A CCIE Security engineer walks into a bar, things get weird

This might get a bit weird, and you can blame me for watching too much of The Might Boosh, but bear with it.

Picture the scene.

You walk into a bar, with a friend who you refer to as "silly knickers".

At the first table, you point to your friend, and can see a pissed-up architect, trying to draw whilst wearing cashmere mittens. What an idiot.

You look at the second table, and point to your friend again, as there are two pissed-up architects, both trying to draw whilst wearing cashmere mittens. Idiots,

Getting a drink is Easy. You politely point at the bar and grab an alcoholic apple juice. Then you head to the bathroom and pee in private. You fancy a vanilla tequila.

Back at the bar, the barman is also a fitness instructor. He's flexing happily. Two authors walk in, they politely propose a policy of only drinking alcoholic apple juice, in order to keep bar profits set high. You prefer a vanilla tequila.

One of the authors is actually a client of the barman, so he does not point and laugh. Instead, he says he'd like the same, but instead of vanilla tequila, he'd like a cup of tea in two cups.

The authors get served.

The next to get served is a policeman with a key. He's carrying Optimus Prime under one arm, and Bumblebee under the other. He has another key, which is huge, it's a really strong key. He orders a cucumber and a lemonade and nods to the group.

As is a bar policy, anyone with a key gets to make the rules. Before you know it, everyone is wearing cashmere mittens. Idiots!

Ok, story time over. All good stories have meanings, so what's this one all about (if you haven't worked it out from the clues)? I am sure lots of readers are thinking.. WTF?

Well, this is to try and remember VPN setups.

I made the VPNs cheatsheet a week or two ago, and this is good for showing where things fit in with each other, but I was still forgetting the steps.

I tried mnemonics, but they just came out as unrelated words, so decided to turn it into a story, with enough information to remember all the steps.

Let's break it down.

The first table is IKEv1.

I = ISAMKP
Point = Policy
To = Transform
Silly = Set
Knickers = Keyring
If = ISAMKP
Pissed = Profile
Architect = ACL
Cashmere = Crypto
Mittens = MAP
Idiot = Interface

Table 2 is IKEv2

I = ISAMKP
Point = Policy
To = Transform
Silly = Set
Knickers = Keyring
If = ISAMKP
2
Pissed = Profile
Architect = ACL
Cashmere = Crypto
Mittens = MAP
Idiots = Interface

A little harder, but the 2 signifies IKEv2 commands, and we need four of them (proposal, policy, keyring and profile). Each starts with "crypto ikev2", so we can use the context-sensitive help.

Easy VPN is next (its EASY to get served...)

I = ISAKMP
Politely = Policy
Point = Pool
Grab = Group
An Alcoholic Apple (juice) = AAA 
I = ISAKMP
Pee = Profile
In = IPSec 
Private = Profile
Vanilla = Virtual
Tequila = Template

I have left the client-side out, as that's pretty easy (create the "crypto ipsec client ez group", and assign the outside and inside interfaces)

Then comes FlexVPN Server (our flexing barman)

Point = Pool
And = Access
Laugh = List
2 Authors = IKEv2 Authorization
Politely = Policy
Propose = Proposal
Policy = Policy
Alcoholic Apple = AAA
2 Keep = Ikev2 Keyring
Profiles = IKEv2 Profile
Set = Transform Set
I = IPSec 
Prefer = Profile
Vanilla = Virtual
Tequila = Template

A server is no good without a client And this is much the same. Here the author wants the same as the server, without the pointing and laughing, but he does not want the vanilla tequila (virtual template), and orders:

Tea = Tunnel
In = Interface
2 = IKEv2
Cups = Client

The policeman is getting served next, which brings us onto GETVPN.

Is A = ISAMKP
Policeman = Policy
Key = ISAKMP key
Transformers = Transform Set
Really Strong Key = RSA key
A Cucumber and Lemonade = ACL
(nods to the) Group = GDOI Group

I have left out the IPSec profile from the server. I could not think of anything to fit, and the IOS will actually complain (I think) if this is missing, so it should be easy to figure out the missing bit(s).

Finally, we have the GETVPN client:

(As) Is A = ISAKMP
(bar) policy = Policy
Key = ISAKMP Key
Group = GDOI group
Cashmere = Crypto
Mittens = Map
Idiots = Interface

Trying to keep things like crypto map (cashmere mittens), interface (idiot/s) and virtual template (vanilla tequila) the same across the story, as it makes it (slightly) easier to remember. It's a weird story, but with enough repetition, and picturing yourself in the bar, it should aid memory.

