月: 2016年5月

VTIでも設定したのでメモ・・・。

ACLいらないし, GRE分のオーバーヘッド(24バイト)も減るしこっちのほうがなんかいいかも。
# IP以外のプロトコルなんてあんま使わないしな。

■ MTU #sh int tu1 Tunnel1 is up, line protocol is up   Hardware is Tunnel   Internet address is 192.168.48.234/29   MTU 17862 bytes, BW 100 Kbit/sec, DLY 50000 usec,      reliability 255/255, txload 1/255, rxload 1/255   Encapsulation TUNNEL, loopback not set   Keepalive set (5 sec), retries 3   Tunnel linestate evaluation up   Tunnel source 192.168.1.2 (Vlan100), destination 52.196.175.0    Tunnel Subblocks:       src-track:          Tunnel1 source tracking subblock associated with Vlan100           Set of tunnels with source Vlan100, 1 member (includes iterators), on interface <OK>   Tunnel protocol/transport IPSEC/IP   Tunnel TTL 255   Tunnel transport MTU 1422 bytes   Tunnel transmit bandwidth 8000 (kbps)   Tunnel receive bandwidth 8000 (kbps)   Tunnel protection via IPSec (profile “VTI”)   Last input 19:27:49, output 18:54:11, output hang never   Last clearing of “show interface” counters 3d17h   Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 330   Queueing strategy: fifo   Output queue: 0/0 (size/max)   5 minute input rate 0 bits/sec, 0 packets/sec   5 minute output rate 0 bits/sec, 0 packets/sec      12728 packets input, 1119256 bytes, 0 no buffer      Received 0 broadcasts (0 IP multicasts)      0 runts, 0 giants, 0 throttles      0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort      68893 packets output, 4199880 bytes, 0 underruns      0 output errors, 0 collisions, 0 interface resets      0 unknown protocol drops      0 output buffer failures, 0 output buffers swapped out permit ip host 172.16.1.1 host 172.16.1.2

以下, Config抜粋。

■ Cisco 抜粋 ! crypto isakmp policy 5  encr aes 256  hash sha256  authentication pre-share  group 14  lifetime 3600 crypto isakmp key aws address A.A.A.A  255.255.255.255 crypto isakmp keepalive 30 30 ! ! crypto ipsec transform-set IPSEC esp-aes 256 esp-sha256-hmac   mode tunnel ! crypto ipsec profile VTI  set transform-set IPSEC  set pfs group14 ! ! ! interface Tunnel1  ip address 192.168.254.1 255.255.255.0  ip mtu 1422   ! ← いらないかも。 不要でした。 ※  ip ospf network broadcast  ip ospf hello-interval 5  keepalive 5 3  tunnel source Vlan100  tunnel mode ipsec ipv4  tunnel destination A.A.A.A  tunnel protection ipsec profile VTI ! interface Vlan100  ip address 192.168.1.2 255.255.255.0  ip virtual-reassembly in ! ! ! router ospf 1  network 192.168.10.0 0.0.0.255 area 0  network 192.168.254.0 0.0.0.255 area 0 ! ! ip access-list extended AWS_GRE !  permit ip host 172.16.1.1 host 172.16.1.2

