February - 2021

Feb 28

Configuring & Verifying FlexVPN Redundancy with Dual Hub & Single Cloud

"The What?" - In this post I intend to add onto previous FlexVPN labs/posts where I will cover deploying a secondary hub in a single cloud for redundancy purposes. Before we dive in, if you want to know more about FlexVPN redundancy design options see here: FlexVPN Redundancy Tidbit "The Why?" - In these types of scenarios we have the ability to achieve active/standby failover with deploying two hubs & using something called the IKEv2 "client configuration block" on the spok

Feb 28

Dual Hub FlexVPN Error Tidbit

Sharing an issue that took me some time to troubleshoot & figure out in my dual hub single cloud FlexVPN lab/post (see here: Configuring & Verifying FlexVPN Redundancy with Dual Hub & Single Cloud). So, I had configured two cert maps on the secondary hub, which ended up causing neither client to establish an SA & come UP when forcing failover to the respective secondary hub. The second cert map was configured/deployed to map CSR1 (primary hub) to a different IKEv2 profile th

Feb 28

FlexVPN Redundancy Tidbit

I want to cover the most commonly used FlexVPN redundancy designs since I intend on building out a few scenarios to play with for studying purposes. The most common designs include: Dual cloud approach, where a spoke has two separate tunnels active to both hubs at all times. Failover approach, where a spoke has an active tunnel with one hub at any given point in time. Both of which have their own unique pros/cons. In the dual cloud approach, you get the advantage of having

Feb 21

Configuring & Verifying FlexVPN Direct Spoke-Spoke Tunnels

"The What?" - In this post I plan to go over how to create FlexVPN direct spoke-spoke tunnels. We will see & understand how NHRP is used to aide in this process. We will also utilize another IKEv2 feature known as the configuration payload. See here to see more about NHRP: Next Hop Resolution Protocol (NHRP) Tidbit See here to see more about IKEv2 Config Payload Feature: IKEv2 Configuration Payload Tidbit "The Why?" - Direct tunnels between spokes can aide in saving bandwid

Feb 21

IKEv2 Configuration Payload Tidbit

In this tidbit I want to cover what IKEv2 configuration payloads are & why they are needed. So it is sometimes desirable for the hub in hub & spoke topologies to provide configuration data to the spokes. Note that the use of the configuration payload feature is completely optional. To start, these configuration payloads are a part of messages 3 & 4 during IKE_AUTH. If using the config payload, note that this feature this occurs prior to creating any child SAs. Now let's co

Feb 21

Next Hop Resolution Protocol (NHRP) Tidbit

NHRP is an important protocol used with DMVPNs & FlexVPNs that allows spokes to directly connect to other spokes. To break it down further, NHRP is essentially a resolution arp-like protocol that allows "next hop clients" (spokes) to dynamically register with "next hop servers" (hubs). In a topology, once all clients register with the hub/s, clients have the ability to discover other clients within the same NBMA (non-broadcast multiple-access) network. Let's breakdown the p

Feb 20

Configuring & Verifying FlexVPN Hub & Spoke Tunnels

"The What?" - In this post we will go over setting up FlexVPN hub & spoke tunnels. We will utilize SVTIs on our spokes, DVTIs derived from virtual templates on our hub, IOS PKI certificate authentication to establish our tunnels. Lastly, we will use some smart defaults. "The Why?" - In hub & spoke topologies the main site is known as the hub. Other remote locations are known as spokes. In these types of setups traffic from remote location flows from the spoke to our hub,

Feb 19

IKEv2 Authentication Error Tidbit

So I recently went down a rabbit hole the other day trying to figure out why I could not use my IOS PKI Certificate Authority (CA) in another FlexVPN scenario acting as the hub. As I attempted to bring up a FlexVPN session I continued to debug ikev2 packets (debug crypto ikev2 packet) and kept seeing this error: Payload contents: NOTIFY(AUTHENTICATION_FAILED) Next payload: NONE, reserved: 0x0, length: 8 Security protocol id: Unknown - 0, spi size: 0, type: AUTHENTICATION_FA

Feb 18

DMVPN versus FlexVPN Tidbit

I want to briefly dissect how DMVPN & FlexVPN are very similar in nature, but hit on some important differences in this tidbit. I will be covering some more in-depth labs relating to the two soon. So to start, FlexVPN is essentially the same as DMVPN in essence, and it is sometimes referred to as DMVPN "Phase 4". DMVPN operates in three different phases. A high level of these 3 phases consist of: Phase 1: All traffic flows through the hub. Phase 2: Allows spoke-to-spoke tu

Feb 18

SVTIs & DVTIs Tidbit

For this tidbit I want to define what SVTIs & DVTIs are, what they do, & when to use one versus the other. So to start, a VTI is a virtual tunnel interface that are used in IPsec configurations. The use of IPsec VTIs provides the ability to simplify configuration when you need to provide protection for remote access. These types of interfaces allow you to uniquely configure virtual interfaces with custom configuration. One of the main benefits of an IPsec VTI is that the c

Feb 10

IKEv2 Name Mangler Tidbit

I want to touch on what the IKEv2 Name Mangler is & what capabilities it provides us. Name Mangler grants us the ability to derive a name from a remote peer's identity. This derived name can then be used in authorization requests. We can match against things such as a distinguished name (DN), EAP, FQDN, or email. Note that we cannot use Name Mangler to match IKE identities on IP addresses. This name mangler provides flexibility in allowing us to perform AAA-based policy

Feb 10

Configuring, Verifying, & Troubleshooting IKEv2 Name Mangler Feature

Ok, so let's continue to build from previous FlexVPN labs/blogs. This post specifically will hit on utilizing the IKEv2 Name Mangler feature & understanding how to tie the components together to make it work. If you are not sure what the Name Mangler feature is see: IKEv2 Name Mangler Tidbit Before we begin let's cover the building blocks on how to utilize the Name Mangler feature. The 3 main configuration blocks are as follows: Enable AAA & add AAA authorization (authz) C