CCIE:Sec practice lab - Day 2-5 - VRF-Aware GETVPN

Day 2, 3, 4 and now 5. and I am getting my arse kicked! It's all about GETVPN. Bearing in mind this will only be the second/third time I have tried it, and this time, it's VRF based. One VRF will go to one GETVPN server, the other VRF to the other, and these will share the routes they get down to the NYC server, which should then pass them where needed.

This part of the topology is actually a little more complex than I had originally envisaged, and if you don't mind me switching from present to past tense, I spent a good few hours trying to get this to work but have made some errors in either design or understanding.

Here is the issue. GETVPN-Client needs to have two different VRFs. This is the easy part. The hard part is that the routes to the tunnel destination are outside of any VRF. Options here are:

1. Set up the main interface (Gi0/0) in a third VRF and import/export the RT's into and out of this.
2. Set up a tunnel VRF as well as the VRF forwarding, using different VRFs.
3. Set up VLANs - this will mean a change to the IP addressing scheme

Number one has issues in that we cannot change the topology to suit our needs. Certainly in a lab exam, I cannot change the topology to support and fix a wrong solution. This goes for number three as well. So, I tried out number 2, and although I thought I had cracked it, I have ended up reaching out for help.

The nuts and bolts are in place in terms of connectivity, and it's now day 5 and I need to move on (one way or another), so we'll crack on and set up the switch (to give access to the WWW and ACS boxes):

Switch(config)#vlan 3,4
Switch(config-vlan)#exit
Switch(config)#int gi0/1
Switch(config-if)#swi mo acc
Switch(config-if)#swi acc vl 3
Switch(config-if)#int gi0/2
Switch(config-if)#swi mo acc
Switch(config-if)#swi acc vl 4
Switch(config-if)#exi
Switch(config)#int gi0/0
Switch(config-if)#swi tru enc dot
Switch(config-if)#swi mo tru
Switch(config-if)#

For GDOI to work, we need to permit a bunch of stuff through the firewalls:

ASA9(config)# sh run | i access-list
access-list Inside->Outside extended permit icmp host 10.1.26.1 host 10.1.2.254 
access-list Inside->Outside extended permit udp host 10.1.26.1 host 10.1.2.254 eq 848 
access-list Inside->Outside extended permit udp host 10.1.26.1 host 10.1.2.254 eq isakmp 
access-list Inside->Outside extended permit udp host 10.1.26.1 host 10.1.2.254 eq 4500 
access-list Inside->Outside extended permit esp host 10.1.26.1 host 10.1.2.254 
access-list Outside->Inside extended permit icmp host 10.1.2.254 host 10.1.26.1 
access-list Outside->Inside extended permit udp host 10.1.2.254 host 10.1.26.1 eq 848 
access-list Outside->Inside extended permit udp host 10.1.2.254 host 10.1.26.1 eq isakmp 
access-list Outside->Inside extended permit udp host 10.1.2.254 host 10.1.26.1 eq 4500 
access-list Outside->Inside extended permit esp host 10.1.2.254 host 10.1.26.1 
threat-detection statistics access-list
ASA9(config)#

ASAv6(config)# sh run | i access-list
access-list Outside->Inside extended permit icmp host 10.1.2.1 host 10.1.2.254 
access-list Outside->Inside extended permit udp host 10.1.2.254 eq 848 host 10.1.9.103 eq 848 
access-list Outside->Inside extended permit udp host 10.1.9.103 eq 848 host 10.1.2.254 eq 848 
access-list Outside->Inside extended permit udp host 10.1.9.103 host 10.1.2.254 eq 848 
access-list Outside->Inside extended permit icmp host 10.1.9.103 host 10.1.2.254 
access-list Outside->Inside extended permit esp host 10.1.9.103 host 10.1.2.254 
access-list Outside->Inside extended permit udp host 10.1.9.103 host 10.1.2.254 eq 4500 
access-list Outside->Inside extended permit udp host 10.1.9.103 host 10.1.2.254 eq isakmp 
threat-detection statistics access-list
ASAv6(config)# 

I do have more rules than needed, but the plan is to then prune back at the end of the lab (keep it neat and so on).

