IPsec Hub-to-Spoke VPN
In an IPsec hub-to-spoke deployment, spokes communicate with each other by way of the hub router (there is no direct communication). One IPsec tunnel is stitched from each spoke to the hub. During spoke-to-spoke communication, the hub receives traffic from one spoke over one IPsec tunnel and forwards the traffic to another spoke over another IPsec tunnel. As shown in the following figure, when Router1 and Router2 (spokes) want to communicate, Router4 (hub) receives traffic from Router1 over IPsec Tunnel 1 and forwards it to Router2 over IPsec Tunnel 2. From the hub (Router4) perspective, this is also referred to as tunnel stitching.
Note: Tunnel endpoints may be multiple hops away and the base path reachable over any interior gateway protocols such as static routing, RIP, OSPF, BGP, and so on.
Note: The Ruckus ICX 7450 has a 50 percent performance degradation when used in a tunnel stitching deployment.
Configurations
In the following configuration example, the IPsec tunnels are running in the user VRF (vrf1) and the base path is in the default VRF. In this case, the IGP running in the basepath is OSPF.
Router1(config)# router ospf Router1(config-router-ospf-vrf-default-vrf)# area 0 Router1(config-router-ospf-vrf-default-vrf)# exit Router1(config)# interface loopback 1 Router1(config-lbif-1)# ip address 10.100.100.1 255.255.255.255 Router1(config-lbif-1)# ip ospf area 0 Router1(config-lbif-1)# exit Router1(config)# ikev2 proposal ikev2_propA Router1(config-ike-proposal-ikev2_propA)# exit Router1(config)# ikev2 auth-proposal ikev2_auth_propA Router1(config-ike-auth-proposal-ikev2_auth_propA)# pre-shared-key ps_key Router1(config-ike-auth-proposal-ikev2_auth_propA)# exit Router1(config)# ikev2 policy ikev2_policyA Router1(config-ike-policy-ikev2_policyA)# proposal ikev2_proposal Router1(config-ike-policy-ikev2_policyA)# match address-local 10.100.100.1 255.255.255.255 Router1(config-ike-policy-ikev2_policyA)# exit Router1(config)# ikev2 profile ikev2_profA Router1(config-ike-profile-ikev2_profA)# authentication ikev2_auth_propA Router1(config-ike-profile-ikev2_profA)# local-identifier address 10.1.1.1 Router1(config-ike-profile-ikev2_profA)# remote-identifier address 10.4.4.4 Router1(config-ike-profile-ikev2_profA)# match-identity local address 10.1.1.1 Router1(config-ike-profile-ikev2_profA)# match-identity remote address 10.4.4.4 Router1(config-ike-profile-ikev2_profA)# exit Router1(config)# ipsec proposal ipsec_propA Router1(config-ipsec-proposal-ipsec_propA)# exit Router1(config)# ipsec profile ipsec_profA Router1(config-ipsec-profile-ipsec_profA)# proposal ipsec_propA Router1(config-ipsec-profile-ipsec_profA)# ike-profile ikev2_profA Router1(config-ipsec-profile-ipsec_profA)# exit Router1(config)# interface tunnel 1 Router1(config-tnif-1)# vrf forwarding vrf1 Router1(config-tnif-1)# tunnel mode ipsec ipv4 Router1(config-tnif-1)# tunnel protection ipsec profile ipsec_profA Router1(config-tnif-1)# tunnel source loopback 1 Router1(config-tnif-1)# tunnel destination 10.100.100.4 Router1(config-tnif-1)# ip address 10.11.1.1 255.255.255.252 Router1(config-tnif-1)# exit
