{"id":745,"date":"2012-11-14T12:19:19","date_gmt":"2012-11-14T11:19:19","guid":{"rendered":"http:\/\/diablo.craem.net\/wordpress\/?p=745"},"modified":"2012-11-14T12:19:19","modified_gmt":"2012-11-14T11:19:19","slug":"ipsec-over-gre-ospf-mikrotik-vs-cisco-parte-1","status":"publish","type":"post","link":"https:\/\/diablo.craem.net\/?p=745","title":{"rendered":"Ipsec Over GRE + ospf mikrotik vs Cisco, parte 1"},"content":{"rendered":"

Hoy toca una entrada de las que me ha costado m\u00e1s de elaborar.
\nTengo bastantes routers cisco en los clientes y la mayor\u00ed\u00ada de vpn’s (m\u00e1s de 50), las tengo con ipsec over GRE y EIGRP…. de esta manera, todas las sedes se ven entre ellas y no me tengo que preocupar de las rutas.
\nLa idea, es montar routers mikrotik virtuales y aprovechar el espacio, ahorrar corriente, etc..
\nEl escenario que propongo es sencillo:
\n\"\"<\/a>
\nTenemos en un lado, la red local: 192.168.80.0\/24 y en el otro extremo, la red 192.168.2.0\/24.
\nLa red que usaremos para el tunel, ser\u00e1: 172.30.0.0\/30.
\nEmpezamos con la configuraci\u00f3n del router cisco:
\n
\ncrypto isakmp policy 10
\n encr 3des
\n hash md5
\n authentication pre-share
\n group 2
\n lifetime 3600
\ncrypto isakmp key superClave address 1.1.1.1 no-xauth
\ncrypto ipsec transform-set trans_3des esp-3des esp-md5-hmac
\n mode transport
\n!
\ncrypto ipsec profile mikro
\n set transform-set trans_3des
\n<\/code>
\nColocaremos ipsec en modo transporte para no perder la informaci\u00f3n de routing, entre otras cosas y nos creamos un profile para el tunel con la mikrotik.
\nCreamos en Tunel GRE:
\n
\ninterface Tunnel5
\n description CONNECTED TO oficina mikrtik
\n ip address 172.30.0.1 255.255.255.252
\n ip mtu 1476
\n tunnel source FastEthernet0\/0
\n tunnel destination 1.1.1.1
\n tunnel protection ipsec profile mikro
\n<\/code>
\nY configuramos OSPF, con las \u00e1reas:
\n
\nrouter ospf 10
\n log-adjacency-changes
\n redistribute static subnets
\n network 192.168.2.0 0.0.0.255 area 0
\n network 172.30.0.0 0.0.0.3 area 0
\n<\/code>
\nY por \u00faltimo, la ruta est\u00e1tica (de momento no me funciona de otra manera), con la red remota:
\n
\ncisco(conf-if)# ip route 192.168.80.0 255.255.255.0 tunnel 5
\n<\/code>
\nY ahora vamos por la mikrotik:
\n
\n\/interface ethernet
\n\/interface gre
\nadd disabled=no dscp=0 l2mtu=65535 local-address=1.1.1.1 mtu=1476
\n name=tunnel5 remote-address=2.2.2.2
\n\/ip ipsec proposal
\nset [ find default=yes ] auth-algorithms=sha1 disabled=no enc-algorithms=3des
\n lifetime=30m name=default pfs-group=modp1024
\nadd auth-algorithms=md5 disabled=no enc-algorithms=3des lifetime=59m59s name=
\n cisco pfs-group=none
\n\/routing ospf instance
\nset [ find default=yes ] disabled=no distribute-default=never in-filter=
\n ospf-in metric-bgp=auto metric-connected=20 metric-default=1
\n metric-other-ospf=auto metric-rip=20 metric-static=20 name=default
\n out-filter=ospf-out redistribute-bgp=no redistribute-connected=as-type-1
\n redistribute-other-ospf=as-type-1 redistribute-rip=no
\n redistribute-static=as-type-1 router-id=0.0.0.0
\n\/routing ospf area
\nset [ find default=yes ] area-id=0.0.0.0 disabled=no instance=default name=
\n backbone type=default
\nadd area-id=192.168.80.0 disabled=no instance=default name=area11 type=
\n default
\n\/routing ospf-v3 instance
\nset [ find default=yes ] disabled=no distribute-default=never metric-bgp=auto
\n metric-connected=20 metric-default=1 metric-other-ospf=auto metric-rip=20
\n metric-static=20 name=default redistribute-bgp=no redistribute-connected=
\n no redistribute-other-ospf=no redistribute-rip=no redistribute-static=no
\n router-id=0.0.0.0
\n\/ip address
\nadd address=192.168.80.254\/24 comment=\"added by setup\" disabled=no interface=
\n ether1_lan network=192.168.80.0
