{"id":835,"date":"2009-10-12T19:26:31","date_gmt":"2009-10-13T01:26:31","guid":{"rendered":"http:\/\/gregsowell.com\/?p=835"},"modified":"2009-10-12T19:26:31","modified_gmt":"2009-10-13T01:26:31","slug":"cisco-%e2%80%93-ipsec-tunnel-termination-via-hsrp","status":"publish","type":"post","link":"https:\/\/gregsowell.com\/?p=835","title":{"rendered":"Cisco \u2013 IPSec Tunnel Termination via HSRP"},"content":{"rendered":"

\"hsrpIpsec\"<\/p>\n\n\n\n
James ran into this one the other day, and I found it interesting. If you have routers configured for high availability(HA) using hot stand-by routing protocol(HSRP) and you are doing straight IPSec tunnels, how would one go about terminating the tunnel on the virtual HSRP IP address? First, why would you want to do this?<\/p>\n

You would most likely want to do this so that you can create a policy at remote sites that won\u2019t break. With straight IPSec tunnels, you can\u2019t specify multiple crypto maps that leverage identical address space in the match ACLs. An easy fix in the scenario is to peer your IPSec tunnel with the HSRP address of your hub site. This way when the routers fail over, your VPN tunnel will failover also.<\/p>\n

How do we configure all of this goodness?<\/p>\n

Remote Config:
\n<\/p>\n

\r\n
\r\n
    \r\n\t
  1. !apply the crypto map to the outside interface<\/li>\r\n\t
  2. interface Fa0\/0<\/li>\r\n\t
  3. ip address 1.1.1.1 255.255.255.252<\/li>\r\n\t
  4. crypto map to-hub<\/li>\r\n\t
  5. desc outside<\/li>\r\n\t
  6. <\/li>\r\n\t
  7. interface Fa0\/1<\/li>\r\n\t
  8. ip address 192.168.1.1 255.255.255.0<\/li>\r\n\t
  9. desc inside<\/li>\r\n\t
  10. !route map to clear the do not fragment bit on tunnel traffic<\/li>\r\n\t
  11. ip policy route-map clear-df<\/li>\r\n\t
  12. <\/li>\r\n\t
  13. !our policy<\/li>\r\n\t
  14. crypto isakmp policy 1<\/li>\r\n\t
  15.  encr 3des<\/li>\r\n\t
  16.  authentication pre-share<\/li>\r\n\t
  17.  group 2<\/li>\r\n\t
  18.  lifetime 14400<\/li>\r\n\t
  19. <\/li>\r\n\t
  20. !key for hub<\/li>\r\n\t
  21. crypto isakmp key test address 2.2.2.4<\/li>\r\n\t
  22. !transform set<\/li>\r\n\t
  23. crypto ipsec transform-set to-hub esp-3des esp-sha-hmac<\/li>\r\n\t
  24. <\/li>\r\n\t
  25. !the actual crypto map<\/li>\r\n\t
  26. crypto map to-hub 10 ipsec-isakmp<\/li>\r\n\t
  27.  set peer 2.2.2.4<\/li>\r\n\t
  28.  set transform-set to-hub<\/li>\r\n\t
  29.  match address hub<\/li>\r\n\t
  30. <\/li>\r\n\t
  31. !interesting traffic ACL<\/li>\r\n\t
  32. ip access-list extended hub<\/li>\r\n\t
  33.  remark Allow access though tunnel to hub<\/li>\r\n\t
  34.  permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255<\/li>\r\n\t
  35. <\/li>\r\n\t
  36. !nat acl.  We are denying access to tunnel traffic<\/li>\r\n\t
  37. ip access-list extended NAT<\/li>\r\n\t
  38.  deny   ip any 192.168.0.0 0.0.255.255<\/li>\r\n\t
  39.  permit ip any any<\/li>\r\n\t
  40. <\/li>\r\n\t
  41. !this is the ACL for the clear DF routemap<\/li>\r\n\t
  42. ip access-list extended clear-df<\/li>\r\n\t
  43.  permit tcp any 192.168.0.0 0.0.255.255<\/li>\r\n\t
  44. <\/li>\r\n\t
  45. !nat statement<\/li>\r\n\t
  46. ip nat inside source list NAT interface FastEthernet0\/0 overload<\/li>\r\n\t
  47. <\/li>\r\n\t
  48. !clear DF route map<\/li>\r\n\t
  49. route-map clear-df permit 10<\/li>\r\n\t
  50.  match ip address clear-df<\/li>\r\n\t
  51.  set ip df 0<\/li>\r\n<\/ol>\r\n<\/div><\/pre>\n

