diff options
Diffstat (limited to 'docs/vpn/gre-ipsec.rst')
| -rw-r--r-- | docs/vpn/gre-ipsec.rst | 99 |
1 files changed, 62 insertions, 37 deletions
diff --git a/docs/vpn/gre-ipsec.rst b/docs/vpn/gre-ipsec.rst index 1d40eace..f7ee84ab 100644 --- a/docs/vpn/gre-ipsec.rst +++ b/docs/vpn/gre-ipsec.rst @@ -3,24 +3,40 @@ GRE/IPsec --------- -Generic Routing Encapsulation (GRE), GRE/IPsec (or IPIP/IPsec, SIT/IPsec, or any other stateless tunnel protocol over IPsec) is the usual way to protect the traffic inside a tunnel. +Generic Routing Encapsulation (GRE), GRE/IPsec (or IPIP/IPsec, SIT/IPsec, or any +other stateless tunnel protocol over IPsec) is the usual way to protect the +traffic inside a tunnel. -An advantage of this scheme is that you get a real interface with its own address, which makes it easier to setup static routes or use dynamic routing protocols without having to modify IPsec policies. The other advantage is that it greatly simplifies router to router communication, which can be tricky with plain IPsec because the external outgoing address of the router usually doesn't match the IPsec policy of typical site-to-site setup and you need to add special configuration for it, or adjust the source address for outgoing traffic of your applications. GRE/IPsec has no such problem and is completely transparent for the applications. +An advantage of this scheme is that you get a real interface with its own +address, which makes it easier to setup static routes or use dynamic routing +protocols without having to modify IPsec policies. The other advantage is that +it greatly simplifies router to router communication, which can be tricky with +plain IPsec because the external outgoing address of the router usually doesn't +match the IPsec policy of typical site-to-site setup and you need to add special +configuration for it, or adjust the source address for outgoing traffic of your +applications. GRE/IPsec has no such problem and is completely transparent for +the applications. -GRE/IPIP/SIT and IPsec are widely accepted standards, which make this scheme easy to implement between VyOS and virtually any other router. +GRE/IPIP/SIT and IPsec are widely accepted standards, which make this scheme +easy to implement between VyOS and virtually any other router. -For simplicity we'll assume that the protocol is GRE, it's not hard to guess what needs to be changed to make it work with a different protocol. We assume that IPsec will use pre-shared secret authentication and will use AES128/SHA1 for the cipher and hash. Adjust this as necessary. +For simplicity we'll assume that the protocol is GRE, it's not hard to guess +what needs to be changed to make it work with a different protocol. We assume +that IPsec will use pre-shared secret authentication and will use AES128/SHA1 +for the cipher and hash. Adjust this as necessary. -.. NOTE:: - Note for vmware users! - Ensure that VMXNET3 adapters used, e1000 adapters have known issue with GRE processing +.. NOTE:: VMWare users should ensure that VMXNET3 adapters used, e1000 adapters + have known issue with GRE processing -#1 IPsec policy to match GRE -^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +IPsec policy matching GRE +^^^^^^^^^^^^^^^^^^^^^^^^^ -The first and arguably cleaner option is to make your IPsec policy match GRE packets between external addresses of your routers. This is the best option if both routers have static external addresses. +The first and arguably cleaner option is to make your IPsec policy match GRE +packets between external addresses of your routers. This is the best option if +both routers have static external addresses. -Suppose the LEFT router has external address 192.0.2.10 on its eth0 interface, and the RIGHT router is 203.0.113.45 +Suppose the LEFT router has external address 192.0.2.10 on its eth0 interface, +and the RIGHT router is 203.0.113.45 On the LEFT: @@ -31,40 +47,44 @@ On the LEFT: set interfaces tunnel tun0 local-ip 192.0.2.10 set interfaces tunnel tun0 remote-ip 203.0.113.45 set interfaces tunnel tun0 address 10.10.10.1/30 - + ## IPsec set vpn ipsec ipsec-interfaces interface eth0 - + # IKE group set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '2' set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes128' set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha1' - + # ESP group set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes128' set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha1' - + # IPsec tunnel set vpn ipsec site-to-site peer 203.0.113.45 authentication mode pre-shared-secret set vpn ipsec site-to-site peer 203.0.113.45 authentication pre-shared-secret MYSECRETKEY - + set vpn ipsec site-to-site peer 203.0.113.45 