diff options
| -rw-r--r-- | docs/_static/images/VyOS_Dual-Hub_DMVPN.png | bin | 0 -> 67747 bytes | |||
| -rw-r--r-- | docs/configexamples/dual-hub-dmvpn.rst | 200 | ||||
| -rw-r--r-- | docs/configexamples/index.rst | 3 |
3 files changed, 202 insertions, 1 deletions
diff --git a/docs/_static/images/VyOS_Dual-Hub_DMVPN.png b/docs/_static/images/VyOS_Dual-Hub_DMVPN.png Binary files differnew file mode 100644 index 00000000..9c25a308 --- /dev/null +++ b/docs/_static/images/VyOS_Dual-Hub_DMVPN.png diff --git a/docs/configexamples/dual-hub-dmvpn.rst b/docs/configexamples/dual-hub-dmvpn.rst new file mode 100644 index 00000000..f103972e --- /dev/null +++ b/docs/configexamples/dual-hub-dmvpn.rst @@ -0,0 +1,200 @@ + +######################## +Dual-Hub DMVPN with VyOS +######################## + +DMVPN is a Dynamic Multipoint VPN technology that provides the capability +for creating a dynamic-mesh VPN network without having to pre-configure +(static) all possible tunnel end-point peers those simplifying deployment +and management of the newly added remote sites. There are 3 main protocols +primarily used to implement DMVPN: + +* NHRP - provides the dynamic tunnel endpoint discovery mechanism (endpoint + registration, and endpoint discovery/lookup) +* mGRE - provides the tunnel encapsulation itself +* IPSec - protocols handle the key exchange, and crypto mechanism + +For his example we are using the following devices: + +* 2 x Hubs +* 3 x Spokes +* 1 x Client device (VPC) +* 1 x ISP router + +The following software was used in the creation of this document: + +* Operating system: VyOS +* Version: 1.3-beta-202112090443 +* Image name: vyos-1.3-beta-202112090443-amd64.iso + + + +******** +Topology +******** +.. image:: /_static/images/VyOS_Dual-Hub_DMVPN.png + :width: 80% + :align: center + :alt: Network Topology Diagram + + + +****************************************** +Network Addressing and Protocol Parameters +****************************************** + +The following ip addressing schema used for the devices IPv4 connectivity: + ++-----------------------------------------------------------------------------+ +|10.X1.0.0/30 - p2p Hubs to ISP networks, where X is Hub site number | ++-----------------------------------------------------------------------------+ +|10.Y1.1.0/24 - p2p Spokes to ISP networks(DHCP), where Y is Spoke site number| ++-----------------------------------------------------------------------------+ +|172.16.253.0/29 - tunnels addressing for Hub-1 connections | ++-----------------------------------------------------------------------------+ +|172.16.254.0/29 - tunnels addressing for Hub-2 connections | ++-----------------------------------------------------------------------------+ +|192.168.0.0/24 - HQ site local network | ++-----------------------------------------------------------------------------+ +|192.168.Z.0/24 - remote sites local network, where Z is Spoke site number | ++-----------------------------------------------------------------------------+ + +eBGP parameters for the routers: + ++----------------------------------------------+ +|AS65000 - HQ (Hub-1 and Hub-2) | ++----------------------------------------------+ +|AS6500X - Spokes, where X is Spoke site number| ++----------------------------------------------+ + + + +************* +Configuration +************* + + + +Step-1: Basic connectivity configuration +======================================== + +- Hub-1: + +.. code-block:: none + + set interfaces ethernet eth0 address '10.11.0.1/30' + set interfaces ethernet eth1 address '192.168.0.1/24' + set protocols static route 0.0.0.0/0 next-hop 10.11.0.2 + set system host-name 'Hub-1' + +- Hub-2: + +.. code-block:: none + + set interfaces ethernet eth0 address '10.21.0.1/30' + set interfaces ethernet eth1 address '192.168.0.2/24' + set protocols static route 0.0.0.0/0 next-hop 10.21.0.2 + set system host-name 'Hub-2' + +- Spoke-1: + +.. code-block:: none + + set interfaces ethernet eth0 address 'dhcp' + set interfaces ethernet eth1 address '192.168.1.1/24' + set system host-name 'Spoke-1' + +- Spoke-2: + +.. code-block:: none + + set interfaces ethernet eth0 address 'dhcp' + set interfaces ethernet eth1 address '192.168.2.1/24' + set system host-name 'Spoke-2' + +- Spoke-3: + +.. code-block:: none + + set interfaces ethernet eth0 address 'dhcp' + set interfaces ethernet eth1 address '192.168.3.1/24' + set system host-name 'Spoke-3' + +- ISP-1: + +.. code-block:: none + + set interfaces ethernet eth0 address '10.11.0.2/30' + set interfaces ethernet eth1 address '10.21.0.2/30' + set interfaces ethernet eth2 address '10.31.1.1/24' + set interfaces ethernet eth3 address '10.21.1.1/24' + set interfaces ethernet eth4 address '10.11.1.1/24' + set service dhcp-server shared-network-name SPK-1 authoritative + set service dhcp-server shared-network-name SPK-1 subnet 10.11.1.0/24 default-router '10.11.1.1' + set service dhcp-server shared-network-name SPK-1 subnet 10.11.1.0/24 range 1 start '10.11.1.10' + set service dhcp-server shared-network-name SPK-1 subnet 10.11.1.0/24 range 1 stop '10.11.1.100' + set service dhcp-server shared-network-name SPK-2 authoritative + set service dhcp-server shared-network-name SPK-2 subnet 10.21.1.0/24 default-router '10.21.1.1' + set service dhcp-server shared-network-name SPK-2 subnet 10.21.1.0/24 range 1 start '10.21.1.10' + set service dhcp-server shared-network-name SPK-2 subnet 10.21.1.0/24 range 1 stop '10.21.1.100' + set service dhcp-server shared-network-name SPK-3 authoritative + set service dhcp-server shared-network-name SPK-3 subnet 10.31.1.0/24 default-router '10.31.1.1' + set service dhcp-server shared-network-name SPK-3 subnet 10.31.1.0/24 range 1 start '10.31.1.10' + set service dhcp-server shared-network-name SPK-3 subnet 10.31.1.0/24 range 1 stop '10.31.1.100' + set system host-name 'ISP1' + + + +Step-2: VRRP configuration for HQ Local network redundancy +========================================================== + +Here we are using VRRP as a local redundancy protocol between Hub-1 and Hub-2. +Initially, Hub-1 operates as an Active and Hub-2 as a Standby router. +Additionally, health-check and script are used to track uplinks and properly +switch mastership between Hub nodes based on the upstream router +reachability (ISP-1). **Note, that before adding local paths to the scripts into +configuration, you have to create and make them executable first**. + +Hub-1 and Hub-2 VRRP health-check script: +_________________________________________ + +* /config/scripts/vrrp-check.sh + +.. code-block:: none + + TBC + +**Note**: some parts of the script might be dependent on your network topology +and connectivity. Be careful before using it on your own devices. + + +Hub-1 and Hub-2 VRRP configuration: +___________________________________ + +* Hub-1 + +.. code-block:: none + + set high-availability vrrp group HQ health-check failure-count '3' + set high-availability vrrp group HQ health-check interval '1' + set high-availability vrrp group HQ health-check script '/config/scripts/vrrp-check.sh' + set high-availability vrrp group HQ interface 'eth1' + set high-availability vrrp group HQ no-preempt + set high-availability vrrp group HQ priority '200' + set high-availability vrrp group HQ rfc3768-compatibility + set high-availability vrrp group HQ virtual-address '192.168.0.254/24' + set high-availability vrrp group HQ vrid '1' + +* Hub-2: + +.. code-block:: none + + set high-availability vrrp group HQ health-check failure-count '3' + set high-availability vrrp group HQ health-check interval '1' + set high-availability vrrp group HQ health-check script '/config/scripts/vrrp-check.sh' + set high-availability vrrp group HQ interface 'eth1' + set high-availability vrrp group HQ no-preempt + set high-availability vrrp group HQ priority '100' + set high-availability vrrp group HQ rfc3768-compatibility + set high-availability vrrp group HQ virtual-address '192.168.0.254/24' + set high-availability vrrp group HQ vrid '1' diff --git a/docs/configexamples/index.rst b/docs/configexamples/index.rst index d1a822c2..10251c5c 100644 --- a/docs/configexamples/index.rst +++ b/docs/configexamples/index.rst @@ -17,6 +17,7 @@ This chapter contains various configuration examples: tunnelbroker-ipv6 ha wan-load-balancing + dual-hub-dmvpn Configuration Blueprints (autotest) =================================== @@ -42,4 +43,4 @@ The process will do the following steps: .. toctree:: :maxdepth: 1 - autotest/Wireguard/Wireguard
\ No newline at end of file + autotest/Wireguard/Wireguard |
