IPSEC over SPA module on 7613 router

Unanswered Question
Jan 18th, 2010
User Badges:

Hi All,

                  I have 7613 router with Services SPA Carrier-400 module. I want to implement IPSEC over this, I m running BGP over P2P and MPLS links. Anyone , plz let me know about the configuration of this , I m not aware of it.



thanx and regards,

taran

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Jon Marshall Mon, 01/18/2010 - 03:38
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

tarnhundal wrote:


Hi All,

                  I have 7613 router with Services SPA Carrier-400 module. I want to implement IPSEC over this, I m running BGP over P2P and MPLS links. Anyone , plz let me know about the configuration of this , I m not aware of it.



thanx and regards,

taran


Taran


Start with this doc and come back if you have further questions -


http://www.cisco.com/en/US/docs/interfaces_modules/shared_port_adapters/configuration/6500series/76ovwvpn.html


Jon

Giuseppe Larosa Mon, 01/18/2010 - 05:41
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Taran,

as pointed out by Jon in a high end platform like 7613 you need the right hardware: you need the specific IPSEC SPA to be installed in the SIP module or you cannot use IPSec on the device


you can install an IPSEC SPA module on SIP-400 according to table 20-5


Table 20-5     SIP and SSC Support for the IPsec VPN SPA by Release 

Line Card or Module
Cisco IOS Release 12.2
SXF
SXH
SXI

7600-SIP-200

Y

Y

Y

7600-SIP-400

Y

Y

Y

7600-SIP-600

N

N1

Y

7600-SSC-400

Y

Y

Y



1 Platform support for the 7600-SIP-600 is removed in Cisco IOS Release 12.2(33)SXH and restored in Cisco IOS Release 12.2(33)SXI and later releases.



Hope to help

Giuseppe

tarnhundal Mon, 01/18/2010 - 23:53
User Badges:

Hi,

              I m using Services SPA Carrier-400 .But bit doubtful about the configuration . what u say if I wll try to configure it with SDM .



thanx and regards,

Taran

Giuseppe Larosa Tue, 01/19/2010 - 06:56
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Taran,

I don't think SDM supports IPSEC SPA configuration, but I'm a CLI adept.

Read carefully the configuration chapter provided by Jon, then try to describe an example of IPSec protection that you would like to implement.


Hope to help

Giuseppe

tarnhundal Tue, 01/19/2010 - 08:32
User Badges:

HI,

       Thanx for reply. Me too also cli guy but i was thinking that sdm may be fine but wll now go with cli and i m bit doubtful about my conf because i m running bgp over my all links including mpls and p2p. let me try that and if u have some conf in ur mind then plz help me because i m not much familiar with this concept in core.


thanx and regards,

Taran

tarnhundal Fri, 01/22/2010 - 04:08
User Badges:

HI ,

            Actually I m doubtfull about conf. Because we are having mpls connectivity like hub and spokes , means one site is connected to 20 sites and all those sites also access data between each other without reaching hub location.we are at client site and now we have P2P links to all those sites. All sites running BGP between themselves. So according to our requirements we have to implement ipsec over gre. I m not sure about it.



Thanx and Regards,

Taran

Giuseppe Larosa Fri, 01/22/2010 - 05:30
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Taran,

it is not clear you have an MPLS L3 VPN service or an MPLS L2 VPN service with point-to-point links


>> all those sites also access data between each other without reaching hub location.


this can be a L3 VPN with basic any-to-any  connectivity or a L2 VPLS


>> now we have P2P links to all those sites


this is more similar to L2 VPN point-to-point service or are these for backup?


In anycase the notes are:


if you have an MPLS L3 VPN and you only to implement hub and spoke (you don't want remote sites to talk directly) this can be done by service provider with few changes on its side.


if you really need encryption you should consider DMVPN that combines IPSec and multipoint GRE to achieve better scalability


http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/DMVPDG.html


the idea is to protect=encrypt traffic between LAN IP subnets of central site and remote sites.

BGP should be used to advertise IPSec endpoints and non secure subnets (if any)


Edit:

I've checked that DMVPN phase2 is supported on the IPSEC SPA.

to implement a true hub and spoke without spoke to spoke dynamic tunnels the best choice is to use EIGRP over the virtual lan segment created by multipoint GRE


Hope to help

Giuseppe

tarnhundal Fri, 01/22/2010 - 08:24
User Badges:

Hi,

         Thanx for instant reply. Actually , we are running BGP peering with ISP at all sites even on the core.But i just mentioned that its like as hub and spoke but not acting like this because all other sites even connecting with core site but those can reach each other without going to core and now we have p2p links to all those sites also running BGP . these are for load sharing and redundancy. I m thinking about DMVPN but bit confused about its conf and working . What u say about it?




thanx and regards,

Taran

Giuseppe Larosa Fri, 01/22/2010 - 10:16
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Taran,

a minimal lab to test and learn DMVPN would require three routers, one acting as hub and other two that are your spokes.

To simplify your setup you can use a shared key.


http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008014bcd7.shtml


this may be of help in setting up the lab.


Later, you can try to add the IPSec SPA to the picture and to use a CA server (to use certificates)


if  you are new to IPSec a preliminary step may be to perform a lab with point-to-point GRE over IPSec


http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008009438e.shtml


this document provides you examples of point to point GRE protected by IPSec and using EIGRP.

This should be used for comparison and also can be considered a possible design if there are only 20 sites, and you don't need spoke to spoke communication.

This may be more familiar to you.



Hope ot help

Giuseppe

tarnhundal Sat, 01/23/2010 - 01:00
User Badges:

Hi, 

            Thanx for reply, The link of DMVPN url was too good. But i have some confusions.I m running BGP on all sites and the other thing is each site communicates with other sites without reaching core site or we can say HUB site. On each site i have different IP scheme. I think it wll work even i wll implement this with BGP, I dont think there is any need to implement to other protocol like Eigrp. And also doubtful that when i wll implement IPSEC over GRE then it can create reachability issues, will any site lose connectivity while implementing this because i have to do all of this on live project.



thanx and regards,

Taran

Actions

This Discussion