Route-Based VPN

VTIs allow the ability to use Dynamic Routing Protocols to exchange routing information between Security Gateways.

The Dynamic Routing Protocols supported on Gaia are:

• BGP4

• OSPFv2

• RIPv1

• RIPv2

When configuring numbered VTIs in a clustered environment, a number of issues need to be considered:

• Each member must have a unique source IP address.

• Every interface on each member requires a unique IP address.

• All VTIs going to the same remote peer must have the same name.

• Cluster IP addresses are required.

See the R82.10 Gaia Administration Guide > Chapter Network Management > Section Network Interfaces > Section VPN Tunnel Interfaces.

Note - For VTIs between Gaia Security Gateways and Cisco GRE gateways, you must manually configure the Hello/Dead packet intervals at 10/40 on the Gaia Security Gateways, or at 30/120 on the peer gateway. If not, OSPF is not able to get into the "FULL" state.

If you configure a Security Gateway for Domain-Based VPN and Route-Based VPN, then Domain-Based VPN takes precedence by default.

To force Route-Based VPN to take priority, you must create an empty group object and assign it to the VPN domain.

To force Route-Based VPN to take priority:

1. In SmartConsole, from the left navigation panel, click Gateways & Servers.

2. Open the Security Gateway / Cluster object.

3. From the left tree, click Network Management > VPN Domain.

4. Select User defined.

5. Click the [...] button.

6. Click New > Group > Simple Group.

7. Enter a Name.

8. Click OK (leave this Group object empty).

The Security Gateways in this scenario are:

VTIs connect these Security Gateways:

• Members of "Cluster GWa" and "GWb"

• Members of "Cluster GWa" and "GWc"

• "GWb" and "GWc"

The example configurations below use the same Security Gateway names and IP addresses that are described in Numbered VTIs.

1. Configure the required VTIs on 'member_GWa1'

   See the R82.10 Gaia Administration Guide > Chapter Network Management > Section Network Interfaces > Section VPN Tunnel Interfaces.

   1. Configure a Numbered VPN Tunnel Interface for GWb.

      Use these settings for the VTI:

      Parameter	Value
      VPN Tunnel ID	Integer from 1 to 9999 Important - You must configure the same ID for GWb on all Cluster Members.
      Peer	GWb
      VPN Tunnel Type	Numbered
      Local Address	10.0.1.11
      Remote Address	10.0.0.2

   2. Configure a Numbered VPN Tunnel Interface for GWc.

      Use these settings for the VTI:

      Parameter	Value
      VPN Tunnel ID	Integer from 1 to 9999 Important - You must configure the same ID for GWc on all Cluster Members.
      Peer	GWc
      VPN Tunnel Type	Numbered
      Local Address	10.0.1.21
      Remote Address	10.0.0.3

2. Configure the required VTIs on 'member_GWa2'

   See the R82.10 Gaia Administration Guide > Chapter Network Management > Section Network Interfaces > Section VPN Tunnel Interfaces.

   1. Configure a Numbered VPN Tunnel Interface for GWb.

      Use these settings for the VTI:

      Parameter	Value
      VPN Tunnel ID	Integer from 1 to 9999 Important - You must configure the same ID for GWb on all Cluster Members.
      Peer	GWb
      VPN Tunnel Type	Numbered
      Local Address	10.0.1.12
      Remote Address	10.0.0.2

   2. Configure a Numbered VPN Tunnel Interface for GWc.

      Use these settings for the VTI:

      Parameter	Value
      VPN Tunnel ID	Integer from 1 to 9999 Important - You must configure the same ID for GWc on all Cluster Members.
      Peer	GWc
      VPN Tunnel Type	Numbered
      Local Address	10.0.1.22
      Remote Address	10.0.0.3

3. Configure the required VTIs on 'GWb'

   See the R82.10 Gaia Administration Guide > Chapter Network Management > Section Network Interfaces > Section VPN Tunnel Interfaces.

   1. Configure a Numbered VPN Tunnel Interface for Cluster GWa.

      Use these settings for the VTI:

      Parameter	Value
      VPN Tunnel ID	Integer from 1 to 9999 Important - You must configure the same ID you configured on all Cluster Members for GWb.
      Peer	ClusterGWa
      VPN Tunnel Type	Numbered
      Local Address	10.0.0.2
      Remote Address	10.0.1.10

   2. Configure a Numbered VPN Tunnel Interface for GWc.

      Use these settings for the VTI:

      Parameter	Value
      VPN Tunnel ID	Integer from 1 to 9999 Important - You must configure the same ID for this VTI on GWb and GWc.
      Peer	GWc
      VPN Tunnel Type	Numbered
      Local Address	10.0.0.2
      Remote Address	10.0.0.3

4. Configure the required VTIs on 'GWc'

   See the R82.10 Gaia Administration Guide > Chapter Network Management > Section Network Interfaces > Section VPN Tunnel Interfaces.

