2

I'm having some difficulty with this scenario. I have an "Internet Edge" whereby all of my regular traffic is firewalled, NATed and sent on it's way. I also have a "Wan Aggregation" layer where a router connects via various WAN technologies to other branch offices.

One of these branches happens to be a floating branch, whose public ip address changes periodically, and is connected via IPSEC VTI. The trouble lies in that, while the tunnel comes up, the wan aggregation router is actually sending it's ISAKMP and ESP packets out it's default route, instead of out it's configured public ip address. I can't change the default route because then all branch traffic would exit on that ip address as well (and not be filtered/firewalled/etc).

The default (and all other) routes are propagated through OSPF.

Network Diagram

I considered doing something with VRF, but I want to add TEST-MDF's networks OSPF, and it looks to be a huge pain to leak routes into the global routing table.

I also played around with policy based routing by creating an access list permitting esp, isakmp, and non500-isakmp from any to any and applying it to just about every interface.

Here's the relevant config:

TEST-MDF:
    crypto isakmp policy 1
     encr aes
     authentication pre-share
     group 2
    crypto isakmp key cisco address 0.0.0.0 0.0.0.0
    !
    crypto ipsec transform-set TSET esp-aes esp-sha-hmac 
    !
    crypto ipsec profile VTI
     set transform-set TSET 
    !
    interface Loopback0
     ip address 10.9.8.1 255.255.255.0
     ip ospf network point-to-point
     ip ospf 1 area 9
    !
    interface Tunnel0
     ip unnumbered Loopback0
     ip ospf 1 area 9
     tunnel source FastEthernet0/0
     tunnel destination 1.1.1.5
     tunnel mode ipsec ipv4
     tunnel protection ipsec profile VTI
    !
    interface FastEthernet0/0
     ip address 1.2.1.2 255.255.255.0
    !
    router ospf 1
     log-adjacency-changes
    !
    ip route 0.0.0.0 0.0.0.0 1.2.1.1

CNT-MDF-WANAGG#
    crypto isakmp policy 1
     encr aes
     authentication pre-share
     group 2
    crypto isakmp key cisco address 0.0.0.0 0.0.0.0
    crypto isakmp profile IKE-DEFAULT
       keyring default
       match identity address 0.0.0.0 
       virtual-template 1
    !
    !
    crypto ipsec transform-set TSET esp-aes esp-sha-hmac 
    !
    crypto ipsec profile VTI
     set transform-set TSET 
     set isakmp-profile IKE-DEFAULT
    !
    interface Loopback0
     ip address 10.0.0.5 255.255.255.255
     ip policy route-map RM-VPN
     ip ospf network point-to-point
     ip ospf 1 area 0
    !
    interface Loopback100
     ip address 10.4.8.1 255.255.255.0
     ip ospf network point-to-point
     ip ospf 1 area 4
    !
    interface FastEthernet0/0
     ip address 10.255.0.1 255.255.255.254
     ip policy route-map RM-VPN
     ip ospf 1 area 0
    !
    interface FastEthernet0/1
     ip address 1.1.1.5 255.255.255.0
     ip policy route-map RM-VPN
    !         
    interface Virtual-Template1 type tunnel
     ip unnumbered Loopback0
     ip virtual-reassembly
     ip policy route-map RM-VPN
     ip ospf 1 area 9
     tunnel source FastEthernet0/1
     tunnel mode ipsec ipv4
     tunnel protection ipsec profile VTI
    !
    router ospf 1
     log-adjacency-changes
    !
    ip local policy route-map RM-VPN
    !
    ip access-list extended VPN
     permit esp any any
     permit gre any any
     permit udp any any eq isakmp
     permit udp any any eq non500-isakmp
    !
    route-map RM-VPN permit 1
     match ip address VPN
     set ip default next-hop 1.1.1.1
Improve this question
1
  • PBR has to be used on an incoming interface, and since your router is initiating the IPSEC it won't be able modify the next-hop. Could you just route the IPSEC peer IP out your public next-hop? Even if it changes occasionally it might be possible to contact them for a larger subnet you could route to the public interface?
    – Robert
    Mar 20, 2015 at 14:37

2 Answers 2

Reset to default
2

You were right with your assumption about VRFs. Use them. F-VRF, I-VRF coined per Cisco

https://supportforums.cisco.com/document/51931/vrf-aware-ipsec-cheat-sheet#Tunnel-protection_with_ivrfcust1-vrf_and_fvrfinternet-vrf_

Improve this answer
0

you could make a router-map to first filter out the branches with the ip you know and then set interface out/next-hop on the different path you want it 2 take.

Or have the floating branch office connect on a second wan ip ?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.