\nadd address=1.1.1.1\/32 disabled=no interface=public_interface network=
\n 1.1.1.1
\nadd address=172.30.0.2\/30 disabled=no interface=tunnel5 network=172.30.0.0
\n\/ip dhcp-server config
\nset store-leases-disk=5m
\n\/ip ipsec peer
\nadd address=2.2.2.2\/32 auth-method=pre-shared-key comment=
\n \"tunel IPSEC pruebas angel\" dh-group=modp1024 disabled=no dpd-interval=2m
\n dpd-maximum-failures=5 enc-algorithm=3des exchange-mode=main
\n generate-policy=no hash-algorithm=md5 lifebytes=0 lifetime=1d
\n my-id-user-fqdn=\"\" nat-traversal=no port=500 proposal-check=obey secret=
\n superClave send-initial-contact=yes
\n\/ip ipsec policy
\nadd action=encrypt disabled=no dst-address=2.2.2.2\/32 dst-port=any
\n ipsec-protocols=esp level=require priority=0 proposal=cisco protocol=47
\n sa-dst-address=2.2.2.2 sa-src-address=1.1.1.1 src-address=
\n 1.1.1.1\/32 src-port=any tunnel=no
\n\/ip neighbor discovery
\nset ether1_lan disabled=no
\nset public_interface disabled=no
\nset tunnel5 disabled=yes
\n\/ip route
\nadd comment=\"added by setup\" disabled=no distance=1 dst-address=0.0.0.0\/0
\n gateway=1.1.1.2 scope=30 target-scope=10
\n\/routing filter
\nadd action=accept chain=ospf-out disabled=no distance=1 invert-match=no
\n prefix=192.168.80.0\/24 protocol=connect,ospf set-bgp-prepend-path=\"\"
\n\/routing igmp-proxy
\nset query-interval=2m5s query-response-interval=10s quick-leave=no
\n\/routing mme
\nset bidirectional-timeout=2 gateway-class=none gateway-keepalive=1m
\n gateway-selection=no-gateway origination-interval=5s preferred-gateway=
\n 0.0.0.0 timeout=1m ttl=50
\n\/routing ospf area range
\nadd advertise=yes area=area11 cost=calculated disabled=no range=
\n 192.168.80.0\/24
\n\/routing ospf interface
\nadd authentication=none authentication-key=\"\" authentication-key-id=1 cost=10
\n dead-interval=40s disabled=no hello-interval=10s instance-id=0 interface=
\n all network-type=broadcast passive=no priority=1 retransmit-interval=5s
\n transmit-delay=1s use-bfd=no
\nadd authentication=none authentication-key=\"\" authentication-key-id=1 cost=10
\n dead-interval=40s disabled=no hello-interval=10s instance-id=0 interface=
\n public_interface network-type=broadcast passive=yes priority=1
\n retransmit-interval=5s transmit-delay=1s use-bfd=no
\n\/routing ospf network
\nadd area=backbone comment=\"local lan\" disabled=no network=192.168.80.0\/24
\nadd area=backbone comment=\"tunnel 5 network\" disabled=no network=
\n 172.30.0.0\/30
\n\/system clock
\nset time-zone-name=Europe\/Madrid
\n\/system clock manual
\nset dst-delta=+00:00 dst-end=\"jan\/01\/1970 00:00:00\" dst-start=
\n \"jan\/01\/1970 00:00:00\" time-zone=+00:00
\nset name=cpd_router
\n\/system lcd
\nset contrast=0 enabled=no port=parallel type=24x4
\nset enabled=yes mode=unicast primary-ntp=130.206.3.166 secondary-ntp=
\n 130.206.3.166
\n\/system ntp server
\nset broadcast=no broadcast-addresses=\"\" enabled=no manycast=yes multicast=no
\n<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

Hoy toca una entrada de las que me ha costado m\u00e1s de elaborar. Tengo bastantes routers cisco en los clientes y la mayor\u00ed\u00ada de vpn’s (m\u00e1s de 50), las tengo con ipsec over GRE y EIGRP…. de esta manera, todas las sedes se ven entre ellas y no me tengo que preocupar de las rutas. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,8],"tags":[41,91,107,137],"class_list":["post-745","post","type-post","status-publish","format-standard","hentry","category-cisco","category-varios","tag-cisco","tag-ipsec","tag-mikrotik","tag-ospf"],"_links":{"self":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts\/745","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=745"}],"version-history":[{"count":0,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts\/745\/revisions"}],"wp:attachment":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}