(GRE) Tunnel Over Ipsec VPN Using Transport Mode with Open Shortest
Total Page:16
File Type:pdf, Size:1020Kb
Avaya Solution & Interoperability Test Lab Configuring a Generic Routing Encapsulation (GRE) Tunnel Over IPSec VPN Using Transport Mode with Open Shortest Path First (OSPF) Routing Protocol between an Avaya G250 Media Gateway and a Cisco Access Router - Issue 1.0 Abstract These Application Notes present the steps necessary to configure a Generic Routing Encapsulation (GRE) tunnel over IPSec VPN using transport mode for Open Shortest Path First (OSPF) routing protocol between the Avaya G250 Media Gateway and a Cisco Access Router. Without a GRE tunnel, an IPSec configuration cannot transfer routing protocols, such as OSPF. JZ; Reviewed: Solution & Interoperability Test Lab Application Notes 1 of 21 GAK 6/16/2005 ©2005 Avaya Inc. All Rights Reserved. G250-GRE-VPN.doc 1. Introduction The network diagram in Figure 1 shows two offices. The office labeled “Main Office” uses an Avaya S8500 Media Server and an Avaya G650 Media Gateway. The office labeled “Small Office” contains an Avaya G250-BRI Media Gateway. As shown in Figure 1, a VPN tunnel across the Internet between the Avaya G250-BRI Media Gateway and the Cisco 3745 Access Router is used between the Main and Small Offices. Normal IP Security (IPSec) configurations cannot transfer routing protocols, such as Open Shortest Path First (OSPF). These Application Notes illustrate how to configure a Generic Routing Encapsulation (GRE) tunnel to accomplish the routing between the different networks. The access to the Internet from the Avaya G250-BRI Media Gateway and the Cisco Access Router are configured to use PPP over T1 in the sample configuration. The Avaya Inter-Gateway Alternate Routing (IGAR) feature provides a means of alternately using PSTN facilities when the IP link is incapable of carrying the bearer connection. The number of VoIP calls allowed on the IP link is determined by the Call Admission Control – Bandwidth Limit (CAC-BL) reported from the Avaya G250-BRI Media Gateway and the IP Codec used. Once the bandwidth limit is reached, subsequent calls will use the PSTN facilities. Main Office Small Office Avaya IP Telephones Avaya IP Telephones Cisco Avaya S8300 LSP With Catalyst Avaya S8500 6509 Avaya G250-BRI Media Gateway Media Server PMI: 192.168.203.1 12.160.179.124 68.38.206.100 Internet IPSI-2 Cisco 3745 C-LAN IPSe c Tunne l MEDPRO 10.10.11.2 10.10.11.1 Avaya Analog Phone Avaya G650 GRE Tunnel Media Gateway Avaya Analog Phone PSTN ISDN PRI ISDN BRI Figure 1: GRE Tunnel Over IPSec Configuration Between an Avaya G250-BRI Media Gateway and a Cisco Access Router JZ; Reviewed: Solution & Interoperability Test Lab Application Notes 2 of 21 GAK 6/16/2005 ©2005 Avaya Inc. All Rights Reserved. G250-GRE-VPN.doc 2. Equipment and Software Validated Table 1 below shows the versions verified in these Application Notes. Equipment Software Avaya Communication Manager Avaya S8500 Media Server 3.0 (load 337.0) Avaya S8300 Media Server (LSP) 3.0 (load 337.0) Avaya G650 Media Gateway IPSI (TN2312AP) HW03 FW012 C-LAN (TN799DP) HW01 FW012 MEDPRO (TN2302AP) HW15 FW102 Avaya G250-BRI Media Gateway 24.11.1 Avaya 4600 Series IP Telephones 2.1.3 Cisco 3745 Access Router 12.3(13) Cisco Catalyst 6509 Switch Layer 2 8.3(4) Layer 3 12.1(13)E6 Table 1: Software Versions 3. Configurations The Avaya IGAR is a single-server feature that provides an alternate bearer path between the Port Networks (PNs) and Gateways (GWs). In order to keep a single-server system, the IP connection must exist between the Avaya Media Server and Avaya PNs/GWs. As shown in Figure 1, the Avaya G250-BRI Media Gateway will register to the Avaya S8300 Local Survivable Processor (LSP) when there is no IP connection between the Main and Small Offices. Sections 3.1 and 3.2 focus on the VPN related configuration between the Avaya G250-BRI Media Gateway and the Cisco Access Router. Refer to reference [1] for how to configure the Avaya IGAR feature based on Figure 1. 