Site-to-Site IPSec VPN to Cisco using FlexVPN

This guide shows a sample configuration for FlexVPN site-to-site Internet Protocol Security (IPsec)/Generic Routing Encapsulation (GRE) tunnel.

FlexVPN is a newer “solution” for deployment of VPNs and it utilizes IKEv2 as the key exchange protocol. The result is a flexible and scalable VPN solution that can be easily adapted to fit various network needs. It can also support a variety of encryption methods, including AES and 3DES.

The lab was built using EVE-NG.

Configuration

VyOS

  • GRE:

set interfaces tunnel tun1 encapsulation 'gre'
set interfaces tunnel tun1 ip adjust-mss '1336'
set interfaces tunnel tun1 mtu '1376'
set interfaces tunnel tun1 remote '10.1.1.6'
set interfaces tunnel tun1 source-address '88.2.2.1'
  • IPsec:

set vpn ipsec authentication psk vyos_cisco_l id 'vyos.net’
set vpn ipsec authentication psk vyos_cisco_l id 'cisco.hub.net'
set vpn ipsec authentication psk vyos_cisco_l secret 'secret'
set vpn ipsec esp-group e1 lifetime '3600'
set vpn ipsec esp-group e1 mode 'tunnel'
set vpn ipsec esp-group e1 pfs 'disable'
set vpn ipsec esp-group e1 proposal 1 encryption 'aes128'
set vpn ipsec esp-group e1 proposal 1 hash 'sha256'
set vpn ipsec ike-group i1 key-exchange 'ikev2'
set vpn ipsec ike-group i1 lifetime '28800'
set vpn ipsec ike-group i1 proposal 1 dh-group '5'
set vpn ipsec ike-group i1 proposal 1 encryption 'aes256'
set vpn ipsec ike-group i1 proposal 1 hash 'sha256'
set vpn ipsec interface 'eth2'
set vpn ipsec options disable-route-autoinstall
set vpn ipsec options flexvpn
set vpn ipsec options interface 'tun1'
set vpn ipsec options virtual-ip
set vpn ipsec site-to-site peer cisco_hub authentication local-id 'vyos.net'
set vpn ipsec site-to-site peer cisco_hub authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer cisco_hub authentication remote-id 'cisco.hub.net'
set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate'
set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1'
set vpn ipsec site-to-site peer cisco_hub ike-group 'i1'
set vpn ipsec site-to-site peer cisco_hub local-address '88.2.2.1'
set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6'
set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '88.2.2.1/32'
set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre'
set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32'
set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0'

Cisco

aaa new-model
!
!
aaa authorization network default local
!
crypto ikev2 name-mangler GET_DOMAIN
 fqdn all
 email all
!
!
crypto ikev2 authorization policy vyos
 pool mypool
 aaa attribute list mylist
 route set interface
 route accept any tag 100 distance 5
!
crypto ikev2 keyring mykeys
 peer peer1
  identity fqdn vyos.net
  pre-shared-key local secret
  pre-shared-key remote secret
crypto ikev2 profile my_profile
 match identity remote fqdn vyos.net
 identity local fqdn cisco.hub.net
 authentication remote pre-share
 authentication local pre-share
 keyring local mykeys
 dpd 10 3 periodic
 aaa authorization group psk list local name-mangler GET_DOMAIN
 aaa authorization user psk cached
 virtual-template 1
!
!
!
crypto ipsec transform-set TSET esp-aes esp-sha256-hmac
 mode tunnel
!
!
crypto ipsec profile my-ipsec-profile
 set transform-set TSET
 set ikev2-profile my_profile
!
interface Virtual-Template1 type tunnel
 no ip address
 ip mtu 1376
 ip nhrp network-id 1
 ip nhrp shortcut virtual-template 1
 ip tcp adjust-mss 1336
 tunnel path-mtu-discovery
 tunnel protection ipsec profile my-ipsec-profile
 !
 ip local pool my_pool 172.16.122.1 172.16.122.254

Since the tunnel is a point-to-point GRE tunnel, it behaves like any other point-to-point interface (for example: serial, dialer), and it is possible to run any Interior Gateway Protocol (IGP)/Exterior Gateway Protocol (EGP) over the link in order to exchange routing information

Verification

vyos@vyos$ show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface        IP Address                        S/L  Description
---------        ----------                        ---  -----------
eth0             -                                 u/u
eth1             -                                 u/u
eth2             88.2.2.1/24                       u/u
eth3             172.16.1.2/24                     u/u
lo               127.0.0.1/8                       u/u
                 ::1/128
tun1             172.16.122.2/32                   u/u

vyos@vyos:~$ show vpn ipsec sa
Connection          State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID              Proposal
------------------  -------  --------  --------------  ----------------  ----------------  ---------------------  -----------------------------
cisco_hub-tunnel-1  up       44m17s    35K/31K         382/367           10.1.1.6          cisco.hub.net  AES_CBC_128/HMAC_SHA2_256_128


Hub#sh crypto ikev2 sa detailed
 IPv4 Crypto IKEv2  SA

Tunnel-id Local                 Remote                fvrf/ivrf            Status
5         10.1.1.6/4500         88.2.2.1/4500         none/none               READY
      Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK
      Life/Active Time: 86400/2694 sec
      CE id: 0, Session-id: 2
      Status Description: Negotiation done
      Local spi: C94EE2DC92A60C47       Remote spi: 9AF0EF151BECF14C
      Local id: cisco.hub.net
      Remote id: vyos.net
      Local req msg id:  269            Remote req msg id:  0
      Local next msg id: 269            Remote next msg id: 0
      Local req queued:  269            Remote req queued:  0
      Local window:      5              Remote window:      1
      DPD configured for 10 seconds, retry 3
      Fragmentation not configured.
      Extended Authentication not configured.
      NAT-T is not detected
      Cisco Trust Security SGT is disabled
      Assigned host addr: 172.16.122.2