Routing – Dynamic Routing Protocol (IGP) over IPSec VPN tunnels to branch offices

cisco-asagreospfrouting

What are the best practices for running an IGP to learn networks at HQ from branch offices when those offices connect via IPSec LAN-to-LAN VPN tunnels over the Internet? The branch offices terminate on Cisco VPN Concentrators that are being replaced with Cisco ASA-X's.

Is it better to let a dynamic routing protocol (IGP) — in this case OSPF — run directly through or to the firewalls (and across the tunnels) or is OSPF over GRE (through the firewalls, but not to the firewalls) the way to go or some other option? We have too many static routes in place that need to be eliminated. The IPSec VPN branch offices are small and don't currently run an IGP other than statics, so consider it a clean slate on what to do with branch office routing. Routers exist beyond the firewalls and can be used for tunneling if needed.

*Answers should focus on Cisco ASA-X's in the mix with L3 switches behind them to run any GRE tunnels if necessary.

Best Answer

Since you are using all ASA-X firewalls, I suggest you go with EIGRP and drop the GRE part - configure IPSEC VPN on ASA.

I had about 80+ branch offices connecting to main site with IPSEC VPN (Although tunnels were on routers not on firewalls) EIGRP played really well. EIGRP is much lighter with computations and has better performance than OSPF. Plus EIGRP is lot easier to troubleshoot and configure.

As for GRE you don't have that option (because you have ASA firewalls not routers) and if you ask me GRE is not the way to go with IPSEC VPN anyway.

Related Solutions

Cisco – Migrating from PIX/VPN 3000 to ASA

Regarding question 1 on mobile device licensing

Per your comment below, I did a couple tests on our ASA5525-X which has Essentials/Mobile licenses. I was indeed able to limit access using Dynamic Access Policies. I setup a test policy allowing only iOS devices on iPad2,7 models to connect in a new policy. Then I setup the default policy to terminate sessions. This worked and allowed my Verizon iPad Mini to connect but not my iPhone. Here is the license breakdown:

Session Type: AnyConnect

Username     : <user>                 Index        : 40
Assigned IP  : 10.10.121.1            Public IP    : 70.194.2.165
Protocol     : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel
License      : AnyConnect Essentials, AnyConnect for Mobile
Encryption   : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)RC4  DTLS-Tunnel: (1)AES128
Hashing      : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)SHA1  DTLS-Tunnel: (1)SHA1
Bytes Tx     : 3200                   Bytes Rx     : 940
Group Policy : anyconnect-split-policy
Tunnel Group : anyconnect-split-group
Login Time   : 11:46:24 EDT Fri Jun 7 2013
Duration     : 0h:01m:52s
Inactivity   : 0h:00m:00s
NAC Result   : Unknown
VLAN Mapping : N/A                    VLAN         : none

Note: When configuring these settings, if you don't have the "Apply" button highlight afterwards, you will need to do something in ASDM that will activate the button and allow you to click it. None of the DAP settings for AnyConnect specifics would apply automatically nor trigger the Apply button so I could apply the settings. I had to go modify another setting, click apply, modify the setting back, click apply. This was using ASDM 7.1 on a 9.1.2 ASA5525-X.

Regarding question 2 on the licensing:

There are no client-side licensing options that I am aware of. The only license not necessarily tied to the ASA directly is the AnyConnect Premium which may be pulled off of a "server" ASA with a pool of session licenses for multiple "client" ASAs. In the end, they're applied to an ASA still.

Source:http://www.cisco.com/en/US/docs/security/asa/asa91/license/license_management/license.html

Cisco – Placement of firewall for VPN RA and L2L tunnels

Should the inside interface of the 5545 land first on the L2 edge switches and then trunk to the agg switches for better security or just have the inside drop straight into the Agg layer, also considering that private line traffic may come through yet another interface on the 5545 in the future

Since you did not say that the L2s would be running ACLs, I would not see a difference. I am guessing you will run tagging on the inside ASAs to the distribution layer. My firewalls connect directly to aggregation switches with a dedicated vlan that runs HSRP/VRRP between each set of firewalls and the agg switches.

As to private line traffic, I do not use ASA but I think they have the zones construct like IOS ZBF and you will keep VPN traffic from going to/from the private line traffic without going through packet filtering.

It sounds like default route points to the 5540 and you will use more specific routes to get to your internal VPN access pools and the private line addresses. The 5545 has the default route pointing to the 5540 and it is ok for VPN traffic to hit the internet directly (don't know if you split tunnel on your VPN clients) and other routes to your internal address space.

So I can not see any real problems with your plan. But some of my above assumptions may be wrong

Best Answer

Related Solutions

Cisco – Migrating from PIX/VPN 3000 to ASA

Cisco – Placement of firewall for VPN RA and L2L tunnels

Related Topic