ID     : 3.3.3.2
 Rekeys sent       : 3
 Rekeys retries    : 0
 Rekey Acks Rcvd   : 3
 Rekey Acks missed : 0

 Sent seq num : 0       13      1       1
Rcvd seq num :  0       13      1       1

Number of rekeys sent for group GDOI-GROUP-GREEN : 4

Group Member ID    : 4.4.4.2     GM Version: 1.0.4
 Group ID          : 1
 Group Name        : GDOI-GROUP-GREEN
 Key Server ID     : 6.6.6.2
 Rekeys sent       : 1
 Rekeys retries    : 1
 Rekey Acks Rcvd   : 1
 Rekey Acks missed : 1

 Sent seq num : 0       0       2       1
Rcvd seq num :  0       0       0       1

Group Member ID    : 11.11.11.11         GM Version: 1.0.4
 Group ID          : 1
 Group Name        : GDOI-GROUP-GREEN
 Key Server ID     : 3.3.3.2
 Rekeys sent       : 1
 Rekeys retries    : 1
 Rekey Acks Rcvd   : 2
 Rekey Acks missed : 0

 Sent seq num : 0       0       2       1
Rcvd seq num :  0       0       2       1

R2#

Conclusion: for non VRF we have to use the new:
 
crypto map MAP-NAME local-address INT-NAME

but for VRF aware this one:

client registration interface loopback10
Labels:

Comments

Post a Comment

Popular posts from this blog

What should you know about HA 'override enabled' setting on Fortigate?

High availability is mandatory in most of today's network designs. Only very small companies or branches can run their business without redundancy. When you have Fortigate firewall in your network you have many options to increase network availability. You can use Fortigate Clustering Protocol ( FGCP ) or Virtual Router Redundancy Protocol ( VRRP ). FGCP has two modes: 'override' disabled (default) and 'override' enabled . I'm not going to explain how to set up HA as you can find many resources on Fortinet websites: https://cookbook.fortinet.com/high-availability-two-fortigates-56/ https://cookbook.fortinet.com/high-availability-with-fgcp-56/ Let's recap what is the main difference between them. The default HA setting is 'override' disabled and this is an order of selection an active unit: 1) number of monitored interfaces - when both units have the same number of working (up) interfaces check next parameter 2) HA uptime - an
8 comments
Read more

FortiGate and GRE tunnel

Recently I worked on one project where a client requested to re-route web traffic to the GRE tunnel to perform traffic inspection. I would like to share with you what is required if you configure it on FortiGate. We need a new GRE interface and policy base routing (PBR) to change the route for specific source IPs. Of course you need firewall policies to permit the traffic. Let's start with GRE interface. Unfortunately you can't configure it using the GUI, only CLI is the option: config system gre-tunnel edit "gre1" set interface "port1" set local-gw 55.55.55.55 set remote-gw 44.44.44.44 next end When the end peer is Cisco router, you need to set the IP for the GRE interface: config system interface edit gre1 set ip 192.168.10.10 255.255.255.255 set remote-ip192.168.10.20 end In next step we need to fix routing. We need the alternate path via GRE but to keep the route in the active routing table you need to set the same AD (adminis
Post a Comment
Read more

Inpection of asymmetric sessions on FortiGate

There is one feature available on FortiGate, and I think you should know it, as it modifies a bit what we know about stateful firewalls. In past every packet was treated individually and you had to create policies in both directions. With stateful firewalls we can track connections, and by checking couple of attributes, we can treat them as part of the same session. For example when you initiate connection from a host1 to host2, the returning connection from host2 to host1 will be treated as part of the same connection (session). They have to have the same source/destination and destination/source IPs, port numbers and interfaces.There is an exception from this rule and FortiGate in some specific cases can accept connections on port which was not used in the initial connection. Let me explain how it works on the below example:      The host1 has a default gateway on R1 (10.0.1.2), but you may notice that it is not the optimal path to host2 subnet. When we analyze the packet flo
1 comment
Read more