※ VTIはMTUを自動計算するから設定は不要（Ciscoのページ参照）

■ Vyos 抜粋 set interfaces loopback lo address ‘172.16.1.2/32’ set interfaces vti vti1 address ‘192.168.48.233/29’ set interfaces vti vti1 ip ospf dead-interval ’20’ set interfaces vti vti1 ip ospf hello-interval ‘5’ set interfaces vti vti1 ip ospf network ‘broadcast’ set interfaces vti vti1 ip ospf priority ‘1’ set interfaces vti vti1 ip ospf retransmit-interval ‘5’ set interfaces vti vti1 ip ospf transmit-delay ‘1’ set interfaces vti vti1 mtu ‘1422’ set protocols ospf area 0 network ‘192.168.254.0/24’ set protocols ospf area 0 network ‘10.10.20.0/24′ set protocols ospf log-adjacency-changes ‘detail’ set protocols static route 0.0.0.0/0 next-hop 10.10.10.1 distance ‘1’ —- set vpn ipsec esp-group ESP_AWS compression ‘disable’ set vpn ipsec esp-group ESP_AWS lifetime ‘3600’ set vpn ipsec esp-group ESP_AWS mode ‘tunnel’ set vpn ipsec esp-group ESP_AWS pfs ‘enable’ set vpn ipsec esp-group ESP_AWS proposal 1 encryption ‘aes256’ set vpn ipsec esp-group ESP_AWS proposal 1 hash ‘sha256’ set vpn ipsec ike-group IKE_AWS dead-peer-detection action ‘hold’ set vpn ipsec ike-group IKE_AWS dead-peer-detection interval ’30’ set vpn ipsec ike-group IKE_AWS dead-peer-detection timeout ‘120’ set vpn ipsec ike-group IKE_AWS lifetime ‘3600’ set vpn ipsec ike-group IKE_AWS proposal 1 dh-group ’14’ set vpn ipsec ike-group IKE_AWS proposal 1 encryption ‘aes256’ set vpn ipsec ike-group IKE_AWS proposal 1 hash ‘sha256’ set vpn ipsec ipsec-interfaces interface ‘eth0’ set vpn ipsec logging log-modes ‘all’ set vpn ipsec nat-traversal ‘enable’ set vpn ipsec site-to-site peer Global IP authentication mode ‘pre-shared-secret’ set vpn ipsec site-to-site peer Global IP authentication pre-shared-secret ‘aws’ set vpn ipsec site-to-site peer Global IP authentication remote-id ‘192.168.1.2’ set vpn ipsec site-to-site peer Global IP connection-type ‘respond’ set vpn ipsec site-to-site peer Global IP ike-group ‘IKE_BB’ set vpn ipsec site-to-site peer Global IP ikev2-reauth ‘inherit’ set vpn ipsec site-to-site peer Global IP local-address ‘10.200.10.50’ set vpn ipsec site-to-site peer Global IP vti bind ‘vti1’ set vpn ipsec site-to-site peer Global IP vti esp-group ‘ESP_BB’

トンネル張った後に, 「OSPFでネイバーがーーー」ってなったけどMTUサイズがあっていなかったから。合わせればState Fullになる。

ちょっとやりたいことあってAWSとIPSec張りたいなと。

構成はこんな。

OSPFは別にいらないんだけど，折角なんでダイナミックルーティングをまわしてみる。

簡単にいけるかなーとも思ったけどかなりハマった。双方NAT配下で家のほうはさらにグローバルはDHCP割当で変わるわPATだからNAT-Tやらなきゃだとか，まーいろいろ気にするポイントがあった。

けど，無事につながりました。
大きくハマった点は以下2つ。

・CiscoのIPSec用ACLでgre指定だとNG。ip 指定で解消。
・Vyosのremote-idでCiscoの実IPを入れてあげる。

Vyosはわかるんだが，CiscoのACLはなんでだ。わからん・・・。

VTIとかでやればACL不要だからいいのかと思ったが，これはこれでハマったので又今度。

Try&Errorをひたすら試すはめになりました。
いい勉強させていただきました。

■ Cisco 抜粋 ! crypto isakmp policy 5  encr aes 256  hash sha256  authentication pre-share  group 14  lifetime 3600 crypto isakmp key aws address A.A.A.A  255.255.255.255 crypto isakmp keepalive 30 30 ! ! crypto ipsec transform-set IPSEC esp-aes 256 esp-sha256-hmac   mode tunnel ! ! crypto map GRE_IPSEC 10 ipsec-isakmp   set peer A.A.A.A  set transform-set IPSEC   set pfs group14  match address AWS_GRE ! ! ! ! interface Loopback1  ip address 172.16.1.1 255.255.255.255 ! interface Tunnel1  ip address 192.168.254.1 255.255.255.0  ip mtu 1400  ip tcp adjust-mss 1360  ip ospf network broadcast  ip ospf hello-interval 5  keepalive 5 3  tunnel source Loopback1  tunnel destination 172.16.1.2 ! interface Vlan100  ip address 192.168.1.2 255.255.255.0  ip virtual-reassembly in  crypto map GRE_IPSEC ! ! ! router ospf 1  network 192.168.10.0 0.0.0.255 area 0  network 192.168.254.0 0.0.0.255 area 0 ! ! ip access-list extended AWS_GRE !  permit ip host 172.16.1.1 host 172.16.1.2

