Cisco GET VPN Configuration – Best Practices/Can the loopback be used

ciscovpn

I am in the process of re-ip addressing a large number of remote locations, all of which are using a Cisco GET VPN/GDOI configuration for encryption of the traffic. In the process, I also wanted to review the configuration to ensure we were following best-practices.

I have been over the Cisco GET VPN config guide and Deployment Guide, but haven't found a good answer to this question:

Is it best practice to use a loopback or physical interface as the terminating interface of the encrypted traffic?

Currently the configuration uses the physical Gig0/0 interface to terminate the encrypted traffic. However to simplify some of the other changes involved, I would like to utilize the Loopback0 interface for that purpose. Down the road, some of these sites would be getting redundant uplinks, and my understanding is that I could use the Loopback interface to terminate both encrypted connections.

Below are two samples, the existing configuration and how I understand I would have to set the router up to use the Loopback. I believe I would only have to add the following command to the GM: 

crypto map %MAPNAME local-address Loopback0

The GM address would then also have to be changed on the Key Server; to my knowledge, that is the only change on the KS.

A sample of the existing confiuration:

!
crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
crypto isakmp key %KEY address 10.100.1.1
crypto isakmp key %KEY address 10.100.2.1
!
crypto ipsec df-bit clear
crypto gdoi group GDOI-MPLS-GROUP-10
 identity number 10
 server address ipv4 10.100.1.1
 server address ipv4 10.100.2.1
!
crypto map CM-STATIC-MAP 10 gdoi 
 set group GDOI-MPLS-GROUP-10
!
interface Loopback0
 ip address 10.129.110.125 255.255.255.252
!
interface GigabitEthernet0/0
 description MPLS-Connection
 ip address 10.101.44.2 255.255.255.248
 ip virtual-reassembly
 ip tcp adjust-mss 1300
 duplex full
 speed 100
 no cdp enable
 crypto map CM-STATIC-MAP
!

A sample using the loopback as the terminating interface: 

!
crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
crypto isakmp key %KEY address 10.100.1.1
crypto isakmp key %KEY address 10.100.2.1
!
crypto ipsec df-bit clear
crypto gdoi group GDOI-MPLS-GROUP-10
 identity number 10
 server address ipv4 10.100.1.1
 server address ipv4 10.100.2.1
!
crypto map CM-STATIC-MAP local-address Loopback0
crypto map CM-STATIC-MAP 10 gdoi 
 set group GDOI-MPLS-GROUP-10
!
interface Loopback0
 ip address 10.129.110.101 255.255.255.252
!
interface GigabitEthernet0/0
 description MPLS-Connection
 ip address 10.101.24.2 255.255.255.248
 ip tcp adjust-mss 1300
 duplex full
 speed 100
 no cdp enable
 crypto map CM-STATIC-MAP
!

Best Answer

If you are planning to implement multiple links in the same GDOI group on the GMs, best practice would be to use a loopback interface as the crypto source. The reason being that otherwise the key servers will see each interface as a separate entry and the router will receive multiple rekeys. Your second sample config looks good.

See section 4.1.2.1.3 of the GETVPN DIG: http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6525/ps9370/ps7180/GETVPN_DIG_version_1_0_External.pdf

Related Topic