GET VPN - part ten (HA)
Today I would like to talk about high availability. The second KS is one example how we can increase its availability. Let’s think about GMs. If there are more paths than one to a KS we should consider using a loopback interface for communication with the KS.
We can add following command on the GM:
crypto map MAP-NAME local-address INT-NAME
We have to ensure that:
- the loopback interface is reachable from KS’
- FW access list accepts traffic from and to this IP
ISAKMP SA from a KS before change:
R2#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
6.6.6.2 4.4.4.2 GDOI_IDLE 1002 ACTIVE
3.3.3.2 6.6.6.2 GDOI_IDLE 1030 ACTIVE
7.7.7.2 6.6.6.2 GDOI_REKEY 0 ACTIVE
7.7.7.2 6.6.6.2 GDOI_REKEY 0 ACTIVE
6.6.6.2 5.5.5.2 GDOI_IDLE 1073 ACTIVE
IPv6 Crypto ISAKMP SA
R2#
R3#sh crypto session
Crypto session current status
Interface: FastEthernet0/0.2
Session status: UP-NO-IKE
Peer: 0.0.0.0 port 848
IPSEC FLOW: permit ip 10.0.0.0/255.0.0.0 10.0.0.0/255.0.0.0
Active SAs: 2, origin: crypto map
Interface: FastEthernet0/0.3
Session status: UP-NO-IKE
Peer: 0.0.0.0 port 848
IPSEC FLOW: permit ip 20.0.0.0/255.0.0.0 20.0.0.0/255.0.0.0
Active SAs: 2, origin: crypto map
Interface: FastEthernet0/0.1
Session status: UP-IDLE
Peer: 6.6.6.2 port 848
IKEv1 SA: local 7.7.7.2/848 remote 6.6.6.2/848 Active
IKEv1 SA: local 7.7.7.2/848 remote 3.3.3.2/848 Active
IKEv1 SA: local 7.7.7.2/848 remote 6.6.6.2/848 Active
Interface: FastEthernet0/0.1
Session status: UP-IDLE
Peer: 6.6.6.2 port 848
IKEv1 SA: local 7.7.7.2/848 remote 6.6.6.2/848 Active
IKEv1 SA: local 7.7.7.2/848 remote 6.6.6.2/848 Active
R3#
Let’s do it:
crypto map MAPA-GREEN local-address Loopback10
crypto map MAPA-RED local-address Loopback10
to force GET VPN to use the new settings you need to re-apply these crypto map:
interface FastEthernet0/0.2
no crypto map MAPA-GREEN
crypto map MAPA-GREEN
!
interface FastEthernet0/0.3
no crypto map MAPA-RED
crypto map MAPA-RED
I cleared all keys on the GM1 and now I check the current ISKAMP SA:
R3#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
7.7.7.2 6.6.6.2 GDOI_REKEY 1089 ACTIVE
7.7.7.2 6.6.6.2 GDOI_REKEY 1085 ACTIVE
7.7.7.2 6.6.6.2 GDOI_REKEY 1088 ACTIVE
6.6.6.2 7.7.7.2 GDOI_IDLE 1084 ACTIVE
7.7.7.2 6.6.6.2 GDOI_REKEY 1087 ACTIVE
IPv6 Crypto ISAKMP SA
R3#
Hm, as you see it doesn’t work. I still use 7.7.7.2 instead of 11.11.11.11. I think it is related to VRF. In the documentation I can’t find any example of this command for VRF aware GET VPN.
