summaryrefslogtreecommitdiff
path: root/docs/configexamples/dual-hub-dmvpn.rst
diff options
context:
space:
mode:
Diffstat (limited to 'docs/configexamples/dual-hub-dmvpn.rst')
-rw-r--r--docs/configexamples/dual-hub-dmvpn.rst200
1 files changed, 200 insertions, 0 deletions
diff --git a/docs/configexamples/dual-hub-dmvpn.rst b/docs/configexamples/dual-hub-dmvpn.rst
new file mode 100644
index 00000000..f103972e
--- /dev/null
+++ b/docs/configexamples/dual-hub-dmvpn.rst
@@ -0,0 +1,200 @@
+
+########################
+Dual-Hub DMVPN with VyOS
+########################
+
+DMVPN is a Dynamic Multipoint VPN technology that provides the capability
+for creating a dynamic-mesh VPN network without having to pre-configure
+(static) all possible tunnel end-point peers those simplifying deployment
+and management of the newly added remote sites. There are 3 main protocols
+primarily used to implement DMVPN:
+
+* NHRP - provides the dynamic tunnel endpoint discovery mechanism (endpoint
+ registration, and endpoint discovery/lookup)
+* mGRE - provides the tunnel encapsulation itself
+* IPSec - protocols handle the key exchange, and crypto mechanism
+
+For his example we are using the following devices:
+
+* 2 x Hubs
+* 3 x Spokes
+* 1 x Client device (VPC)
+* 1 x ISP router
+
+The following software was used in the creation of this document:
+
+* Operating system: VyOS
+* Version: 1.3-beta-202112090443
+* Image name: vyos-1.3-beta-202112090443-amd64.iso
+
+
+
+********
+Topology
+********
+.. image:: /_static/images/VyOS_Dual-Hub_DMVPN.png
+ :width: 80%
+ :align: center
+ :alt: Network Topology Diagram
+
+
+
+******************************************
+Network Addressing and Protocol Parameters
+******************************************
+
+The following ip addressing schema used for the devices IPv4 connectivity:
+
++-----------------------------------------------------------------------------+
+|10.X1.0.0/30 - p2p Hubs to ISP networks, where X is Hub site number |
++-----------------------------------------------------------------------------+
+|10.Y1.1.0/24 - p2p Spokes to ISP networks(DHCP), where Y is Spoke site number|
++-----------------------------------------------------------------------------+
+|172.16.253.0/29 - tunnels addressing for Hub-1 connections |
++-----------------------------------------------------------------------------+
+|172.16.254.0/29 - tunnels addressing for Hub-2 connections |
++-----------------------------------------------------------------------------+
+|192.168.0.0/24 - HQ site local network |
++-----------------------------------------------------------------------------+
+|192.168.Z.0/24 - remote sites local network, where Z is Spoke site number |
++-----------------------------------------------------------------------------+
+
+eBGP parameters for the routers:
+
++----------------------------------------------+
+|AS65000 - HQ (Hub-1 and Hub-2) |
++----------------------------------------------+
+|AS6500X - Spokes, where X is Spoke site number|
++----------------------------------------------+
+
+
+
+*************
+Configuration
+*************
+
+
+
+Step-1: Basic connectivity configuration
+========================================
+
+- Hub-1:
+
+.. code-block:: none
+
+ set interfaces ethernet eth0 address '10.11.0.1/30'
+ set interfaces ethernet eth1 address '192.168.0.1/24'
+ set protocols static route 0.0.0.0/0 next-hop 10.11.0.2
+ set system host-name 'Hub-1'
+
+- Hub-2:
+
+.. code-block:: none
+
+ set interfaces ethernet eth0 address '10.21.0.1/30'
+ set interfaces ethernet eth1 address '192.168.0.2/24'
+ set protocols static route 0.0.0.0/0 next-hop 10.21.0.2
+ set system host-name 'Hub-2'
+
+- Spoke-1:
+
+.. code-block:: none
+
+ set interfaces ethernet eth0 address 'dhcp'
+ set interfaces ethernet eth1 address '192.168.1.1/24'
+ set system host-name 'Spoke-1'
+
+- Spoke-2:
+
+.. code-block:: none
+
+ set interfaces ethernet eth0 address 'dhcp'