    \nThe remote config is straight forward. <\/p>\n
    RTR-1 Config:
    \n<\/p>\n
    \r\n
    \r\n
      \r\n\t
    1. !apply the crypto map to the outside interface<\/li>\r\n\t
    2. interface Fa0\/0<\/li>\r\n\t
    3. ip address 2.2.2.2 255.255.255.248<\/li>\r\n\t
    4. !notice that the crypto map is using the redundancy command<\/li>\r\n\t
    5. ! we specify the name of the standby group<\/li>\r\n\t
    6. ! this will source the tunnel from the standby address<\/li>\r\n\t
    7. crypto map to-remote redundancy ha-out<\/li>\r\n\t
    8. desc outside<\/li>\r\n\t
    9. !here's the HSRP config info<\/li>\r\n\t
    10. standby delay minimum 30 reload 60<\/li>\r\n\t
    11. standby 1 ip 2.2.2.4<\/li>\r\n\t
    12. standby 1 timers 1 10<\/li>\r\n\t
    13. standby 1 preempt<\/li>\r\n\t
    14. !name of the hsrp group reference by the crypto map<\/li>\r\n\t
    15. standby 1 name ha-out<\/li>\r\n\t
    16. standby 1 track fa0\/1<\/li>\r\n\t
    17. <\/li>\r\n\t
    18. interface Fa0\/1<\/li>\r\n\t
    19. ip address 192.168.2.1 255.255.255.0<\/li>\r\n\t
    20. desc inside<\/li>\r\n\t
    21. !route map to clear the do not fragment bit on tunnel traffic<\/li>\r\n\t
    22. ip policy route-map clear-df<\/li>\r\n\t
    23. <\/li>\r\n\t
    24. !our policy<\/li>\r\n\t
    25. crypto isakmp policy 1<\/li>\r\n\t
    26.  encr 3des<\/li>\r\n\t
    27.  authentication pre-share<\/li>\r\n\t
    28.  group 2<\/li>\r\n\t
    29.  lifetime 14400<\/li>\r\n\t
    30. <\/li>\r\n\t
    31. !key for remote<\/li>\r\n\t
    32. crypto isakmp key test address 1.1.1.1<\/li>\r\n\t
    33. !transform set<\/li>\r\n\t
    34. crypto ipsec transform-set to-remote esp-3des esp-sha-hmac<\/li>\r\n\t
    35. <\/li>\r\n\t
    36. !the actual crypto map<\/li>\r\n\t
    37. crypto map to-remote 10 ipsec-isakmp<\/li>\r\n\t
    38.  set peer 1.1.1.1<\/li>\r\n\t
    39.  set transform-set to-remote<\/li>\r\n\t
    40.  match address remote<\/li>\r\n\t
    41. <\/li>\r\n\t
    42. !interesting traffic ACL<\/li>\r\n\t
    43. ip access-list extended remote<\/li>\r\n\t
    44.  remark Allow access though tunnel to remote<\/li>\r\n\t
    45.  permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255<\/li>\r\n\t
    46. <\/li>\r\n\t
    47. !nat acl.  We are denying access to tunnel traffic<\/li>\r\n\t
    48. ip access-list extended NAT<\/li>\r\n\t
    49.  deny   ip any 192.168.0.0 0.0.255.255<\/li>\r\n\t
    50.  permit ip any any<\/li>\r\n\t
    51. <\/li>\r\n\t
    52. !this is the ACL for the clear DF routemap<\/li>\r\n\t
    53. ip access-list extended clear-df<\/li>\r\n\t
    54.  permit tcp any 192.168.0.0 0.0.255.255<\/li>\r\n\t
    55. <\/li>\r\n\t
    56. !nat statement<\/li>\r\n\t
    57. ip nat inside source list NAT interface FastEthernet0\/0 overload<\/li>\r\n\t
    58. <\/li>\r\n\t
    59. !clear DF route map<\/li>\r\n\t
    60. route-map clear-df permit 10<\/li>\r\n\t
    61.  match ip address clear-df<\/li>\r\n\t
    62.  set ip df 0<\/li>\r\n<\/ol>\r\n<\/div><\/pre>\n
       <\/p>\n
      RTR-2 Config:
      \n<\/p>\n
      \r\n
      \r\n
        \r\n\t
      1. !apply the crypto map to the outside interface<\/li>\r\n\t
      2. interface Fa0\/0<\/li>\r\n\t
      3. ip address 2.2.2.3 255.255.255.248<\/li>\r\n\t
      4. !notice that the crypto map is using the redundancy command<\/li>\r\n\t
      5. ! we specify the name of the standby group<\/li>\r\n\t
      6. ! this will source the tunnel from the standby address<\/li>\r\n\t
      7. crypto map to-remote redundancy ha-out<\/li>\r\n\t
      8. desc outside<\/li>\r\n\t
      9. !here's the HSRP config info<\/li>\r\n\t
      10. standby delay minimum 30 reload 60<\/li>\r\n\t
      11. standby 1 ip 2.2.2.4<\/li>\r\n\t
