8

I am in the process of re-ip addressing a large number of remote locations, all of which are using a Cisco GET VPN/GDOI configuration for encryption of the traffic. In the process, I also wanted to review the configuration to ensure we were following best-practices.

I have been over the Cisco GET VPN config guide and Deployment Guide, but haven't found a good answer to this question:

Is it best practice to use a loopback or physical interface as the terminating interface of the encrypted traffic?

Currently the configuration uses the physical Gig0/0 interface to terminate the encrypted traffic. However to simplify some of the other changes involved, I would like to utilize the Loopback0 interface for that purpose. Down the road, some of these sites would be getting redundant uplinks, and my understanding is that I could use the Loopback interface to terminate both encrypted connections.

Below are two samples, the existing configuration and how I understand I would have to set the router up to use the Loopback. I believe I would only have to add the following command to the GM: 

crypto map %MAPNAME local-address Loopback0

The GM address would then also have to be changed on the Key Server; to my knowledge, that is the only change on the KS.

A sample of the existing confiuration:

!
crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
crypto isakmp key %KEY address 10.100.1.1
crypto isakmp key %KEY address 10.100.2.1
!
crypto ipsec df-bit clear
crypto gdoi group GDOI-MPLS-GROUP-10
 identity number 10
 server address ipv4 10.100.1.1
 server address ipv4 10.100.2.1
!
crypto map CM-STATIC-MAP 10 gdoi 
 set group GDOI-MPLS-GROUP-10
!
interface Loopback0
 ip address 10.129.110.125 255.255.255.252
!
interface GigabitEthernet0/0
 description MPLS-Connection
 ip address 10.101.44.2 255.255.255.248
 ip virtual-reassembly
 ip tcp adjust-mss 1300
 duplex full
 speed 100
 no cdp enable
 crypto map CM-STATIC-MAP
!

A sample using the loopback as the terminating interface: 

!
crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
crypto isakmp key %KEY address 10.100.1.1
crypto isakmp key %KEY address 10.100.2.1
!
crypto ipsec df-bit clear
crypto gdoi group GDOI-MPLS-GROUP-10
 identity number 10
 server address ipv4 10.100.1.1
 server address ipv4 10.100.2.1
!
crypto map CM-STATIC-MAP local-address Loopback0
crypto map CM-STATIC-MAP 10 gdoi 
 set group GDOI-MPLS-GROUP-10
!
interface Loopback0
 ip address 10.129.110.101 255.255.255.252
!
interface GigabitEthernet0/0
 description MPLS-Connection
 ip address 10.101.24.2 255.255.255.248
 ip tcp adjust-mss 1300
 duplex full
 speed 100
 no cdp enable
 crypto map CM-STATIC-MAP
!
Improve this question

2 Answers 2

Reset to default
4

If you are planning to implement multiple links in the same GDOI group on the GMs, best practice would be to use a loopback interface as the crypto source. The reason being that otherwise the key servers will see each interface as a separate entry and the router will receive multiple rekeys. Your second sample config looks good.

See section 4.1.2.1.3 of the GETVPN DIG: http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6525/ps9370/ps7180/GETVPN_DIG_version_1_0_External.pdf

Improve this answer
1
  • Thank you! That is the guide I was missing in my searches... :)
    – Brett Lykins
    Commented May 14, 2013 at 14:39
0

Here's a GET VPN configuration example:

http://www.certvideos.com/get-vpn-configuration-example/

Improve this answer
1
  • 2
    First, welcome and thank you for contributing. Stack Exchange generally frowns on answers that are link only as they are subject to "link rot." Please add the relevant information in the answer and use links as references or for more detail.
    – YLearn
    Commented Aug 16, 2013 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.