Octet

Run OSPF across a GRE over IPsec tunnel with IKEv1

Cisco IOSWorking

Tasks

  1. Configure the ISAKMP policy and a pre-shared key for the peer's public address.
  2. Create a transport-mode transform set and an IPsec profile.
  3. Build the GRE tunnel with tunnel protection and sensible MTU and MSS values.
  4. Run OSPF on the tunnel and LAN only, with the LAN passive.
  5. Pin the tunnel destination with a /32 static route.
  6. Verify phase 1, the GRE selectors and mode in phase 2, and the OSPF adjacency and routes.

Solution

  1. 1Phase 1 policy and keyR1
    R1 on Cisco IOS
    crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 lifetime 86400
crypto isakmp key Gre-Psk-5mW2tY8vQ3nB address 203.0.113.2

    The key is bound to the peer's address because main mode with a PSK must choose the key before it learns the peer's identity.

  2. 2Transform set and IPsec profileR1
    R1 on Cisco IOS
    crypto ipsec transform-set TS-GRE esp-aes 256 esp-sha256-hmac
 mode transport
!
crypto ipsec profile GRE-PROTECT
 set transform-set TS-GRE

    Transport mode is enough because the GRE packet's own outer IP header already carries the public addresses. It saves 20 bytes per packet.

  3. 3GRE tunnel with protectionR1
    R1 on Cisco IOS
    interface Tunnel0
 ip address 172.16.0.1 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/0/0
 tunnel mode gre ip
 tunnel destination 203.0.113.2
 tunnel protection ipsec profile GRE-PROTECT
!
ip route 203.0.113.2 255.255.255.255 198.51.100.2

    The /32 static keeps the tunnel destination on the ISP path even if someone later leaks 203.0.113.0/30 into OSPF.

  4. 4OSPF on the tunnel and LAN onlyR1
    R1 on Cisco IOS
    router ospf 1
 router-id 1.1.1.1
 passive-interface GigabitEthernet0/0/1
 network 10.1.0.0 0.0.0.255 area 0
 network 172.16.0.0 0.0.0.3 area 0

    GRE tunnels default to OSPF network type point-to-point, so there is no DR election and the adjacency forms straight to FULL.

  5. 5Mirror configuration on the branchR2
    R2 on Cisco IOS
    crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 lifetime 86400
crypto isakmp key Gre-Psk-5mW2tY8vQ3nB address 198.51.100.1
!
crypto ipsec transform-set TS-GRE esp-aes 256 esp-sha256-hmac
 mode transport
!
crypto ipsec profile GRE-PROTECT
 set transform-set TS-GRE
!
interface Tunnel0
 ip address 172.16.0.2 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/0/0
 tunnel mode gre ip
 tunnel destination 198.51.100.1
 tunnel protection ipsec profile GRE-PROTECT
!
ip route 198.51.100.1 255.255.255.255 203.0.113.1
!
router ospf 1
 router-id 2.2.2.2
 passive-interface GigabitEthernet0/0/1
 network 10.2.0.0 0.0.0.255 area 0
 network 172.16.0.0 0.0.0.3 area 0

Verify

R1 output
R1# show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
203.0.113.2     198.51.100.1    QM_IDLE           1001 ACTIVE

IPv6 Crypto ISAKMP SA

QM_IDLE and ACTIVE means phase 1 is complete. R1 initiated, so it is the source.

R1 output
R1# show crypto ipsec sa | include ident|pkts encaps|pkts decaps|in use settings
   local  ident (addr/mask/prot/port): (198.51.100.1/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (203.0.113.2/255.255.255.255/47/0)
    #pkts encaps: 118, #pkts encrypt: 118, #pkts digest: 118
    #pkts decaps: 116, #pkts decrypt: 116, #pkts verify: 116
        in use settings ={Transport, }
        in use settings ={Transport, }

The selectors are protocol 47 (GRE) host to host between the public addresses, both SAs are in transport mode, and both counters rise with OSPF hellos alone.

R1 output
R1# show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2           0   FULL/  -        00:00:34    172.16.0.2      Tunnel0

FULL with no DR or BDR, because the tunnel is a point-to-point network type.

R1 output
R1# show ip route ospf | begin Gateway
Gateway of last resort is 198.51.100.2 to network 0.0.0.0

      10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
O        10.2.0.0/24 [110/1001] via 172.16.0.2, 00:05:12, Tunnel0

Only the branch LAN is learned, no WAN subnets. The cost of 1001 is the tunnel (1000, from its default bandwidth of 100 kbit/s) plus 1 for R2's GigabitEthernet LAN.

Mistakes people make

  • Advertising the WAN interfaces into OSPF (for example network 0.0.0.0 255.255.255.255 area 0), which leads to recursive routing and a flapping tunnel.
  • Leaving the transform set in tunnel mode. It works, but wastes 20 bytes on every packet.
  • Forgetting that the tunnel's OSPF cost is 1000 by default. If a backup path exists, set bandwidth or ip ospf cost on Tunnel0 on purpose.
  • Different ip mtu values on the two ends. OSPF database exchange can stall in EXSTART or EXCHANGE when the MTUs disagree.
  • Expecting a crypto ACL. With tunnel protection there is none; the selectors are generated from the tunnel endpoints.

Say it in the interview

"GRE gives me an interface that carries OSPF multicast, and tunnel protection encrypts it, with the selectors generated automatically as GRE between the two public addresses. Transport mode saves the extra IP header. I only advertise the LAN and the tunnel subnet into OSPF, pin the tunnel destination with a /32 static, and verify QM_IDLE, protocol 47 selectors in transport mode, a FULL adjacency, and the remote LAN learned over Tunnel0."

Book 8.5 Example SystemsBook 3.3 Internet (IP)