IPsec Support
The AWE-7200R and CloudEOS router provides robust support for using IPsec to establish and maintain IPsec tunnels for secure or encrypted communications between virtual router peer instances and virtual peer instances to non-virtual routers.
- Secure the communications between AWE-7200R and CloudEOS router instances.
- Secure the communications between AWE-7200R and CloudEOS router instances and third-party virtual router instances.
Note: See the AWE-7200R and CloudEOS router Release Notes for the latest information on the types of virtual routers that can share IPsec tunnels with AWE-7200R and CloudEOS router.
- Supported Tunnel Types
The AWE-7200R and CloudEOS router supports the use of two basic types of IPsec tunnels. The tunnel types are determined based on the encapsulation mode.
- Requirements when Behind a NAT
The AWE-7200R and CloudEOS router supports using NAT-Traversal to communicate with the remote peer virtual router. To ensure that the tunnel configuration between the AWE-7200R and CloudEOS router and peer router is successful, make sure that the AWE-7200R and CloudEOS router tunnel configuration meets the requirements for using NAT.
Note: NAT-Traversal for IPsec is not supported for DCS-7020SRG. - Using IPsec on CloudEOS and AWE-7200R and CloudEOS router Instances
The AWE-7200R and CloudEOS router enables you to establish and maintain GRE-over-IPsec and VTI IPsec tunnels for secure or encrypted communications between peer AWE-7200R and CloudEOS router instances.
- CloudEOS IPsec Connectivity to Azure Virtual Network Gateway
Supported Tunnel Types
The AWE-7200R and CloudEOS router supports the use of two basic types of IPsec tunnels. The tunnel types are determined based on the encapsulation mode.
The supported tunnel types are:- In GRE-over-IPsec encapsulation mode, the application payload is first encapsulated within a GRE packet. IPsec then encrypts the GRE packet, which results in the packet being encapsulated and encrypted by the IPsec header.
- Select this encapsulation type by specifying tunnel mode gre for the tunnel interface to which the IPsec profile is applied. This ensures that the packets forwarded on the interface are encrypted.
- When using GRE-over-IPsec encapsulation mode, both IPsec mode options are supported (select either transport or tunnel).
- In VTI encapsulation mode, the application payload is directly encapsulated and encrypted by the IPsec header.
- Select this encapsulation type by specifying tunnel mode ipsec for the tunnel interface to which the IPsec profile is applied. This ensures that the packets forwarded on the interface are encrypted.
- When using VTI encapsulation mode, set the IPsec mode to tunnel. The transport option under the IPsec mode has no effect.
Requirements when Behind a NAT
The AWE-7200R and CloudEOS router supports using NAT-Traversal to communicate with the remote peer behind a NAT. Configure the tunnel source with the outgoing interface IP address on the router.
Flow Parallelization
Enable the IPsec flow parallelization feature to achieve high throughput over an IPsec connection. Multiple cores parallelize the IPsec encryption and decryption processing when the feature is enabled. To enable this feature, include the flow parallelization encapsulation udp command in the IPsec profile configuration.
- Under the tunnel's IPsec profile, use the flow parallelization encapsulation udp command to enable the feature.
- Shut down the tunnel on the tunnel interface.
- Bring the tunnel back up on the tunnel interface. After it is up, this enables the feature.
Using IPsec on AWE-7200R and CloudEOS Router Instances
Topology
Use the AWE-7200R and CloudEOS router Router to establish and maintain IPsec tunnels between peer AWE-7200R and CloudEOS router Router instances in different topologies of varying complexity.
The diagram below represents a basic IPsec tunnel configuration in which AWE-7200R and CloudEOS router Router instances use an IPsec tunnel.
Router instances and third-party devices peer router instances.
- Creating an IKE Policy to establish IKE with the peer.
- Specifying the encryption integrity protocols for the Security Association (SA) Policy.
- Apply IKE and SA policies to a given profile.
- Apply the profile to a tunnel interface.
Configuring IPsec Tunnels on AWE-7200R and CloudEOS Router Instances
Use this procedure to configure GRE-over-IPsec or VTI IPsec tunnels on peer AWE-7200R and CloudEOS router instances.
The procedure provides all the steps required to set up either GRE-over-IPsec or VTI IPsec tunnels. Most steps are identical for both tunnel types (Steps 1 through 6 are the same). Step 7 is the step to select the tunnel type.
Procedure
Complete the following steps to configure GRE-over-IPsec or VTI IPsec tunnels on AWE-7200R and CloudEOS router instances. This configuration will be the default IKE version 2 procedure.
Examples of Running-configurations for GRE-over-IPsec Tunnels
The following examples show the running configurations for two AWE-7200R and CloudEOS router instances (AWE-7200R and CloudEOS router1 and AWE-7200R and CloudEOS router2). The instances are the tunnel endpoints of a GRE-over-IPsec tunnel.
Running Configuration for AWE-7200R and CloudEOS router1
ip security
ike policy ikebranch1
integrity sha256
dh-group 15
!
sa policy sabranch1
sa lifetime 2
pfs dh-group 14
!
profile hq
mode tunnel
ike-policy ikebranch1
sa-policy sabranch1
connection add
shared-key keyAristaHq
dpd 10 50 clear
!
interface Tunnel1
mtu 1404
ip address 1.0.3.1/24
tunnel mode gre
tunnel source 1.0.0.1
tunnel destination 1.0.0.2
tunnel ipsec profile hq
!
interface Ethernet1
no routerport
ip address 1.0.0.1/24
!Running Configuration for AWE-7200R and CloudEOS router2
ip security
ike policy ikebranch1
integrity sha256
dh-group 15
!
ike policy ikebranch2
dh-group 15
version 1
local-id 200.0.0.1
!
ike policy ikedefault
!
sa policy sabranch1
sa lifetime 2
pfs dh-group 14
!
profile hq
mode tunnel
ike-policy ikebranch1
sa-policy sabranch1
connection start
shared-key keyAristaHq
dpd 10 50 clear
!
interface Tunnel1
mtu 1404
ip address 1.0.3.2/24
tunnel mode gre
tunnel source 1.0.0.2
tunnel destination 1.0.0.1
tunnel ipsec profile hq
!
interface Ethernet2
no routerport
ip address 1.0.0.2/24
!Examples of Running-configurations for VTI IPsec Tunnels
The following examples show the running configurations for two AWE-7200R and CloudEOS router instances (AWE-7200R and CloudEOS router1 and AWE-7200R and CloudEOS router 2). The instances are the tunnel endpoints of a VTI IPsec tunnel.
Running Configuration for AWE-7200R and CloudEOS router 1
ip security
ike policy ikebranch1
integrity sha256
dh-group 15
!
sa policy sabranch1
sa lifetime 2
pfs dh-group 14
!
profile hq
mode tunnel
ike-policy ikebranch1
sa-policy sabranch1
connection add
shared-key keyAristaHq
dpd 10 50 clear
!
interface Ethernet1
no routerport
ip address 1.0.0.1/24
!
interface Management1
ip address dhcp
!
interface Tunnel1
mtu 1404
ip address 1.0.3.1/24
tunnel mode ipsec
tunnel source 1.0.0.1
tunnel destination 1.0.0.2
tunnel ipsec profile hq
!Running Configuration for AWE-7200R and CloudEOS router 2
ip security
ike policy ikebranch1
integrity sha256
dh-group 15
!
ike policy ikebranch2
dh-group 15
version 1
local-id 200.0.0.1
!
ike policy ikedefault
!
sa policy sabranch1
sa lifetime 2
pfs dh-group 14
!
profile hq
mode tunnel
ike-policy ikebranch1
sa-policy sabranch1
connection start
shared-key keyAristaHq
dpd 10 50 clear
!
interface Ethernet2
no routerport
ip address 1.0.0.2/24
!
interface Management1 ip address dhcp
!
interface Tunnel1
mtu 1404
ip address 1.0.3.2/24
tunnel mode ipsec
tunnel source 1.0.0.2
tunnel destination 1.0.0.1
tunnel ipsec profile hq
!AWE-7200R and CloudEOS IPsec Connectivity to Azure Virtual Network Gateway
This section discusses establishing an IPsec connection between the AWE-7200R and CloudEOS router and Azure Virtual Network Gateway. This document also documents establishing a BGP connection over the IPsec tunnel.
Creating an IPsec Azure Virtual Network Gateway
The following topology is for IPsec Azure Virtual Network Gateway.
The following steps are to create an IPsec Azure Virtual Network Gateway.
- Create a Resource Group.
- Create the Virtual Network.
- Create a Virtual Network Gateway.
- Configure Local Network Gateway.
- Create Site-to-site Connections.
For more information on creating an IPsec Azure Virtual Network Gateway, refer to:https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal
Creating a Resource Group
- Create a new resource group if not already created; all other resources, such as Virtual Network Gateway, Virtual Networks, and other resources, are created under this group. For example, AnetVPN is created as a resource group.
Creating a Virtual Network
- A virtual network is created in the Azure Cloud and is reached through the Azure Virtual Network Gateway. For example, a virtual network, AnetNet1, with an IP address space of 172.27.0.0/16, is created. A subnet AnetSubnet1(172.27.1.0/24) is also created and used as the subnet for Virtual Network Gateway.
- Click the Create button.
- Fill in the mandatory fields in the Project Details section.
- Fill in the IP address section with the IP address and Subnets.
- Click the Review+create tab to validate the deployment.
- Finally, you will see this screen if the deployment passes the validation.
Creating an Virtual Network Gateway
- After creating the virtual network, a virtual network gateway (AnetVGW) is created. The Virtual Network Gateway must have a public IP address. By default, BGP is disabled on the Virtual Network Gateway, and in this example below, the BGP is enabled to demonstrate the BGP session over the IPsec connection.
- Provide the public IP address name.
- Click the Review+create tab to proceed with the deployment.
- Finally, you see this page on successful deployment.