Originally I rushed in trying to get things working with virtual templates, VRFs and so on, but have now reverted back to a single layer, with no VRFs. It's working and the client has registered. Here are the (relevant) configs, the VRFs are still present, but not being used:

GETVPN-Client#sh run
!
ip vrf FVRF
 rd 100:100
!
ip vrf RED
 rd 103:103
!
ip vrf WHITE
 rd 104:104
!
crypto keyring RED-G1  
  pre-shared-key address 10.1.9.103 key CCIE
!
crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2
 lifetime 3600
!
crypto isakmp policy 20
 encr aes 256
 authentication pre-share
 group 2
crypto isakmp key CCIE address 10.1.9.103     
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 10
crypto isakmp profile GET-ISAK-Profile-RED
   keyring RED-G1
   match identity address 10.1.9.103 255.255.255.255 
!
!
crypto ipsec transform-set GET-TS esp-3des esp-sha-hmac 
 mode tunnel
!
crypto ipsec profile GET-IPS-Profile-RED
 set group G1-RED
 set transform-set GET-TS 
 set isakmp-profile GET-ISAK-Profile-RED
!
!
crypto gdoi group G1-RED
 identity number 103
 server address ipv4 10.1.9.103
 client registration interface GigabitEthernet0/0
!
!
crypto map G1-RED isakmp-profile GET-ISAK-Profile-RED
crypto map G1-RED 103 gdoi 
 set group G1-RED
!
interface GigabitEthernet0/0
 ip address 10.1.2.254 255.255.255.0
 crypto map G1-RED
!
ip route 0.0.0.0 0.0.0.0 10.1.2.1
end

GETVPN-S1#sh run
!
crypto keyring RED-Keyring  
  pre-shared-key address 10.1.2.254 key CCIE
!
crypto ikev2 profile GET-IKEv2-Profile
 match address local interface GigabitEthernet0/1
 match identity remote address 10.1.2.254 255.255.255.255 
 authentication remote pre-share
 authentication local pre-share
!
!
!
crypto ipsec transform-set GET-TS esp-3des esp-sha-hmac 
 mode tunnel
!
crypto ipsec profile GET-Profile
!
crypto gdoi group G1-RED
 identity number 103
 server local
  rekey algorithm aes 128
  rekey retransmit 10 number 3
  rekey authentication mypubkey rsa GET-RSA-Key
  rekey transport unicast
  registration interface GigabitEthernet0/1
  sa ipsec 103
   profile GET-Profile
   match address ipv4 103
   replay counter window-size 64
   no tag
  address ipv4 10.1.26.1
!
ip route 0.0.0.0 0.0.0.0 10.1.26.200
!
access-list 103 permit tcp any any

The NAT rules are set up on the ASA:

ASA9(config)# object network obj-GETVPN-S1
ASA9(config-network-object)# host 10.1.26.1
ASA9(config-network-object)# nat (inside,outside) 1 source static obj-GETVPN-S1 obj-GETVPN-S1-external 
ERROR: obj-GETVPN-S1-external doesn't match an existing object or object-group
ASA9(config)# object network obj-GETVPN-S1-external                                     
ASA9(config-network-object)# host 10.1.9.103
ASA9(config-network-object)# exit
ASA9(config)# object network obj-GETVPN-S1                                              
ASA9(config-network-object)# nat (inside,outside) 1 source static obj-GETVPN-S1 obj-GETVPN-S1-external 
ASA9(config)# 

The client happily registers with this configuration:

GETVPN-Client#sh cry gdoi
GROUP INFORMATION

    Group Name               : G1-RED
    Group Identity           : 103
    Group Type               : GDOI (ISAKMP)
    Crypto Path              : ipv4
    Key Management Path      : ipv4
    Rekeys received          : 0
    IPSec SA Direction       : Both

     Group Server list       : 10.1.9.103
                               
Group Member Information For Group G1-RED:
    IPSec SA Direction       : Both
    ACL Received From KS     : gdoi_group_G1-RED_temp_acl

    Group member             : 10.1.2.254      vrf: None
       Local addr/port       : 10.1.2.254/848
       Remote addr/port      : 10.1.9.103/848
       fvrf/ivrf             : None/None
       Version               : 1.0.17
       Registration status   : Registered
       Registered with       : 10.1.9.103
       Re-registers in       : 2222 sec
       Succeeded registration: 1
       Attempted registration: 5
       Last rekey from       : 0.0.0.0
       Last rekey seq num    : 0
       Unicast rekey received: 0
       Rekey ACKs sent       : 0
       Rekey Received        : never
       DP Error Monitoring   : OFF
       IPSEC init reg executed    : 0
       IPSEC init reg postponed   : 0
       Active TEK Number     : 1
       SA Track (OID/status) : disabled

       allowable rekey cipher: any
       allowable rekey hash  : any
       allowable transformtag: any ESP

    Rekeys cumulative
       Total received        : 0
       After latest register : 0
       Rekey Acks sents      : 0

