Dynamic Routing Protocol (IGP) over IPSec VPN tunnels to branch offices?

Question

What are the best practices for running an IGP to learn networks at HQ from branch offices when those offices connect via IPSec LAN-to-LAN VPN tunnels over the Internet? The branch offices terminate on Cisco VPN Concentrators that are being replaced with Cisco ASA-X's.

Is it better to let a dynamic routing protocol (IGP) -- in this case OSPF -- run directly through or to the firewalls (and across the tunnels) or is OSPF over GRE (through the firewalls, but not to the firewalls) the way to go or some other option? We have too many static routes in place that need to be eliminated. The IPSec VPN branch offices are small and don't currently run an IGP other than statics, so consider it a clean slate on what to do with branch office routing. Routers exist beyond the firewalls and can be used for tunneling if needed.

*Answers should focus on Cisco ASA-X's in the mix with L3 switches behind them to run any GRE tunnels if necessary.

Answer 1

Since you are using all ASA-X firewalls, I suggest you go with EIGRP and drop the GRE part - configure IPSEC VPN on ASA.

I had about 80+ branch offices connecting to main site with IPSEC VPN (Although tunnels were on routers not on firewalls) EIGRP played really well. EIGRP is much lighter with computations and has better performance than OSPF. Plus EIGRP is lot easier to troubleshoot and configure.

As for GRE you don't have that option (because you have ASA firewalls not routers) and if you ask me GRE is not the way to go with IPSEC VPN anyway.

Answer 2

Dynamic protocols only really make sense if your sites have more than one exit point, or you have many routes per site that can't be nicely aggregated into a single static route.

I would stick with OSPF, simply to be able to use other vendors. I know EIGRP has been 'released' but its going to be years until you see other vendors using it and you dont want to be locked into a single vendor

Answer 3

It is possible to run OSPF over an IPsec VPN between two ASAs, without the use of GRE (which as mentioned before, is not supported on the ASA). You just need to use static neighbors since multicast won't go through, and define the OSPF interface as point-to-point.

Here is an example of running OSPF over IPSec

Answer 4

Anytime possible I would use EIGRP (faster convergence and failover) over the tunnels then next in preference would be OSPF.

GRE is not supported by ASA as far as I know.

Answer 5

You can't terminate the GRE on the ASA, if you want to terminate it you will need a router behind the ASA because the GRE traffic can pass through the ASA.

In this case because you are using two ASAs, it is better to use OSPF over existing IPSEC or VPN tunnel. Terminate the VPN on the first ASA then add OSPF on both ASAs for learning the networks. This way you don't need GRE anymore.

Answer 6

GRE isn't supported on the ASA from my knowledge. Would you ever required multicast? How many tunnels would you need to support?

Although this is going off-topic of the ASA, DMVPN could solve your issue with any dynamic routing protocol. It is fairly easy to deploy and scale and supports multicast routing and spoke 2 spoke communications (including behind a NAT) [big plus for remote-home users]

EasyVPN on the ASA + routers (endpoints) maybe a solution but I only messed with static routes on that. I believe you can only add-in static routes towards the endpoints. The ASA of course can participate in EIGRP/OSPF/RIP to redistribute those routes towards the rest of your network

Answer 7

IPSec VTI is another option. I don't believe it is supported on ASA, but it is something to be aware of.