topic Vpn domain based and eBGP + VSX in Firewall and Security Management

Vpn domain based and eBGP + VSX

victor_cortez — Wed, 13 Nov 2024 21:43:50 GMT

Hello Friends,

I got situation here and Im stucked.

We are talking about r81.20 VSX 26k SG.

I can set eBGP between external router and a Vsys. Vsys can announce own routes and receive routes from external router. But how I can send to external Router a route to a subnet reachead only by vpn domain based?

How I can announce to BGP a (route) vpn domain based ?

The VPN domain based doesnt have routes on the FIB, under # route -n or #ip route show we only can see static routes.

Is there anyway to accomplish this?

Tks a lot,

Victor C

Re: Vpn domain based and eBGP + VSX

JozkoMrkvicka — Wed, 13 Nov 2024 22:38:51 GMT

You need to use RIM feature for domain based VPN. Once RIM is activated, you will get content of VPN encryption domain of remote VPN peer as kernel routes. These kernel routes can be propagated over BGP.

More info about RIM feature can be found in R81.20 Site to Site VPN Administration Guide.

Re: Vpn domain based and eBGP + VSX

the_rock — Thu, 14 Nov 2024 02:54:29 GMT

I agree 100% with @JozkoMrkvicka . All this would be much easier with route based tunnel, as you could just use unnumbered VTIs for BGP. But, for domain based, yes, RIM mechanism seems your best option.

Andy

Re: Vpn domain based and eBGP + VSX

victor_cortez — Thu, 14 Nov 2024 03:48:18 GMT

Hello Josko,

Im reading about RIM and sounds like exaclty what I need. Just to confirm, RIM works fine with VSX, correct?

Tks,

Victor C

Re: Vpn domain based and eBGP + VSX

Wolfgang — Thu, 14 Nov 2024 05:56:43 GMT

@victor_cortez yes, RIM is working with VSX, no limitation seen in sk79700 - VSNext / VSX supported features

Re: Vpn domain based and eBGP + VSX

the_rock — Thu, 14 Nov 2024 11:34:26 GMT

Yes, it does, no issues there.

Re: Vpn domain based and eBGP + VSX

victor_cortez — Thu, 14 Nov 2024 17:30:38 GMT

Hello,

Im looking here and got stucked once more.

situation 1 - for Vsys XYZ the vpn ipsec we are not defining the subnets in the community, all traffic should go to the tunnel. So in the "interopable device" - topology - group properties - in group - there is only the public Ip of the peer itself.

If im not defining the subnets in the community RIM will work?

1 - I understand is RIM only works as the expected if subnets are defined in the VPN Community.

2 - RIM doesnt work if customized crypt.def and user.defl files.

What you guys think about this?

Tks,

Victor

Re: Vpn domain based and eBGP + VSX

the_rock — Thu, 14 Nov 2024 17:33:37 GMT

I believe so as well.

1-yes

2-correct

Andy

Re: Vpn domain based and eBGP + VSX

Wolfgang — Thu, 14 Nov 2024 20:44:11 GMT

For 1.

- yes, the definition of an encryption domain is necessary

- you can define an encryption domain for all networks as an example with a range „0.0.0.0 - 254.254.254.254“

For 2.

- as @the_rock Andy wrote, entries from these special files are ignored.
- but with the newer releases you can define separate encryption domains for differente VPN communities within SmartConsole, this was the most common use case for changing user.def (I don‘t know which changes you did, but maybe that‘s it)