I think I should change this line:
client registration interface FastEthernet0/0.1
Let’s try:
crypto gdoi group GDOI-GROUP-GREEN
no client registration interface FastEthernet0/0.1
client registration interface loopback10
!
crypto gdoi group GDOI-GROUP-RED
no client registration interface FastEthernet0/0.1
client registration interface loopback10
On the ASA I see:
%ASA-4-106023: Deny udp src spoke1-mng:11.11.11.11/848 dst keys2:6.6.6.2/848 by access-group "SPOKE1-MNG" [0x0, 0x0]
Let’s fix it:
access-list SPOKE1-MNG ext permit udp host 11.11.11.11 host 6.6.6.2 eq 848
access-list SPOKE1-MNG ext permit udp host 11.11.11.11 host 3.3.3.2 eq 848
I found another one:
%ASA-4-106023: Deny udp src keys2:6.6.6.2/848 dst spoke1-mng:11.11.11.11/848 by access-group "KEYS2" [0x0, 0x0]
access-list KEYS2 exte permit udp host 6.6.6.2 host 11.11.11.11 eq 848
access-list KEYS1 exte permit udp host 3.3.3.2 host 11.11.11.11 eq 848
Ok, let’s check the KS:
R2#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
6.6.6.2 3.3.3.2 GDOI_IDLE 1012 ACTIVE
6.6.6.2 4.4.4.2 GDOI_IDLE 1016 ACTIVE
11.11.11.11 6.6.6.2 GDOI_REKEY 0 ACTIVE
11.11.11.11 6.6.6.2 GDOI_REKEY 0 ACTIVE
IPv6 Crypto ISAKMP SA
R2#
As you see the KS2 registered the GM1 with IP of 11.11.11.11. I think the new command is not required for VRF aware GET VPN. It is needed only for non VRF instances.
I try to remove it:
no crypto map MAPA-GREEN local-address Loopback10
no crypto map MAPA-RED local-address Loopback10
The KS2 still sees the GM1 with 11.11.11.11:
R2#sh crypto gdoi ks members
Group Member Information :
Number of rekeys sent for group GDOI-GROUP-RED : 4
Group Member ID : 4.4.4.2 GM Version: 1.0.4
Group ID : 2
Group Name : GDOI-GROUP-RED
Key Server ID : 3.3.3.2
Rekeys sent : 2
Rekeys retries : 1
Rekey Acks Rcvd : 3
Rekey Acks missed : 0
Sent seq num : 0 14 1 1
Rcvd seq num : 0 14 1 1
Group Member ID : 5.5.5.2 GM Version: 1.0.4
Group ID : 2
Group Name : GDOI-GROUP-RED
Key Server ID : 3.3.3.2
Rekeys sent : 4
Rekeys retries : 1
Rekey Acks Rcvd : 3
Rekey Acks missed : 0
Sent seq num : 12 13 1 1
Rcvd seq num : 0 13 1 1
Group Member ID : 11.11.11.11 GM Version: 1.0.4
Group ID : 2
Group Name : GDOI-GROUP-RED
Key Server ID : 3.3.3.2
Rekeys sent : 3
Rekeys retries : 0
Rekey Acks Rcvd : 3
Rekey Acks missed : 0
Sent seq num : 0 13 1 1
Rcvd seq num : 0 13 1 1
Number of rekeys sent for group GDOI-GROUP-GREEN : 4
Group Member ID : 4.4.4.2 GM Version: 1.0.4
Group ID : 1
Group Name : GDOI-GROUP-GREEN
Key Server ID : 6.6.6.2
Rekeys sent : 1
Rekeys retries : 1
Rekey Acks Rcvd : 1
Rekey Acks missed : 1
Sent seq num : 0 0 2 1
Rcvd seq num : 0 0 0 1
Group Member ID : 11.11.11.11 GM Version: 1.0.4
Group ID : 1
Group Name : GDOI-GROUP-GREEN
Key Server ID : 3.3.3.2
Rekeys sent : 1
Rekeys retries : 1
Rekey Acks Rcvd : 2
Rekey Acks missed : 0
Sent seq num : 0 0 2 1
Rcvd seq num : 0 0 2 1
R2#
Conclusion: for non VRF we have to use the new:
crypto map MAP-NAME local-address INT-NAME
but for VRF aware this one:
client registration interface loopback10