   1. Configure a Numbered VPN Tunnel Interface for Cluster GWa.

      Use these settings for the VTI:

      Parameter	Value
      VPN Tunnel ID	Integer from 1 to 9999 Important - You must configure the same ID you configured on all Cluster Members for GWc.
      Peer	ClusterGWa
      VPN Tunnel Type	Numbered
      Local Address	10.0.0.3
      Remote Address	10.0.1.20

   2. Configure a Numbered VPN Tunnel Interface for GWb.

      Use these settings for the VTI:

      Parameter	Value
      VPN Tunnel ID	Integer from 1 to 9999 Important - You must configure the same ID for this VTI on GWc and GWb.
      Peer	GWb
      VPN Tunnel Type	Numbered
      Local Address	10.0.0.3
      Remote Address	10.0.0.2

5. Configure the Cluster object in SmartConsole

   After configuring the VTIs on the cluster members, you must configure the Cluster Virtual IP addresses of these VTIs in the cluster object in SmartConsole.

   1. From the left navigation panel, click Gateways & Servers.

   2. Right-click the cluster object and select Edit.

   3. From the left tree, click Network Management.

   4. Click Get Interfaces > Get Interfaces Without Topology.

      The VTIs appear in the Topology column as Point to point.

      Interfaces are members of the same VTI if these criteria match:

      • Peer

      • Remote IP address

      • Interface name

   5. Configure the Cluster Virtual IP addresses on the VTIs:

      1. Select the VTI interface and click Edit.

      2. On the General page, enter the Virtual IP address.

      3. Click OK.

      Virtual IP Addresses:

      Name	Topology	Virtual IP	member_GWa1	member_GWa2	Comment
      vpnt1	Point to point	10.0.1.10	10.0.1.11	10.0.1.12	VTI with GWb
      vpnt2	Point to point	10.0.1.20	10.0.1.21	10.0.1.22	VTI with GWc

   6. Click OK.

   7. Install the Access Control Policy on the cluster object.

1. From the left navigation panel, click Gateways & Servers.

2. Right-click the Security Gateway object and select Edit.

3. From the left tree, click Network Management.

4. Select a VTI interface, and click Edit.

5. From the left tree, click General.

6. In the Topology section, click Modify.

7. In the IP Addresses behind peer Security Gateway that are within reach of this interface section, select:

   • Not Defined - To accept all traffic.

   • Specific - To choose a particular network. The IP addresses in this network will be the only addresses accepted by this interface.

8. In the Anti-Spoofing section, select Perform Anti-Spoofing based on interface topology.

9. select Don't check packets from to make sure Anti-Spoofing does not occur for traffic from IP addresses from certain internal networks to the external interface. Configure a Network object that represents those internal networks with valid addresses, and from the drop-down list, select that Network object.

   Anti-Spoofing does not apply to objects selected in the Don't check packets from drop-down menu.

10. In the Spoof Tracking field, select the applicable options.

11. Click OK.

12. Install the Access Control Policy on the Security Gateway object.

Multicast is used to transmit a single message to a select group of recipients. IP Multicasting applications send one copy of each datagram (IP packet) and address it to a group of computers that want to receive it. This technique addresses datagrams to a group of receivers (at the multicast address) rather than to a single receiver (at a unicast address). The network is responsible for forwarding the datagrams to only those networks that need to receive them. PIM is required for this feature.

For more about Multicasting, see the R82.10 Security Management Administration Guide > Chapter Creating an Access Control Policy > Section Multicast Access Control.

Multicast traffic can be encrypted and forwarded across VPN tunnels that were configured with VPN Tunnel Interfaces (virtual interfaces associated with the same physical interface). All participant Security Gateways, both on the sending and receiving ends, must have a virtual interface for each VPN tunnel and a multicast routing protocol must be enabled on all participant Security Gateways.

To enable multicast service on a Security Gateway functioning as a rendezvous point, add a rule to the security policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection. of that Security Gateway to allow only the specific multicast service to be accepted unencrypted, and to accept all other services only through the community. Corresponding Access Control rules enabling multicast protocols and services should be created on all participating Security Gateways.

For example: