Group Encrypted Transport VPN

This document is solution deployment guide for GDOI encryption in secondary network. Deployment of the following two solution test cases are covered in this document:

1. Use same GDOI policies for both primary and secondary Service Provider (SP) network paths in the Group Member (GM). PPPoE Secondary SP network path and DMVPN Secondary SP path are covered in this document.

2. Use different GDOI group for each SP network path with redundancy where even the crypto services are disjoint.

1. GETVPN Backup Network Solution Objectives

• Same GDOI (Group Domain of Interpretation) group and policies for both networks: Use same GDOI policies for both primary and secondary Service Provider (SP) network paths in the Group Member (GM). This case is required if the enterprise VPN spans both providers (e.g. Inter-Provider Inter-AS MPLS VPN). When a GM's path via the primary MPLS network fails, routes are converged in the GM, and GM uses secondary (SP) path to reach other GMs. The GM's traffic may pass through the Inter-Provider Inter-AS link to reach other GM's attached to the primary SP network. In this case, all GM use same GDOI policies on all possible paths. Encrypted traffic flow high availability is achieved via route convergence. Generally, the shortest path between two GM dual-homed to two SP networks will be via the same SP network. There are cases where one GM has a failure to the primary network while another GM has a failure to the secondary network. Traffic between these GM must pass via the Inter-provider Inter-AS link.

• Failure: Outage of a GM link to the primary SP network.

• Recovery: Route convergence and traffic flow via Secondary SP network in the GM.

• Use different GDOI group for each SP network path: This case is needed if the user wants independent redundancy where even the crypto services are disjoint. The provider VPN networks MUST be disjoint in this case. Different GDOI group is used for each SP network path in the GM. GM High Availability is achieved by triggering EEM script to filter primary network routes if crypto failure is incurred so traffic may traverse through the secondary network.

• Failure: Primary SP routes are fine. But GM is unable to register to Key Server (KS) and unable to receive rekeys from the KS. These are typically operator errors. For example pre-shared keys are not matching between KS and GM or ACL is dropping rekey packets or rekeys are not received in GM due to multicast problem.

• Recovery: After GM registration failure to the last KS, trigger EEM script to filter all primary network routes except routes to the KS. This will cause route convergence to occur and induce GM traffic to be sent via secondary SP network with different keys. This is done in order to insure the routes are revoked on the primary provider network where the crypto has failed.

2. Using GETVPN in PPPoE Secondary SP Network

2.1 Objective

• Test GDOI encryption of traffic via PPPoE network.

• Test failover of primary SP network. When primary SP network fails, traffic will flow through the secondary SP network. When the primary SP network is restored, traffic will switch back to primary SP network from the secondary SP network.

2.2 Solution Test Topology

Figure 1. Demo GETVPN Network Topology

2.3 PPPoE Secondary SP Network Configuration

2.3.1 Configuration of GM in Branch 1 (demo-gm1)

2.3.2 Configuration of GM in Branch 2 (demo-gm2)

2.3.3 Configuration of GM in Headquarters (demo-gm3)

2.3.4 Configuration of LAC in SP Network (demo-lac)

2.3.5 Configuration of LNS in SP Network (demo-lns)

2.4 PPPoE Secondary SP Network Verification

2.4.1 Verification of PPPoE Path Setup

2.4.2 Verify PPPoE Session between the Branch and LNS

2.4.3 Verify PPPoE Connectivity

2.4.4 Verify GDOI Encrypted Traffic between Branches

2.4.4.1 GDOI Encrypted Traffic between Branches Using MPLS Core

2.4.4.2 Verifying GDOI Encrypted Unicast Traffic between Branches and Headquarters Using PPPoE SP Path

2.4.4.3 Verifying GDOI Encrypted Unicast Traffic between Branches and Headquarters with Large File Transfer

2.4.4.4 Verifying Whether GM Receives Multicast Rekey

2.5 Primary Network Failover Solution Test

2.5.1 Verify Primary Network Failover

2.5.2 Verify Primary Network Recovery and Traffic Flow Switch to Primary Network

2.6 Reference Configuration of Solution Test Setup

2.6.1 Reference Configuration of demo-pe1

2.6.2 Reference Configuration of demo-gm1

2.6.3 Reference Configuration of demo-gm2

2.6.4 Reference Configuration of demo-gm3

2.6.5 Reference Configuration of demo-ks1

2.6.6 Reference Configuration of demo-ks2

2.6.7 Reference Configuration of demo-lac

2.6.8 Reference Configuration of demo-lns

3. Using GDOI Encryption in DMVPN Secondary SP Network

3.1 Objective

• Test GDOI encryption of traffic via DMVPN Tunnel network path.

• Test failover of primary SP network. When primary SP network fails, traffic will flow through the secondary SP network. When the primary SP network is restored, traffic will switch back to primary SP network from the secondary SP network.

3.2 Solution Test Topology

3.2.1 DMVPN Secondary Path Setup

Figure 2. DMVPN Secondary SP Network with GDOI Encryption in the GMs

3.3 DMVPN Secondary SP Network Configuration

3.3.1 Configuration of GM in Branch 1 (demo-gm1)

3.3.2 Configuration of GM in Branch 2 (demo-gm2)

3.3.3 Configuration of GM in Headquarters (demo-gm3)

3.3.4 Configuration of Primary KS (demo-ks1)

3.3.5 Configuration of Secondary KS (demo-ks2)

3.3.5 Configuration of demo-pe1

3.3.6 Configuration of demo-dmvpn

3.4 Verify GDOI Encrypted Traffic between Branches

3.4.1 Verify DMVPN Tunnel Operation

3.4.2 Verify GDOI Encrypted Traffic between Branches

3.5 Primary Network Failover Solution Test

3.5.1 Verify Primary Network Failover

3.5.2 Verify Primary Network Recovery and Traffic Flow Switch to Primary Network

4. Co-op KS and GM High Availability

4.1 Objective

• Test co-op KS high availability.

• Test GM high availability by using multiple GDOI groups.

4.2 Solution Test Topology

Figure 3. Demo GETVPN Network Topology with Multiple GDOI Groups

Table 1. GDOI Groups and IP Addresses of GM Interfaces

4.3 Co-op KS High Availability

4.3.1 Verifying Co-op KS High Availability

4.3.1.1 Verifying Co-op KS Messages and Rekeys Sent via Secondary Network During MPLS Outage

4.3.1.2 Verifying Co-op KS Messages and Rekeys Sent via Primary Network When MPLS Network Is Restored

4.4 GM High Availability by Using Multiple GDOI Groups

4.4.1 Create Separate GDOI Group for Each Network

4.4.2 Simulate GM Reachability Problem to Both KSs via MPLS Network

4.4.2.1 Simulate GM Registration Problem with KS

4.4.2.2 Simulate GM Not Receiving Rekeys from KS

4.4.3 Resolve Routing Problems in demo-gm1 by Blocking Routes

4.4.4 Unblock Block Routes When GM to KS Network Reachability Is Restored

5. Glossary