Router2(config)# router ospf Router2(config-router-ospf-vrf-default-vrf)# area 0 Router2(config-router-ospf-vrf-default-vrf)# end Router2(config)# interface loopback 1 Router2(config-lbif-1)# ip address 10.100.100.2 255.255.255.255 Router2(config-lbif-1)# ip ospf area 0 Router2(config-lbif-1)# exit Router2(config)# ikev2 proposal ikev2_propA Router2(config-ike-proposal-ikev2_propA)# exit Router2(config)# ikev2 auth-proposal ikev2_auth_propA Router2(config-ike-auth-proposal-ikev2_auth_propA)# pre-shared-key ps_key Router2(config-ike-auth-proposal-ikev2_auth_propA)# exit Router2(config)# ikev2 policy ikev2_policyA Router2(config-ike-policy-ikev2_policyA)# proposal ikev2_proposal Router2(config-ike-policy-ikev2_policyA)# match address-local 10.100.100.2 255.255.255.255 Router2(config-ike-policy-ikev2_policyA)# exit Router2(config)# ikev2 profile ikev2_profA Router2(config-ike-profile-ikev2_profA)# authentication ikev2_auth_propA Router2(config-ike-profile-ikev2_profA)# local-identifier address 10.2.2.2 Router2(config-ike-profile-ikev2_profA)# remote-identifier address 10.4.4.4 Router2(config-ike-profile-ikev2_profA)# match-identity local address 10.2.2.2 Router2(config-ike-profile-ikev2_profA)# match-identity remote address 10.4.4.4 Router2(config-ike-profile-ikev2_profA)# exit Router2(config)# ipsec proposal ipsec_propA Router2(config-ipsec-proposal-ipsec_propA)# exit Router2(config)# ipsec profile ipsec_profA Router2(config-ipsec-profile-ipsec_profA)# proposal ipsec_propA Router2(config-ipsec-profile-ipsec_profA)# ike-profile ikev2_profA Router2(config-ipsec-profile-ipsec_profA)# exit Router2(config)# interface tunnel 1 Router2(config-tnif-1)# vrf forwarding vrf1 Router2(config-tnif-1)# tunnel mode ipsec ipv4 Router2(config-tnif-1)# tunnel protection ipsec profile ipsec_profA Router2(config-tnif-1)# tunnel source loopback 1 Router2(config-tnif-1)# tunnel destination 10.100.100.4 Router2(config-tnif-1)# ip address 10.12.1.1 255.255.255.252 Router2(config-tnif-1)# exit
Router3(config)# router ospf Router3(config-router-ospf-vrf-default-vrf)# area 0 Router3(config-router-ospf-vrf-default-vrf)# end Router3(config)# interface loopback 1 Router3(config-lbif-1)# ip address 10.100.100.3 255.255.255.255 Router3(config-lbif-1)# ip ospf area 0 Router3(config-lbif-1)# exit Router3(config)# ikev2 proposal ikev2_propA Router3(config-ike-proposal-ikev2_propA)# exit Router3(config)# ikev2 auth-proposal ikev2_auth_propA Router3(config-ike-auth-proposal-ikev2_auth_propA)# pre-shared-key ps_key Router3(config-ike-auth-proposal-ikev2_auth_propA)# exit Router3(config)# ikev2 policy ikev2_policyA Router3(config-ike-policy-ikev2_policyA)# proposal ikev2_proposal Router3(config-ike-policy-ikev2_policyA)# match address-local 10.100.100.3 255.255.255.255 Router3(config-ike-policy-ikev2_policyA)# exit Router3(config)# ikev2 profile ikev2_profA Router3(config-ike-profile-ikev2_profA)# authentication ikev2_auth_propA Router3(config-ike-profile-ikev2_profA)# local-identifier address 10.3.3.3 Router3(config-ike-profile-ikev2_profA)# remote-identifier address 10.4.4.4 Router3(config-ike-profile-ikev2_profA)# match-identity local address 10.3.3.3 Router3(config-ike-profile-ikev2_profA)# match-identity remote address 10.4.4.4 Router3(config-ike-profile-ikev2_profA)# exit Router3(config)# ipsec proposal ipsec_propA Router3(config-ipsec-proposal-ipsec_propA)# exit Router3(config)# ipsec profile ipsec_profA Router3(config-ipsec-profile-ipsec_profA)# proposal ipsec_propA Router3(config-ipsec-profile-ipsec_profA)# ike-profile ikev2_profA Router3(config-ipsec-profile-ipsec_profA)# exit Router3(config)# interface tunnel 1 Router3(config-tnif-1)# vrf forwarding vrf1 Router3(config-tnif-1)# tunnel mode ipsec ipv4 Router3(config-tnif-1)# tunnel protection ipsec profile ipsec_profA Router3(config-tnif-1)# tunnel source loopback 1 Router3(config-tnif-1)# tunnel destination 10.100.100.4 Router3(config-tnif-1)# ip address 10.13.1.1 255.255.255.252 Router3(config-tnif-1)# exit
Note: Router4, which is performing IPsec tunnel stitching, can be any device that supports IPsec. The following example shows how to configure Router4 when the device is a Ruckus ICX 7450 switch.