■ Vyos 抜粋 set interfaces loopback lo address ‘172.16.1.2/32’ set interfaces tunnel tun1 address ‘192.168.254.2/24’ set interfaces tunnel tun1 encapsulation ‘gre’ set interfaces tunnel tun1 ip ospf dead-interval ’20’ set interfaces tunnel tun1 ip ospf hello-interval ‘5’ set interfaces tunnel tun1 ip ospf priority ‘1’ set interfaces tunnel tun1 ip ospf retransmit-interval ‘5’ set interfaces tunnel tun1 ip ospf transmit-delay ‘1’ set interfaces tunnel tun1 local-ip ‘172.16.1.2’ set interfaces tunnel tun1 mtu ‘1400’ set interfaces tunnel tun1 multicast ‘enable’ set interfaces tunnel tun1 remote-ip ‘172.16.1.1’ set protocols ospf area 0 network ‘192.168.254.0/24’ set protocols ospf area 0 network ‘10.10.20.0/24′ set protocols ospf log-adjacency-changes ‘detail’ set protocols static route 0.0.0.0/0 next-hop 10.10.10.1 distance ‘1’ —- set vpn ipsec esp-group ESP_AWS compression ‘disable’ set vpn ipsec esp-group ESP_AWS lifetime ‘3600’ set vpn ipsec esp-group ESP_AWS mode ‘tunnel’ set vpn ipsec esp-group ESP_AWS pfs ‘enable’ set vpn ipsec esp-group ESP_AWS proposal 1 encryption ‘aes256’ set vpn ipsec esp-group ESP_AWS proposal 1 hash ‘sha256’ set vpn ipsec ike-group IKE_AWS dead-peer-detection action ‘hold’ set vpn ipsec ike-group IKE_AWS dead-peer-detection interval ’30’ set vpn ipsec ike-group IKE_AWS dead-peer-detection timeout ‘120’ set vpn ipsec ike-group IKE_AWS lifetime ‘3600’ set vpn ipsec ike-group IKE_AWS proposal 1 dh-group ’14’ set vpn ipsec ike-group IKE_AWS proposal 1 encryption ‘aes256’ set vpn ipsec ike-group IKE_AWS proposal 1 hash ‘sha256’ set vpn ipsec ipsec-interfaces interface ‘eth0’ set vpn ipsec logging log-modes ‘all’ set vpn ipsec nat-traversal ‘enable’ set vpn ipsec site-to-site peer 0.0.0.0 authentication mode ‘pre-shared-secret’ set vpn ipsec site-to-site peer 0.0.0.0 authentication pre-shared-secret ‘aws’ set vpn ipsec site-to-site peer 0.0.0.0 authentication remote-id ‘192.168.1.2’ set vpn ipsec site-to-site peer 0.0.0.0 connection-type ‘respond’ set vpn ipsec site-to-site peer 0.0.0.0 ike-group ‘IKE_AWS’ set vpn ipsec site-to-site peer 0.0.0.0 local-address ‘10.10.10.50’ set vpn ipsec site-to-site peer 0.0.0.0 tunnel 1 esp-group ‘ESP_AWS’ set vpn ipsec site-to-site peer 0.0.0.0 tunnel 1 local prefix ‘172.16.1.2/32’ set vpn ipsec site-to-site peer 0.0.0.0 tunnel 1 remote prefix ‘172.16.1.1/32’