ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    VPN communication through ERX to different subnet

    IT Discussion
    edgeos vpn
    3
    19
    2.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JaredBuschJ
      JaredBusch @AdamF
      last edited by

      @fuznutz04 said in VPN communication through ERX to different subnet:

      So I should add another config line like this in the ERX?
      set vpn ipsec site-to-site peer AZURE IP tunnel 100 local prefix 10.0.1.0/24 ?

      Current one is: set vpn ipsec site-to-site peer AZURE IP tunnel 100 local prefix 10.0.0.0/24

      New tunnel.

      set vpn ipsec site-to-site peer XXX.XXX.XXX.XXX tunnel 1 allow-nat-networks disable
set vpn ipsec site-to-site peer XXX.XXX.XXX.XXX tunnel 1 allow-public-networks disable
set vpn ipsec site-to-site peer XXX.XXX.XXX.XXX tunnel 1 esp-group FOO3
set vpn ipsec site-to-site peer XXX.XXX.XXX.XXX tunnel 1 local prefix 10.254.103.0/24
set vpn ipsec site-to-site peer XXX.XXX.XXX.XXX tunnel 1 remote prefix 10.201.1.0/24
set vpn ipsec site-to-site peer XXX.XXX.XXX.XXX tunnel 2 allow-nat-networks disable
set vpn ipsec site-to-site peer XXX.XXX.XXX.XXX tunnel 2 allow-public-networks disable
set vpn ipsec site-to-site peer XXX.XXX.XXX.XXX tunnel 2 esp-group FOO3
set vpn ipsec site-to-site peer XXX.XXX.XXX.XXX tunnel 2 local prefix 10.254.103.0/24
set vpn ipsec site-to-site peer XXX.XXX.XXX.XXX tunnel 2 remote prefix 10.201.5.0/24
      1 Reply Last reply Reply Quote 0
      • AdamFA
        AdamF
        last edited by

        So in attempting to do that, I seemed to have broken the first tunnel. I reverted back to just my old config by deleting the additional tunnel commands and restarting vpn services. The tunnel appears to be up, but no no traffic is flowing. I have this lingering feeling that a reboot of the ERX would fix it, but cant restart it at the moment.

        JaredBuschJ 1 Reply Last reply Reply Quote 0
        • JaredBuschJ
          JaredBusch @AdamF
          last edited by JaredBusch

          @fuznutz04

          Linux ubnt 3.10.20-UBNT #1 SMP Fri Jul 29 16:51:50 PDT 2016 mips64
Welcome to EdgeOS
Last login: Mon Aug 29 11:34:35 2016 from dt-jared
jbusch@jared:~$ sudo ipsec restart
Stopping strongSwan IPsec...
Starting strongSwan 5.2.2 IPsec [starter]...
jbusch@jared:~$
          AdamFA 1 Reply Last reply Reply Quote 0
          • DashrenderD
            Dashrender
            last edited by

            did you add the route to Azure that JB mentioned?

            1 Reply Last reply Reply Quote 0
            • AdamFA
              AdamF @JaredBusch
              last edited by

              @JaredBusch Unfortunately, that didn't work. But now I have another command for the toolbox. so thanks!

              Additionally, after a reboot, the tunnel comes back up, but still not pinging. So basically, I broke the existing tunnel and although the tunnel comes up, no communication.

              The below is the exact configuration that I backed up right before I started making changes today.