 ACL Downloaded From KS 10.1.9.103:
   access-list   permit tcp any any

KEK POLICY:
    Rekey Transport Type     : Unicast
    Lifetime (secs)          : 85231
    Encrypt Algorithm        : AES
    Key Size                 : 128     
    Sig Hash Algorithm       : HMAC_AUTH_SHA
    Sig Key Length (bits)    : 1296    

TEK POLICY for the current KS-Policy ACEs Downloaded:
  GigabitEthernet0/0:
    IPsec SA:
        spi: 0x80E62B18(2162567960)
        KGS: Disabled
        transform: esp-aes esp-sha-hmac 
        sa timing:remaining key lifetime (sec): (2433)
        Anti-Replay(Counter Based) : 64
        tag method : disabled
        alg key size: 16 (bytes)
        sig key size: 20 (bytes)
        encaps: ENCAPS_TUNNEL
          
GETVPN-Client#

Now this is where it gets frustrating fun. I have proved that GDOI *should* work. Now, GETVPN-Client needs to be switched about, so that the Gi0/0 interface is in VRF FVRF (Front-VRF) and the G1-RED (and then G2-WHITE) are connecting from different VRFs.

I'll start by moving everything to FVRF and confirm that it still works:

GETVPN-Client(config)#interface GigabitEthernet0/0
GETVPN-Client(config-if)# ip vrf for FVRF
% Interface GigabitEthernet0/0 IPv4 disabled and address(es) removed due to enabling VRF FVRF
GETVPN-Client(config-if)# ip address 10.1.2.254 255.255.255.0
GETVPN-Client(config-if)# crypto map G1-RED
GETVPN-Client(config-if)#exit
GETVPN-Client(config)#ip route vrf FVRF 0.0.0.0 0.0.0.0 10.1.2.1
GETVPN-Client(config)#crypto isakmp profile GET-ISAK-Profile-RED
GETVPN-Client(conf-isa-prof)#   no keyring RED-G1
GETVPN-Client(conf-isa-prof)#no match identity address 10.1.9.103 255.255.255.255   
GETVPN-Client(conf-isa-prof)#no crypto keyring RED-G1 
GETVPN-Client(config)#crypto keyring RED-G1 vrf FVRF
GETVPN-Client(conf-keyring)#  pre-shared-key address 10.1.9.103 key CCIE
GETVPN-Client(conf-keyring)# crypto isakmp profile GET-ISAK-Profile-RED
% A profile is deemed incomplete until it has match identity statements
GETVPN-Client(conf-isa-prof)#   keyring RED-G1
GETVPN-Client(conf-isa-prof)#match identity address 10.1.9.103 255.255.255.255 FVRF 
*Jul 19 11:23:22.674: %CRYPTO-5-GM_REGSTER: Start registration to KS 10.1.9.103 for group G1-RED using address 10.1.2.254 fvrf FVRF ivrf FVRF
GETVPN-Client(conf-isa-prof)#

This gets registered:

GETVPN-Client(conf-keyring)#do sh cry gdo | i fvrf|status|access-list
       fvrf/ivrf             : FVRF/FVRF
       Registration status   : Registered
       SA Track (OID/status) : disabled
   access-list   permit tcp any any
GETVPN-Client(conf-keyring)#

So far so good. Now, can we change the G1-RED GDOI group to use VRF RED? We'll need to use the ISAKMP policy to split the G1-RED into using a different interface, and the only option here is to use a virtual-template:

GETVPN-Client(config-if)#crypto isakmp profile GET-ISAK-Profile-RED
GETVPN-Client(conf-isa-prof)#?     
Crypto ISAKMP Profile Commands are:

  accounting        Enable AAA Accounting for IPSec Sessions
  ca                Specify certificate authorities to trust
  client            Specify client configuration settings
  default           Set a command to its defaults
  description       Specify a description of this profile
  exit              Exit from crypto isakmp profile sub mode
  initiate          Initiator property
  isakmp            ISAKMP Authorization command
  keepalive         Set a keepalive interval for use with IOS peers
  keyring           Specify keyring to use
  local-address     Interface to use for local address for this isakmp profile
  match             Match values of peer
  no                Negate a command or set its defaults
  qos-group         Apply a Qos policy class map for this profile
  self-identity     Specify Identity to use
  virtual-template  Specify the virtual-template for dynamic interface creation.
  vrf               Specify the VRF it is related to

GETVPN-Client(conf-isa-prof)#

Here is the virtual-template:

GETVPN-Client(config-if)#do sh run int virtual-templ 3 | b interface
interface Virtual-Template3 type tunnel
 ip vrf forwarding RED
 ip unnumbered GigabitEthernet0/0
 tunnel source GigabitEthernet0/0
 tunnel mode ipsec ipv4
 tunnel destination 10.1.9.103
 tunnel vrf FVRF
 tunnel protection ipsec profile GET-IPS-Profile-RED
end