+ set interfaces ethernet eth1 address '192.168.2.1/24'
+ set system host-name 'Spoke-2'
+
+- Spoke-3:
+
+.. code-block:: none
+
+ set interfaces ethernet eth0 address 'dhcp'
+ set interfaces ethernet eth1 address '192.168.3.1/24'
+ set system host-name 'Spoke-3'
+
+- ISP-1:
+
+.. code-block:: none
+
+ set interfaces ethernet eth0 address '10.11.0.2/30'
+ set interfaces ethernet eth1 address '10.21.0.2/30'
+ set interfaces ethernet eth2 address '10.31.1.1/24'
+ set interfaces ethernet eth3 address '10.21.1.1/24'
+ set interfaces ethernet eth4 address '10.11.1.1/24'
+ set service dhcp-server shared-network-name SPK-1 authoritative
+ set service dhcp-server shared-network-name SPK-1 subnet 10.11.1.0/24 default-router '10.11.1.1'
+ set service dhcp-server shared-network-name SPK-1 subnet 10.11.1.0/24 range 1 start '10.11.1.10'
+ set service dhcp-server shared-network-name SPK-1 subnet 10.11.1.0/24 range 1 stop '10.11.1.100'
+ set service dhcp-server shared-network-name SPK-2 authoritative
+ set service dhcp-server shared-network-name SPK-2 subnet 10.21.1.0/24 default-router '10.21.1.1'
+ set service dhcp-server shared-network-name SPK-2 subnet 10.21.1.0/24 range 1 start '10.21.1.10'
+ set service dhcp-server shared-network-name SPK-2 subnet 10.21.1.0/24 range 1 stop '10.21.1.100'
+ set service dhcp-server shared-network-name SPK-3 authoritative
+ set service dhcp-server shared-network-name SPK-3 subnet 10.31.1.0/24 default-router '10.31.1.1'
+ set service dhcp-server shared-network-name SPK-3 subnet 10.31.1.0/24 range 1 start '10.31.1.10'
+ set service dhcp-server shared-network-name SPK-3 subnet 10.31.1.0/24 range 1 stop '10.31.1.100'
+ set system host-name 'ISP1'
+
+
+
+Step-2: VRRP configuration for HQ Local network redundancy
+==========================================================
+
+Here we are using VRRP as a local redundancy protocol between Hub-1 and Hub-2.
+Initially, Hub-1 operates as an Active and Hub-2 as a Standby router.
+Additionally, health-check and script are used to track uplinks and properly
+switch mastership between Hub nodes based on the upstream router
+reachability (ISP-1). **Note, that before adding local paths to the scripts into
+configuration, you have to create and make them executable first**.
+
+Hub-1 and Hub-2 VRRP health-check script:
+_________________________________________
+
+* /config/scripts/vrrp-check.sh
+
+.. code-block:: none
+
+ TBC
+
+**Note**: some parts of the script might be dependent on your network topology
+and connectivity. Be careful before using it on your own devices.
+
+
+Hub-1 and Hub-2 VRRP configuration:
+___________________________________
+
+* Hub-1
+
+.. code-block:: none
+
+ set high-availability vrrp group HQ health-check failure-count '3'
+ set high-availability vrrp group HQ health-check interval '1'
+ set high-availability vrrp group HQ health-check script '/config/scripts/vrrp-check.sh'
+ set high-availability vrrp group HQ interface 'eth1'
+ set high-availability vrrp group HQ no-preempt
+ set high-availability vrrp group HQ priority '200'
+ set high-availability vrrp group HQ rfc3768-compatibility
+ set high-availability vrrp group HQ virtual-address '192.168.0.254/24'
+ set high-availability vrrp group HQ vrid '1'
+
+* Hub-2:
+
+.. code-block:: none
+
+ set high-availability vrrp group HQ health-check failure-count '3'
+ set high-availability vrrp group HQ health-check interval '1'
+ set high-availability vrrp group HQ health-check script '/config/scripts/vrrp-check.sh'
+ set high-availability vrrp group HQ interface 'eth1'
+ set high-availability vrrp group HQ no-preempt
+ set high-availability vrrp group HQ priority '100'
+ set high-availability vrrp group HQ rfc3768-compatibility
+ set high-availability vrrp group HQ virtual-address '192.168.0.254/24'
+ set high-availability vrrp group HQ vrid '1'
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-30 03:29:16 +0000