      12. standby 1 timers 1 10<\/li>\r\n\t
      13. standby 1 preempt<\/li>\r\n\t
      14. !name of the hsrp group reference by the crypto map<\/li>\r\n\t
      15. standby 1 name ha-out<\/li>\r\n\t
      16. standby 1 track fa0\/1<\/li>\r\n\t
      17. <\/li>\r\n\t
      18. interface Fa0\/1<\/li>\r\n\t
      19. ip address 192.168.2.2 255.255.255.0<\/li>\r\n\t
      20. desc inside<\/li>\r\n\t
      21. !route map to clear the do not fragment bit on tunnel traffic<\/li>\r\n\t
      22. ip policy route-map clear-df<\/li>\r\n\t
      23. <\/li>\r\n\t
      24. !our policy<\/li>\r\n\t
      25. crypto isakmp policy 1<\/li>\r\n\t
      26.  encr 3des<\/li>\r\n\t
      27.  authentication pre-share<\/li>\r\n\t
      28.  group 2<\/li>\r\n\t
      29.  lifetime 14400<\/li>\r\n\t
      30. <\/li>\r\n\t
      31. !key for remote<\/li>\r\n\t
      32. crypto isakmp key test address 1.1.1.1<\/li>\r\n\t
      33. !transform set<\/li>\r\n\t
      34. crypto ipsec transform-set to-remote esp-3des esp-sha-hmac<\/li>\r\n\t
      35. <\/li>\r\n\t
      36. !the actual crypto map<\/li>\r\n\t
      37. crypto map to-remote 10 ipsec-isakmp<\/li>\r\n\t
      38.  set peer 1.1.1.1<\/li>\r\n\t
      39.  set transform-set to-remote<\/li>\r\n\t
      40.  match address remote<\/li>\r\n\t
      41. <\/li>\r\n\t
      42. !interesting traffic ACL<\/li>\r\n\t
      43. ip access-list extended remote<\/li>\r\n\t
      44.  remark Allow access though tunnel to remote<\/li>\r\n\t
      45.  permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255<\/li>\r\n\t
      46. <\/li>\r\n\t
      47. !nat acl.  We are denying access to tunnel traffic<\/li>\r\n\t
      48. ip access-list extended NAT<\/li>\r\n\t
      49.  deny   ip any 192.168.0.0 0.0.255.255<\/li>\r\n\t
      50.  permit ip any any<\/li>\r\n\t
      51. <\/li>\r\n\t
      52. !this is the ACL for the clear DF routemap<\/li>\r\n\t
      53. ip access-list extended clear-df<\/li>\r\n\t
      54.  permit tcp any 192.168.0.0 0.0.255.255<\/li>\r\n\t
      55. <\/li>\r\n\t
      56. !nat statement<\/li>\r\n\t
      57. ip nat inside source list NAT interface FastEthernet0\/0 overload<\/li>\r\n\t
      58. <\/li>\r\n\t
      59. !clear DF route map<\/li>\r\n\t
      60. route-map clear-df permit 10<\/li>\r\n\t
      61.  match ip address clear-df<\/li>\r\n\t
      62.  set ip df 0<\/li>\r\n<\/ol>\r\n<\/div><\/pre>\n

        \nHere in the HSRP router configs you will notice that there are two new commands. The redundancy command was added to the cyrpto map interface command and the name command was used on the standby group. You name the standby group and then reference this in the crypto statement. What this does is source the IPSec tunnel from the HSRP virtual IP.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"
        James ran into this one the other day, and I found it interesting. If you have routers configured for high availability(HA) using hot stand-by\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,8],"tags":[],"class_list":["post-835","post","type-post","status-publish","format-standard","hentry","category-cisco","category-networking"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/835","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=835"}],"version-history":[{"count":1,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/835\/revisions"}],"predecessor-version":[{"id":837,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/835\/revisions\/837"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=835"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=835"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=835"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}