Router4(config)# router ospf Router4(config-router-ospf-vrf-default-vrf)# area 0 Router4(config-router-ospf-vrf-default-vrf)# end Router4(config)# interface loopback 1 Router4(config-lbif-1)# ip address 10.100.100.4 255.255.255.255 Router4(config-lbif-1)# exit Router4(config)# ikev2 proposal ikev2_propA Router4(config-ike-proposal-ikev2_propA)# exit Router4(config)# ikev2 auth-proposal ikev2_auth_propB Router4(config-ike-auth-proposal-ikev2_auth_propB)# pre-shared-key ps_key Router4(config-ike-auth-proposal-ikev2_auth_propB)# exit Router4(config)# ikev2 auth-proposal ikev2_auth_propC Router4(config-ike-auth-proposal-ikev2_auth_propC)# pre-shared-key ps_key Router4(config-ike-auth-proposal-ikev2_auth_propC)# exit Router4(config)# ikev2 auth-proposal ikev2_auth_propD Router4(config-ike-auth-proposal-ikev2_auth_propD)# pre-shared-key ps_key Router4(config-ike-auth-proposal-ikev2_auth_propD)# exit Router4(config)# ikev2 policy ikev2_policyA Router4(config-ike-policy-ikev2_policyA)# proposal ikev2_propA Router4(config-ike-policy-ikev2_policyA)# match address-local 10.100.100.4 255.255.255.255 Router4(config-ike-policy-ikev2_policyA)# exit Router4(config)# ikev2 profile ikev2_profB Router4(config-ike-profile-ikev2_profB)# authentication ikev2_auth_propB Router4(config-ike-profile-ikev2_profB)# local-identifier address 10.4.4.4 Router4(config-ike-profile-ikev2_profB)# remote-identifier address 10.1.1.1 Router4(config-ike-profile-ikev2_profB)# match-identity local address 10.4.4.4 Router4(config-ike-profile-ikev2_profB)# match-identity remote address 10.1.1.1 Router4(config-ike-profile-ikev2_profB)# exit Router4(config)# ikev2 profile ikev2_profC Router4(config-ike-profile-ikev2_profC)# authentication ikev2_auth_propC Router4(config-ike-profile-ikev2_profC)# local-identifier address 10.4.4.4 Router4(config-ike-profile-ikev2_profC)# remote-identifier address 10.2.2.2 Router4(config-ike-profile-ikev2_profC)# match-identity local address 10.4.4.4 Router4(config-ike-profile-ikev2_profC)# match-identity remote address 10.2.2.2 Router4(config-ike-profile-ikev2_profC)# exit Router4(config)# ikev2 profile ikev2_profD Router4(config-ike-profile-ikev2_profD)# authentication ikev2_auth_propD Router4(config-ike-profile-ikev2_profD)# local-identifier address 10.4.4.4 Router4(config-ike-profile-ikev2_profD)# remote-identifier address 10.3.3.3 Router4(config-ike-profile-ikev2_profD)# match-identity local address 10.4.4.4 Router4(config-ike-profile-ikev2_profD)# match-identity remote address 10.3.3.3 Router4(config-ike-profile-ikev2_profD)# exit Router4(config)# ipsec proposal ipsec_propA Router4(config-ipsec-proposal-ipsec_propA)# exit Router4(config)# ipsec profile ipsec_profB Router4(config-ipsec-profile-ipsec_profB)# proposal ipsec_propA Router4(config-ipsec-profile-ipsec_profB)# ike-profile ikev2_profB Router4(config-ipsec-profile-ipsec_profB)# exit Router4(config)# ipsec profile ipsec_profC Router4(config-ipsec-profile-ipsec_profC)# proposal ipsec_propA Router4(config-ipsec-profile-ipsec_profC)# ike-profile ikev2_profC Router4(config-ipsec-profile-ipsec_profC)# exit Router4(config)# ipsec profile ipsec_profD Router4(config-ipsec-profile-ipsec_profD)# proposal ipsec_propA Router4(config-ipsec-profile-ipsec_profD)# ike-profile ikev2_profD Router4(config-ipsec-profile-ipsec_profD)# exit Router4(config)# interface tunnel 1 Router4(config-tnif-1)# vrf forwarding vrf1 Router4(config-tnif-1)# tunnel mode ipsec ipv4 Router4(config-tnif-1)# tunnel protection ipsec profile ipsec_profB Router4(config-tnif-1)# tunnel source loopback 1 Router4(config-tnif-1)# tunnel destination 10.100.100.1 Router4(config-tnif-1)# ip address 10.11.1.2 255.255.255.252 Router4(config-tnif-1)# exit Router4(config)# interface tunnel 2 Router4(config-tnif-2)# vrf forwarding vrf1 Router4(config-tnif-2)# tunnel mode ipsec ipv4 Router4(config-tnif-2)# tunnel protection ipsec profile ipsec_profC Router4(config-tnif-2)# tunnel source loopback 1 Router4(config-tnif-2)# tunnel destination 10.100.100.2 Router4(config-tnif-2)# ip address 10.12.1.2 255.255.255.252 Router4(config-tnif-2)# exit Router4(config)# interface tunnel 3 Router4(config-tnif-3)# vrf forwarding vrf1 Router4(config-tnif-3)# tunnel mode ipsec ipv4 Router4(config-tnif-3)# tunnel protection ipsec profile ipsec_profD Router4(config-tnif-3)# tunnel source loopback 1 Router4(config-tnif-3)# tunnel destination 10.100.100.3 Router4(config-tnif-3)# ip address 10.13.1.2 255.255.255.252 Router4(config-tnif-3)# exit