3.1 Configure Avaya G250-BRI Media Gateway 3.1.1. Configure IP Routing on the Avaya G250-BRI Media Gateway The following screen shows VLAN configurations of VLAN 202 and 203. VLAN 203 is configured as the Primary Management Interface (PMI). The G250-BRI Media Gateway will use the PMI to register to the Media Gateway Controllers (MGC). interface Vlan 202 ip address 192.168.202.1 255.255.255.0 interface Vlan 203 icc-vlan ip address 192.168.203.1 255.255.255.0 pmi JZ; Reviewed: Solution & Interoperability Test Lab Application Notes 3 of 21 GAK 6/16/2005 ©2005 Avaya Inc. All Rights Reserved. G250-GRE-VPN.doc In the following screen, a MM340 T1/E1 data module on the G250-BRI Media Gateway is connected to the Internet with a public IP address. The module is configured to T1 by default. Channel group 1 is configured with 24 channels. The corresponding Serial interface 2/1:1 is configured to PPP encapsulation. ds-mode t1 controller t1 2/1 linecode b8zs framing esf channel-group 1 timeslots 1-24 speed 64 interface Serial 2/1:1 encapsulation ppp ip address 68.38.206.100 255.255.255.0 In the following screen, a GRE tunnel interface is configured. The tunnel source IP address is the IP address of Serial 2/1:1 and the tunnel destination is the Cisco Access Router’s public IP address. The tunnel IP addresses on the Avaya G250-BRI Media Gateway and Cisco Access Router must be configured on the same network for OSPF routing protocol. interface Tunnel 1 tunnel source 68.38.206.100 tunnel destination 12.160.179.124 ip address 10.10.11.1 255.255.255.252 The following screen shows the OSPF and default route configuration. The tunnel interface must be included in the OSPF configuration. The default route is configured to the Internet gateway IP address. router ospf network 10.10.11.0 0.0.0.3 area 0.0.0.0 network 192.168.202.0 0.0.0.255 area 0.0.0.0 network 192.168.203.0 0.0.0.255 area 0.0.0.0 ip default-gateway 68.38.206.1 JZ; Reviewed: Solution & Interoperability Test Lab Application Notes 4 of 21 GAK 6/16/2005 ©2005 Avaya Inc. All Rights Reserved. G250-GRE-VPN.doc 3.1.2. Configure VPN on the Avaya G250-BRI Media Gateway The Avaya G250-BRI Media Gateway is also a VPN appliance. The following shows the IKE phase 1 policy configuration. Configurations on the Cisco Access Router and Avaya G250-BRI Media Gateway must match for IKE phase 1 proposal. crypto isakmp policy 1 description "Phase 1 Proposal" encryption aes hash md5 group 2 authentication pre-share The following screen shows ISAKMP peer configuration with the Cisco Access Router. The Avaya G250-BRI Media Gateway is configured to initiate the IKE connection (aggressive mode). The Avaya G250-BRI Media Gateway supports standard VPN Dead Peer Detection (DPD) keepalives. The command keepalive 10 retry 2 on-demand is used to configure the DPD keepalives. With the on-demand approach, the G250-BRI Media Gateway never sends a DPD message if it has no traffic to send. If the G250-BRI Media Gateway has to send outbound traffic and the liveliness of the peer is questionable, the G250-BRI Media Gateway will send a DPD message to query the status of the peer. In the example, the G250-BRI Media Gateway will send a DPD keepalive message every 10 seconds, and to retry every two seconds if the DPD messages fail. crypto isakmp peer address 12.160.179.124 pre-shared-key **** isakmp-policy 1 initiate mode aggressive keepalive 10 retry 2 on-demand The following creates an IPSec Phase 2 transform-set proposal using the transport mode. In transport mode, only the IP payload is encrypted, and the original IP headers are left intact. With tunnel mode, the entire original IP packet is encrypted, and a new VPN header is added. Compared to tunnel mode, transport mode results in less overhead, and therefore uses less bandwidth for a VoIP call. Perfect Forward Secrecy (PFS) is enabled to strengthen the tunnel against brute force attacks. crypto ipsec transform-set H2 esp-aes esp-sha-hmac mode transport set pfs group2 JZ; Reviewed: Solution & Interoperability Test Lab Application Notes 5 of 21 GAK 6/16/2005 ©2005 Avaya Inc. All Rights Reserved. G250-GRE-VPN.doc The following assigns an IPSec phase 2 proposal to the Cisco Access Router via a crypto map: crypto map 1 description "Phase 2 Proposal" set peer 12.160.179.124 set transform-set H2 The following screen configures a crypto-list 901 to define the VPN traffic between the Avaya G250-BRI Media Gateway and Cisco Access Router. Note that the source IP address must be configured to the GRE tunnel source IP address and the destination IP address to the public IP address of the Cisco Access Router. ip crypto-list 901 name "To-Cisco-3745" local-address Serial 2/1:1 ip-rule 1 protect crypto map 1 source-ip host 68.38.206.100 destination-ip host 12.160.179.124 Use the command ip crypto-group to apply IP crypto-list 901 to the public facing interface, which is Serial 2/1:1 in the sample. interface Serial 2/1:1 encapsulation ppp ip crypto-group 901 ip address 68.38.206.100 255.255.255.0 JZ; Reviewed: Solution & Interoperability Test Lab Application Notes 6 of 21 GAK 6/16/2005 ©2005 Avaya Inc.