ike-group MyIKEGroup set vpn ipsec site-to-site peer 203.0.113.45 default-esp-group MyESPGroup - + set vpn ipsec site-to-site peer 203.0.113.45 local-address 192.0.2.10 - + # This will match all GRE traffic to the peer set vpn ipsec site-to-site peer 203.0.113.45 tunnel 1 protocol gre On the RIGHT, setup by analogy and swap local and remote addresses. -#2 Source tunnel from loopbacks -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +Source tunnel from loopbacks +^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -The scheme above doesn't work when one of the routers has a dynamic external address though. The classic workaround for this is to setup an address on a loopback interface and use it as a source address for the GRE tunnel, then setup an IPsec policy to match those loopback addresses. +The scheme above doesn't work when one of the routers has a dynamic external +address though. The classic workaround for this is to setup an address on a +loopback interface and use it as a source address for the GRE tunnel, then setup +an IPsec policy to match those loopback addresses. -We assume that the LEFT router has static 192.0.2.10 address on eth0, and the RIGHT router has a dynamic address on eth0. +We assume that the LEFT router has static 192.0.2.10 address on eth0, and the +RIGHT router has a dynamic address on eth0. **Setting up the GRE tunnel** @@ -77,7 +97,7 @@ On the LEFT: set interfaces tunnel tun0 encapsulation gre set interfaces tunnel tun0 address 10.10.10.1/30 set interfaces tunnel tun0 local-ip 192.168.99.1 - set interfaces tunnel tun0 remote-ip 192.168.99.2 + set interfaces tunnel tun0 remote-ip 192.168.99.2 On the RIGHT: @@ -91,18 +111,22 @@ On the RIGHT: set interfaces tunnel tun0 remote-ip 192.168.99.1 **Setting up IPSec** -However, now you need to make IPsec work with dynamic address on one side. The tricky part is that pre-shared secret authentication doesn't work with dynamic address, so we'll have to use RSA keys. -First, on both routers run the operational command "generate vpn rsa-key bits 2048". You may choose different length than 2048 of course. If your machine is a VM, generating it from /dev/random may take ages, so you may opt for "generate vpn rsa-key 2048 random /dev/urandom" instead. +However, now you need to make IPsec work with dynamic address on one side. The +tricky part is that pre-shared secret authentication doesn't work with dynamic +address, so we'll have to use RSA keys. + +First, on both routers run the operational command "generate vpn rsa-key bits +2048". You may choose different length than 2048 of course. .. code-block:: sh - vyos@left# run generate vpn rsa-key bits 2048 random /dev/urandom + vyos@left# run generate vpn rsa-key bits 2048 Generating rsa-key to /config/ipsec.d/rsa-keys/localhost.key - + Your new local RSA key has been generated The public portion of the key is: - + 0sAQO2335[long string here] Then on the opposite router, add the RSA key to your config. @@ -111,23 +135,24 @@ Then on the opposite router, add the RSA key to your config. set vpn rsa-keys rsa-key-name LEFT rsa-key KEYGOESHERE -Now you are ready to setup IPsec. You'll need to use an ID instead of address for the peer on the dynamic side. +Now you are ready to setup IPsec. You'll need to use an ID instead of address +for the peer on the dynamic side. On the LEFT (static address): .. code-block:: sh set vpn rsa-keys rsa-key-name RIGHT rsa-key <PUBLIC KEY FROM THE RIGHT> - + set vpn ipsec ipsec-interfaces interface eth0 - + set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128 set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1 - + set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2 set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128 set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1 - + set vpn ipsec site-to-site peer @RIGHT authentication mode rsa set vpn ipsec site-to-site peer @RIGHT authentication rsa-key-name RIGHT set vpn ipsec site-to-site peer @RIGHT default-esp-group MyESPGroup @@ -143,16 +168,16 @@ On the RIGHT (dynamic address): .. code-block:: sh set vpn rsa-keys rsa-key-name LEFT rsa-key <PUBLIC KEY FROM THE LEFT> - + set vpn ipsec ipsec-interfaces interface eth0 - + set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128 set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1 - + set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2 set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128 set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1 - + set vpn ipsec site-to-site peer 192.0.2.10 authentication id @RIGHT set vpn ipsec site-to-site peer 192.0.2.10 authentication mode rsa set vpn ipsec site-to-site peer 192.0.2.10 authentication rsa-key-name LEFT |