- Background
- IPSec Configuration
- VPN Routing Using Border Gateway Protocol (BGP)
- Implementation Experience
IPSec Configuration
Consider two LANs connected by an IPSec tunnel configured between two firewalls, one at each LAN location, as in Figure 1. The details of the firewall configuration and any external routers required for Internet connectivity are irrelevant. The critical assumption is that the firewall will encapsulate and forward any traffic explicitly addressed to end-systems at the far end of the tunnel, provided that it's received on a specific local IP address assigned to the firewall. The challenge is that, to the routers on the inside networks, the firewalls behave like routers but don't participate in any dynamic routing protocol exchanges. That is, the firewalls only support forwarding of unicast packets along unchanging routes to predefined destinations.
){kind=link}
Figure 1 VPN configuration under consideration.
Because the link between the firewall and the router is Ethernet, there's no way for the router to detect firewall or IPSec failure at the link level. At the same time, traditional interior gateway protocols only function between adjacent routers, so there's no convenient way to set up a router-to-router association across the channel provided by the firewalls. While your initial reaction might be to configure the VPN as a bridged rather than a routed tunnel, so that broadcasts and multicasts would be forwarded, that approach is rarely acceptable because of the impact on performance.
The standard approach for providing routing support is to define a generic routing encapsulation (GRE) tunnel between the routers that uses the IPSec tunnel for its transport. This provides a logical point-to-point link between the two routers capable of supporting any desired routing protocol. However, this approach has two significant disadvantages:
It forces the routers to handle every packet, encapsulating each packet before sending it over the tunnel and then extracting each packet at the other end. This not only introduces delay but also increases the processor loading on the router.
Using a GRE tunnel reduces the maximum transfer unit (MTU) for the path by the overhead of GRE encapsulation. So if the IPSec tunnel MTU is 1500 bytes (the maximum allowed by the Ethernet link to the firewall), the GRE tunnel used for all production traffic will be only 1476 bytes.