2

From a PC that is attached to a Cisco Catalyst 3850 and Portchanneld to Cisco ISR I do a ping to a destination that is connected with BGP. That works for me.

The trace path looks like:

1: localhost (10.1.1.22)
2: gateway (10.1.1.18)
3: BGP Neigbhour (10.1.2.101)
4: destination IP (10.1.3.205)

On the ISR I configure a subdevice that works as IPSec Endpoint. Phase 1 comes up and the carrier confirm phase 1. Now I need to change my IP Route like that way for encryption:

1: localhost (10.1.1.22/28)
2: gateway (10.1.1.18/28)
3: IPSec subdevice (10.1.1.37/30)
4: BGP Neigbhour (10.1.2.101/30)
5: destination IP (10.1.3.205/27)

How can I reach this goal or anything wrong in my case?

The config of my Catalyst:

sh run int gi1/0/7
!
interface GigabitEthernet1/0/7
 description PC1
 switchport access vlan 30
end

sh run int gi1/0/4
!
interface GigabitEthernet1/0/4
 description carrier1
 switchport trunk allowed vlan 331
 switchport mode trunk
end

sh run int gi1/0/1    
!
interface GigabitEthernet1/0/1
 description PortChannel ISR
 switchport trunk native vlan 10
 switchport mode trunk
 channel-group 1 mode on
end

And this is the config of the ISR

sh run int po1.331
!
interface Port-channel1.331
 description carrier1
 encapsulation dot1Q 331
 ip address 10.1.2.102 255.255.255.252
end

sh run int po1.30 
!
interface Port-channel1.30
 encapsulation dot1Q 30
 ip address 10.1.1.18 255.255.255.240
end

sh run int po1.202
!
interface Port-channel1.202
 description IPsec Interconnect
 encapsulation dot1Q 202
 ip address 10.1.1.37 255.255.255.252
 no ip redirects
 no ip proxy-arp
 crypto map test
end

Maybe I need a static route that says destination Network via IPSec subdevice and then to BGP Neigbhour? How can I do that?

I try to add a static route but doesn't work:

ip route 10.1.3.192 255.255.255.224 10.1.1.37 

But ios told me that is invalid because it's this router. The issue is that the Port where the PC is connected only accept decrypted traffic but one customer wants to use a IPSec Tunnel for encryption. So the ISR should be the endpoint, decrypt the traffic and send it decrypted to the PC1 Port.

For explanation see this Visio chart:

enter image description here

This is the Cryptoconfig from ISR

crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key XXpeterpanXX address 10.1.3.238
crypto ipsec security-association lifetime seconds 86400
crypto ipsec transform-set ipcom esp-3des esp-md5-hmac 
 mode tunnel
crypto map test 10 ipsec-isakmp 
 description IPSec peer 
 set peer 10.1.3.238
 set transform-set ipcom 
 set pfs group2
 match address 120
 crypto map test
access-list 120 permit ip 10.1.1.36 0.0.0.3 10.1.3.192 0.0.0.31
7
  • What I understand is that your VPN tunnel works, and that you need to say is "the traffic intended to this destination should be routed to the VPN endpoint (10.1.1.37) rather than to the 10.1.2.101 router" Is that correct?
    – JFL
    Sep 6, 2017 at 6:35
  • Yes through the 10.1.1.37 and then encrypted to the BGP Neighbor
    – kockiren
    Sep 6, 2017 at 6:49
  • Is this scenario possible or do I need to plug an physical device that is connected to this VLAN 202 with IP 10.1.1.38?
    – kockiren
    Sep 6, 2017 at 9:48
  • This is perfectly possible and there's several way to do it, but I'm not expert of ISR, since there's some people here with extended Cisco competencies, I hope they will answer you.
    – JFL
    Sep 6, 2017 at 9:59
  • Oh great, nice to hear that is possible and I'am not on the wrong way. Do you have a Idea how to do that? Maybe I can figure out how to do this on ISR. As I understand I need to route the traffic only through this subdevice and the Traffic will be encrypted. But the static route can't create because of the Route Hop is the Router self.
    – kockiren
    Sep 6, 2017 at 10:03

2 Answers 2

1

What you are asking doesn't make sense to me. Why do you want to see that IP address in your trace? The only thing I can think of is that you want to set up a tunnel interface at each end?

So you could do something like:

Your router:

interface tunnel 0
 ip address 10.1.1.37 255.255.255.252
 tunnel source po1.331
 tunnel destination 10.1.2.101
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ENCRYPTTUNNEL

Other Router:

interface tunnel 0
 ip address 10.1.1.38 255.255.255.252
 tunnel source g1  !<--or whatever the source interface is on that router
 tunnel destination 10.1.2.102
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ENCRYPTTUNNEL

Then you could add static routes on the ISR to networks:

ip route 10.1.3.192 255.255.255.224 10.1.1.38

Even with all of that, you will see 10.1.1.38 as a hop in your trace, not 10.1.1.37.

6
  • I can only configure my ISR and the PC that is physical connected has the network 10.1.1.17/28 configured. If I send traffic from 10.1.1.20 to 10.1.3.205 than it pass the 10.1.1.18 and than BGP Neighbor 10.1.2.101 but it should pass 10.1.1.38 before that is the IPSec endpoint so in this case the traffic is encrypted.
    – kockiren
    Sep 6, 2017 at 12:20
  • It isn't because I want to see this IP in my trace, it is because of encryption. If the traffic pass this IP then it is encrypted.
    – kockiren
    Sep 6, 2017 at 12:54
  • Is the other party only allowing traffic coming from 10.1.1.37? Can you show your crypto map and crypto ACL configurations? Can you run show crypto isakmp sa details (I think), to see what you have now? I'm not sure if you can make the traffic within the router take a detour through 10.1.1.37. I'm also curious for more detail since maybe NAT translation is what you need instead of another router interface.
    – Aaron D
    Sep 6, 2017 at 21:41
  • The other Party has a endpoint for IPsec and allow only traffic from 10.1.1.18/28 through this tunnel. I will add the crypto config above.
    – kockiren
    Sep 7, 2017 at 8:24
  • Any suggestion? I do add a Device to VLAN 202 so I can take a route through 10.1.1.38 and the device I connected has the 10.1.1.37 but the peer IPSec endpoint allow only traffic from 10.1.1.20/28 so I can't add any device that has this IP
    – kockiren
    Sep 12, 2017 at 10:55
1

You could try applying NAT.

  1. I think you want to first remove the IP address and crypto map from interface po1.202. From what I can tell, you don't need that.
  2. Next create a NAT pool which only contains the one IP address you want to use:

    ip nat pool VPN-Accepted-Address 10.1.1.37 10.1.1.37 netmask 255.255.255.252
    
  3. Now an ACL to match traffic going to 10.1.3.192/27

    ip access-list extended NAT
     permit ip 10.1.1.16 0.0.0.15 10.1.3.192 0.0.0.31
    
  4. Assign NAT outside:

    int po1.331
     ip nat outside
    
  5. Assign NAT inside:

    int po1.30
     ip nat inside
    
  6. NAT overload all traffic matching the ACL using the NAT pool which only contains 10.1.1.37

    ip nat inside source list NAT pool VPN-Accepted-Address overload
    
  7. Apply crypto map to outside interface:

     int po1.331
      crypto map test
    

show ip nat translations ping from 10.1.1.22

8
  • In case of NAT the source IP will be 10.1.1.38 and not 10.1.1.20 but the Carrier only accept traffic from 10.1.1.20/28 and not from 10.1.1.38 but 10.1.1.38 is the endpoint for IPsec and Phase 1 of this tunnel is up. What I need is that the traffic from 10.1.1.20 (gateway is 10.1.1.18 on ISR) route through 10.1.1.38 to the carrier
    – kockiren
    Sep 12, 2017 at 15:33
  • Or am I wrong in this thinking?
    – kockiren
    Sep 12, 2017 at 17:42
  • If it has to be 10.1.1.38 then put that in the NAT pool instead?
    – Aaron D
    Sep 12, 2017 at 17:45
  • I will try to implement this.
    – kockiren
    Sep 12, 2017 at 17:46
  • Have you tried what I've suggested? Your communication with the carrier will be from 10.1.1.20 and they will only see encrypted VPN traffic. The carrier will now see 10.1.1.37. The other end of the VPN tunnel will decrypt the traffic and then see it is from 10.1.1.37. I'm kind of guessing since I'm still not 100% clear what the outside vendor is requiring. Do they have requirements you can point me to that might help describe what they are looking for?
    – Aaron D
    Sep 12, 2017 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.