- This page provides information about the resources and other information related to the deployment.
Configuring the Local Network Gateway
Creating Site-to-Site Connections
A site-to-site connection is configured to connect a Virtual Network Gateway to the Local Network Gateway. In addition to this, the IKE version and shared key used for IKE authentication is configured. The rest of the cryptographic parameters cannot be configured from the Azure portal but can be configured using PowerShell. The complete list of Azure crypto suites is here:https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell#params
Configuring AWE-7200R and CloudEOS Router IPsec
IKE - Ikev2/AES256/SHA256/DH-Group2
IPsec - ESP/AES256/SHA256Configure the IKE Policy
router(config-ipsec-ike)# ip security
router(config-ipsec)# ike policy ikeAzure
router(config-ipsec-ike)# encryption aes256
router(config-ipsec-ike)# integrity sha256
router(config-ipsec-ike)# version 2
router(config-ipsec-ike)# dh-group 2
router(config-ipsec-ike)# ex
router(config-ipsec)#
Configure the SA Policy
router(config-ipsec)# sa policy saAzure
router(config-ipsec-sa)# esp encryption aes256
router(config-ipsec-sa)# esp integrity sha256
router(config-ipsec-sa)# ex
router(config-ipsec)#
Configure the Profile
router(config-ipsec)# profile profAzure
router(config-ipsec-profile)# ike-policy ikeAzure
router(config-ipsec-profile)# sa-policy saAzure
router(config-ipsec-profile)# connection start
router(config-ipsec-profile)# shared-key arista
router(config-ipsec-profile)# ex
router(config-ipsec)#
Configuring the IPsec Tunnel (VTI) Interface
router(config)# interface Tunnel 1
router(config-if-Tu1)# ip address 10.100.1.1/24
router(config-if-Tu1)# tunnel mode ipsec
router(config-if-Tu1)# tunnel source 3.212.212.81
router(config-if-Tu1)# tunnel destination 13.77.139.173
router(config-if-Tu1)# tunnel ipsec profile profAzure
! IPSec adds an overhead of up to 82 bytes. Example: A GRE tunnel with an MTU=1476 should be changed to 1394 when using IPSec.
router(config-if-Tu1)# ex
router(config)#show
Verifying the IPsec Connection
router(config)# show ip securityconnection
TunnelSource Dest Status UptimeInput Output Rekey Time
Tunnel1 3.212.212.81 13.77.139.173Established1 second0 bytes 0 bytes44 minutes
0 pkts 0 pkts
On-Prem AWE-7200R and CloudEOS behind a NAT Device
router# ip security
ike policy ikeAzure
encryption aes256
dh-group 2
local-id 3.212.212.81
BGP over IPsec
CloudEOS(config)# router bgp 65530
CloudEOS(config-router-bgp)# neighbor 172.27.0.254 remote-as 65515
CloudEOS(config-router-bgp)# neighbor 172.27.0.254 update-source Tunnel1
CloudEOS(config-router-bgp)# neighbor 172.27.0.254 ebgp-multihop 4
CloudEOS(config-router-bgp)# address-family ipv4
CloudEOS(config-router-bgp-af)# neighbor 172.27.0.254 activate
CloudEOS(config-router-bgp-af)# network 10.100.100.0/24
CloudEOS(config-router-bgp-af)# ex
CloudEOS(config-router-bgp)# ex
CloudEOS(config)#
BGP Routes Advertised to Neighbor
router(config)# show ip bgpneighbors 172.27.0.254 advertised-routes
BGP routing table information for VRF default
Router identifier 198.18.0.65, local AS number 65530
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E - ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup, L - labeled-unicast, q - Queued for advertisement
% - Pending BGP convergence
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI Origin Validation codes: V - valid, I - invalid, U - unknown
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - Link Local Nexthop
Network Next Hop MetricLocPref WeightPath
* >10.100.100.0/24 10.100.1.1 - - - 65530 i
BGP Routes Received from the Neighbor
router(config)# show ip bgpneighbors 172.27.0.254received-routes
BGP routing table information for VRF default
Router identifier 198.18.0.65, local AS number 65530
Route status codes: s - suppressed, * - valid, > - active, # - not installed, E - ECMP head, e - ECMP
S - Stale, c - Contributing to ECMP, b - backup, L - labeled-unicast
% - Pending BGP convergence
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI Origin Validation codes: V - valid, I - invalid, U - unknown
AS Path Attributes: Or-ID - Originator ID, C-LST - Cluster List, LL Nexthop - Link Local Nexthop
NetworkNext Hop MetricLocPref WeightPath
* >172.27.0.0/16172.27.0.254 - - - 65515 i
router(config)#
Verifying the BGP Connection
router(config)# show ip bgp summmary
BGP summary information for VRF default
Router identifier 198.18.0.65, local AS number 65530
Neighbor Status Codes: m - Under maintenance
NeighborVASMsgRcvd MsgSent InQ OutQUp/DownState PfxRcd PfxAcc
172.27.0.254465515 194 214 0 000:00:06Estab 11
router(config)#