              set vpn ipsec auto-firewall-nat-exclude enable
set vpn ipsec disable-uniqreqids
set vpn ipsec esp-group esp-azure compression disable
set vpn ipsec esp-group esp-azure lifetime 3600
set vpn ipsec esp-group esp-azure mode tunnel
set vpn ipsec esp-group esp-azure pfs disable
set vpn ipsec esp-group esp-azure proposal 1 encryption aes256
set vpn ipsec esp-group esp-azure proposal 1 hash sha1
set vpn ipsec ike-group ike-azure ikev2-reauth no
set vpn ipsec ike-group ike-azure key-exchange ikev2
set vpn ipsec ike-group ike-azure lifetime 28800
set vpn ipsec ike-group ike-azure proposal 1 dh-group 2
set vpn ipsec ike-group ike-azure proposal 1 encryption aes256
set vpn ipsec ike-group ike-azure proposal 1 hash sha1
set vpn ipsec ipsec-interfaces interface eth0
set vpn ipsec nat-networks allowed-network 0.0.0.0/0
set vpn ipsec nat-traversal enable
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx authentication mode pre-shared-secret
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx authentication pre-shared-secret blahblah
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx connection-type initiate
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx default-esp-group esp-azure
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx ike-group ike-azure
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx ikev2-reauth inherit
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx local-address xxx.xxx.xxx.xxx
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx tunnel 100 allow-nat-networks disable
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx tunnel 100 allow-public-networks disable
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx tunnel 100 esp-group esp-azure
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx tunnel 100 local prefix 10.0.0.0/24
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx tunnel 100 protocol all
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx tunnel 100 remote prefix 172.16.2.0/24

              My local net is 10.0.0.0/24
              My server in Azure is on the 172.16.2.0/24 network.

              1 Reply Last reply Reply Quote 0
              • DashrenderD
                Dashrender
                last edited by

                Can you show us the route commands both in Azure and the ERX?

                AdamFA 1 Reply Last reply Reply Quote 0
                • AdamFA
                  AdamF @Dashrender
                  last edited by

                  @Dashrender I didnt' setup any specific routes in Azure previously. I just started playing with Azure not long ago, so I'm not even sure where to show any existing routes. As far as the ERX routes, if I do a "show IP route table all", one of the routes pertains to my Azure network:

                   show ip route table  all
172.16.2.0/28 via PUBLIC.IP dev eth0  table 220  proto static  src 10.0.0.1 default via PUBLIC.IP dev eth0  proto zebra
                  1 Reply Last reply Reply Quote 0
                  • AdamFA
                    AdamF
                    last edited by

                    Progress... So deleting the entire tunnel from the ERX completely, as well as removing the gateway/public IP from Azure, and then re-creating a new one, with a new IP, solved the issue. As soon as the tunnel was created, traffic started flowing. Feels like something was either "stuck" on the ERX with the old config, or it was something on the Azure side.

                    In any case, now I'll attempt to create another tunnel to solve the original problem in the OP.

                    1 Reply Last reply Reply Quote 2
                    • DashrenderD
                      Dashrender
                      last edited by

                      How do you tell Azure to send traffic destined for the other side of the VPN to the gateway in question?

                      AdamFA 1 Reply Last reply Reply Quote 1
                      • AdamFA
                        AdamF @Dashrender
                        last edited by

                        @Dashrender

                        There are no specific "rules" that I set in Azure for traffic flow. I can tell you how I set it up though. I'll outline it below but plan on doing a write up guide here on the site for others.

                        Basic step:

                        1. Created a local Vnet for your on premise network. This is where you supply your public IP of your on premise device (in my case, the ERX) as well as the local network prefix. (in my case, 10.0.0.0/24)
                        2. Created a Vnet in Azure with address space of 172.16.0.0/16
                        3. Created a Subnet within that Vnet for my servers with an address space of 172.16.2.0/24
                        4. Created a "Gateway Subnet" within the Vnet. This is required for the next step, and the name must not be changed.
                        5. Create a Virtual Network Gateway. Type is VPN, and choose Route Based. Choose to create a new public IP. This step takes nearly an hour.
                        6. Once completed, you go into that Virtual Network Gateway and create an IPSEC connection to your local Vnet from step 1.
                        7. Then on your ERX, you configure it using the config below:
                        set vpn ipsec auto-firewall-nat-exclude enable
set vpn ipsec disable-uniqreqids
set vpn ipsec esp-group esp-azure compression disable
set vpn ipsec esp-group esp-azure lifetime 3600
set vpn ipsec esp-group esp-azure mode tunnel
set vpn ipsec esp-group esp-azure pfs disable
set vpn ipsec esp-group esp-azure proposal 1 encryption aes256
set vpn ipsec esp-group esp-azure proposal 1 hash sha1
set vpn ipsec ike-group ike-azure ikev2-reauth no
set vpn ipsec ike-group ike-azure key-exchange ikev2
set vpn ipsec ike-group ike-azure lifetime 28800
set vpn ipsec ike-group ike-azure proposal 1 dh-group 2
set vpn ipsec ike-group ike-azure proposal 1 encryption aes256
set vpn ipsec ike-group ike-azure proposal 1 hash sha1
set vpn ipsec ipsec-interfaces interface eth0
set vpn ipsec nat-networks allowed-network 0.0.0.0/0
set vpn ipsec nat-traversal enable
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx authentication mode pre-shared-secret
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx authentication pre-shared-secret blahblah
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx connection-type initiate
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx default-esp-group esp-azure
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx ike-group ike-azure
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx ikev2-reauth inherit
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx local-address xxx.xxx.xxx.xxx
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx tunnel 100 allow-nat-networks disable
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx tunnel 100 allow-public-networks disable
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx tunnel 100 esp-group esp-azure
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx tunnel 100 local prefix 10.0.0.0/24
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx tunnel 100 protocol all
set vpn ipsec site-to-site peer xxx.xxx.xxx.xxx tunnel 100 remote prefix 172.16.2.0/24
                        1. Once the tunnel is up, traffic started flowing without any other config steps other than the firewall rules on the ERX side to allow for IPSEC traffic.
                        JaredBuschJ DashrenderD 2 Replies Last reply Reply Quote 0
                        • JaredBuschJ
                          JaredBusch @AdamF
                          last edited by

                          @fuznutz04 nothing in that azure Vpn step hints at two networks beyond the Vpn

                          AdamFA 1 Reply Last reply Reply Quote 0
                          • AdamFA
                            AdamF @JaredBusch
                            last edited by

                            @JaredBusch said in VPN communication through ERX to different subnet:

                            @fuznutz04 nothing in that azure Vpn step hints at two networks beyond the Vpn

                            I know, that's still a work in progress. 😕 I just managed to get the original tunnel working again which is what the above configs are for.

                            1 Reply Last reply Reply Quote 0
                            • DashrenderD
                              Dashrender @AdamF
                              last edited by

                              @fuznutz04 said in VPN communication through ERX to different subnet:

                              @Dashrender

                              There are no specific "rules" that I set in Azure for traffic flow. I can tell you how I set it up though. I'll outline it below but plan on doing a write up guide here on the site for others.

                              Basic step:

                              1. Created a local Vnet for your on premise network. This is where you supply your public IP of your on premise device (in my case, the ERX) as well as the local network prefix. (in my case, 10.0.0.0/24)

                              This step is what tells Azure how to get to your network.

                              JaredBuschJ 1 Reply Last reply Reply Quote 0
                              • JaredBuschJ
                                JaredBusch @Dashrender
                                last edited by

                                @Dashrender said in VPN communication through ERX to different subnet:

                                @fuznutz04 said in VPN communication through ERX to different subnet:

                                @Dashrender

                                There are no specific "rules" that I set in Azure for traffic flow. I can tell you how I set it up though. I'll outline it below but plan on doing a write up guide here on the site for others.

                                Basic step:

                                1. Created a local Vnet for your on premise network. This is where you supply your public IP of your on premise device (in my case, the ERX) as well as the local network prefix. (in my case, 10.0.0.0/24)

                                This step is what tells Azure how to get to your network.

                                right.. Not driving now so i can actually type.

                                you need to modify this command to have the two local networks on the ERL side.

                                then add your second tunnel in the ERL and it should all come back up.

                                AdamFA 1 Reply Last reply Reply Quote 0
                                • AdamFA
                                  AdamF @JaredBusch
                                  last edited by

                                  Sounds good. I'm going to give this a shot tonight on my ERX at home so I don't bring down the existing tunnel here in the office.

                                  1 Reply Last reply Reply Quote 0
                                  • 1 / 1
                                  • First post
                                    Last post