01-05-2009 02:34 AM
We have an cluster of 2 SSG140's. On both devices we have a interface configured to connect to the same WAN remote site. We wan't to implement a backup method of this WAN connection. Both site's have a internet connection. So we want to implement a IPSEC VPN tunnel between the two site's and use OSPF to determen the best path. I'm currently updating my knowledge about automated routing protocols, so I would probebly manage to configure this. But the question is, can OSPF be used in combination with a interface-to-interface connection and a routebased IPSEC VPN?
Does anyone have any experiance with this? Any expamples?
01-05-2009 03:53 AM
You have to use routebased vpn's with ospf enabled. If you enable ECMP (equal cost) so you can even loadbalance the traffic or as an alternative you can use different metrics to have a failover solution.
Here´s ahow to do a route-based VPN solution using the WebUI between two Netscreens:
Firewall A -> Internet -> Firewall B
- Log into Firewall A through the WebUI
Configure tunnel interface
- Click Network -> Interfaces
- Ensure the dropdown in the top left says Tunnel IF, click New
- Put it in the Untrust zone if you want all VPN traffic to pass throug my Untrust->Trust policy
- Click unnumbered and select the untrust interface
- click OK
- Configure your VPN Gateway
- Click VPNs -> AutoKey Advanced -> Gateway
- click New
- Name the gateway "FirewallB-gw"
- I always select the custom security level, you´ll see why in a following step
- Enter the public IP address of Firewall B
- Carefully enter your preshared key
- select untrust for your outgoing interface
- click advanced
- select User defined (custom)
- in the first dropdown select pre-g2-aes128-sha
- click return at the bottom
- click OK at the bottom
- Create the VPN
- on the menu on the left select VPNs -> Autokey Advanced
- click New
- name it FirewallB-vpn
- select Custom
- leave predefined checked and select your FirewallB-GW in the dropdown
- click Advanced
- select custom
- in the first dropdown, select g2-esp-aes128-sha
- turn on replay protection
- Bind to tunnel interface, and select your tunnel interface you created in step 2
- turn on VPN monitor (this will bring up the VPN right away and keep it up even when there´s no traffic on it)
- click Return
- click OK
- You need to add routes to the remote network. You can configure the tunnel interfaces to run OSPF, or you can add a static. I will tell you how to add a static.
- on the menu click Network -> Routing -> Destination
- click new
- type in the network address behind Firewall B
- Select Gateway
- Select your tunnel interface in the dropdown
- click ok
- Add your policy to allow access to/from the remote network. If you are not in NAT mode on your trust interface, make sure you check position at top when creating a Trust->Untrust rule, or it will NAT the traffic to your untrust IP or DIP pool and then send it across the tunnel, which you probably don´t want. Create an Untrust->Trust policy which allows access from the Network behind FirewallB to hosts or the network behind FirewallB. You probably want to allow Ping at a minimum.
- Repeat steps 1-6 on Firewall B. Substituting Firewall A´s data.
The VPN should pop up and everything should work. You can also use the little wizard thing, but I haven´t tried it. If you use it, I don´t think it picks the most secure cipher for P1 and P2, this is why we set this up manually. If one or both of your Netscreens is behind something that does NAT, you will also have to turn on NAT traversal on both ends.
If you don´t want static routes and want to use OSPF instead, you can create an OSPF instance under the trust VR. Make sure you add the tunnel interfaces and your internal interfaces to it, and tell it to advertise your private networks. You will then have to go under each interface that you added, and turn on OSPF. On tunnel interfaces, you can enable demand circuit and add it to the area, apply the changes, and then Enable OSPF on it.
01-11-2009 08:02 AM
That will indeed work, I've done similar setups before. For the VPNs, i would use numbered tunnel interfaces instead and terminate all vpns on a single tunnel interface on the central firewall. Manually configure the router-id on each device, add the interfaces to the OSPF area, enable OSPF on them and set the correct link-type and cost.
I don't know which version you are currently using but there is a new feature in 6.1 that might be of interest as well:
Session Rerouting Between Tunnels and Physical Interfaces—ScreenOS 6.1.0
allows the traffic to fail over between route-based VPN tunnels and physical
interfaces in the same zone when the security devices are deployed in a fully
redundant network design consisting of dynamic routing and route-based VPNs.
Without this feature, if a session that originated over an Ethernet link traverses
a VPN link (or vice versa) as a result of routing changes, traffic flow will stop,
requiring you to restart your applications. This feature reroutes the session and
avoids the need to restart applications.
10-20-2009 05:32 AM
I have a question that needs an experianced or well educated answer (actually i'll take what I can get)...
At our home office (VPN Hub Location) we have two internet connections, the primary internet connection is used as the main point of entry for about 25 to 50 tunnels terminated to an SSG140 via route based tunnels with AC-VPN and OSPF configured (works well by the way).
The spokes are SSG5's with Route based tunnels, AC-VPN and OSPF configured as well.
Both SSG140's and SSG5's have 6.1.0R6. We run Ayaya IP phones, Gateways and Citrix at these remote spoke locations so up time is important.
We just put in a backup internet connection and purchased a new spare SSG140 and we're ready to start some sort of implementation.
What is the best way to implement rendant connectivity with what we have (Spare SSG140 and a Spare Internet Connection)?
10-20-2009 09:50 AM - edited 10-20-2009 09:51 AM
Make sure they are the same firmware version! 6.1r6 will work great.
10-20-2009 01:48 PM
Thanks for your reply.
I'm aware of the failover abilities IE:active/passive of the ssg140. That's not what I was referring to.
I was hoping for the best way to fail over automatically to another set of tunnels on the spare internet connection without loosing sessions.
I'd appreciate any ideas to build off of.