BGP over IPSEC

Does anyone have any experience running a route based vti using bgp as the INTERIOR routing protocol? I have a client who wants to run the ipsec vpn this way and the senior Network Engineer says we have to do it.

Find more posts tagged with

Comments

ColbyG

With GRE tunnels? I've run DMVPN with BGP. Traditional IPSec should work too.

Bl8ckr0uter

Yes. Sorry I should have mentioned that. I really want to use OSPF for this but the customer is always right.

How well did that work out? I am assuming you advertised a private ASN between the tunnels.

I originally thought about using DMVPN but I am having some trouble with the "how". I guess we could have multiple spoke routers. Can a router be a hub and a spoke at the same time (assuming the networks are different)?

shodown

What are the design requirements, and more importantly what problem are we trying to solve?

ColbyG

Each site was an AS. I prefer BGP greatly when routing between sites. You have much, much more control. OSPF can be annoying to design for a DMVPN deployment if you want multiple areas.

What do you mean a hub and a spoke? You have a diagram?

Bl8ckr0uter

ColbyG wrote: »

What do you mean a hub and a spoke? You have a diagram?

shodown wrote: »

What are the design requirements, and more importantly what problem are we trying to solve?

Ok. R5-8 are our routers. R1-4 are our client. On R1 and R2 and R5 and R6 there are vpn tunnels two each other (these actually represent an HSRP pair). The same configuration is on R7, R8, R3 and R4. Those tunnels are the primary tunnel for traffic. R1 and R2 also have backup tunnel to R7 and R8 in case R5 and R6 fail. R3 and R4 have a similar connection. Now behind are routers (R5-

are devices that need to talk to things behind their devices (R1-4). Now. Both sets of vpn devices have client devices talking at the same time that are in different subnets. So lets say that behind R1 and R2 the subnet is 10.1.0./24 which pairs to the subnet behind R5 and R6 which is 192.168.1.0/24. R3 and R4 have the subnet 10.2.0.0/24 which pairs to R7 and R8 which has 192.168.2.0/24.

So in case of a failure of both of our routers on one side, we will have tunnels as backups. IMO we don't need BGP for this as we could just use tunnels with weights (and use RRI on the crypto maps as we have other devices behind R5/6 and R7/8 that could fail). I was thinking of making R5/6 and R7/8 DMVPN Hubs and the others spokes and have each a spoke to both hub pairs.
Hopefully you aren't confused and I explained it well as my limited experience probably means my idea doesn't make sense.

idea2.jpg

Bl8ckr0uter

I think I figured out what I am going to do for this. I am going to use tunnels with different metrics on them. I have like 6 2811s and 2 3945s at work I can try this with.

Bl8ckr0uter

Colby did you use private ASNs for your network?