GETVPN-Client(config-if)#

We specify that we are forwarding for VRF RED, but the tunnel VRF should use FVRF, these are the "ivrf" and "fvrf" shown in the "sh cry gdoi" output above. So, should I be using the IP address from Gi0/0 (as it is in a different VRF)? Well, the template seems happy about this:

GETVPN-Client(conf-isa-prof)#do sh ip int bri | i Virtual
Virtual-Template3          10.1.2.254      YES unset  up                    down    
GETVPN-Client(conf-isa-prof)#

Let's change the ISAKMP profile and find out if this works:

GETVPN-Client(config-if)#crypto isakmp profile GET-ISAK-Profile-RED
GETVPN-Client(conf-isa-prof)#virtual-template 3
GETVPN-Client(conf-isa-prof)#
GETVPN-Client(conf-isa-prof)#int gi 0/0
GETVPN-Client(config-if)#shut
GETVPN-Client(config-if)#
%LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to administratively down
GETVPN-Client(config-if)#
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down
GETVPN-Client(config-if)#
GETVPN-Client(config-if)#no shut
GETVPN-Client(config-if)#
%LINK-3-UPDOWN: Interface GigabitEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up
GETVPN-Client(config-if)#

The GDOI tunnel is still up, but I don't think it's picked up the change yet:

ETVPN-Client(config-if)#
%GDOI-5-SA_TEK_UPDATED: SA TEK was updated
%GDOI-5-GM_RECV_REKEY: Received Rekey for group G1-RED from 10.1.26.1 to 10.1.2.254 with seq # 1, spi 0xCB99183CA67992C99B4503A3EDCF75C2
%GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 10.1.9.103 for group G1-RED & gm identity 10.1.2.254 fvrf FVRF ivrf FVRF
GETVPN-Client(config-if)#end
GETVPN-Client#clear cry  gdoi 
% The Key Server and Group Member will destroy created and downloaded policies.
% All Group Members are required to re-register.

Are you sure you want to proceed ? [yes/no]: yes
GETVPN-Client#
%GDOI-4-GM_RE_REGISTER: The IPSec SA created for group G1-RED may have expired/been cleared, or didn't go through. Re-register to KS.
%CRYPTO-5-GM_REGSTER: Start registration to KS 10.1.9.103 for group G1-RED using address 10.1.2.254 fvrf FVRF ivrf FVRF
%GDOI-5-SA_TEK_UPDATED: SA TEK was updated
%GDOI-5-SA_KEK_UPDATED: SA KEK was updated 0xCB99183CA67992C99B4503A3EDCF75C2
%GDOI-5-GM_REGS_COMPL: Registration to KS 10.1.9.103 complete for group G1-RED using address 10.1.2.254 fvrf FVRF ivrf FVRF
%GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 10.1.9.103 for group G1-RED & gm identity 10.1.2.254 fvrf FVRF ivrf FVRF
GETVPN-Client#
GETVPN-Client#sh cry gdoi | i status
       Registration status   : Registered
       SA Track (OID/status) : disabled
GETVPN-Client#

It's not using the ivrf of RED, like I hoped it would. I need to make one more change to the ISAKMP profile:

GETVPN-Client(config)#crypto isakmp profile GET-ISAK-Profile-RED
GETVPN-Client(conf-isa-prof)#vrf RED
% VRF configured in VirtualTemplate will get precedence over IKE Profile VRF
GETVPN-Client(conf-isa-prof)#end
GETVPN-Client#
GETVPN-Client#clear cry  gdoi       
% The Key Server and Group Member will destroy created and downloaded policies.
% All Group Members are required to re-register.

Are you sure you want to proceed ? [yes/no]: yes
GETVPN-Client#
%GDOI-4-GM_RE_REGISTER: The IPSec SA created for group G1-RED may have expired/been cleared, or didn't go through. Re-register to KS.
%CRYPTO-5-GM_REGSTER: Start registration to KS 10.1.9.103 for group G1-RED using address 10.1.2.254 fvrf FVRF ivrf FVRF
%GDOI-5-SA_TEK_UPDATED: SA TEK was updated
%GDOI-5-SA_KEK_UPDATED: SA KEK was updated 0xCB99183CA67992C99B4503A3EDCF75C2
%GDOI-5-GM_REGS_COMPL: Registration to KS 10.1.9.103 complete for group G1-RED using address 10.1.2.254 fvrf FVRF ivrf FVRF
%GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 10.1.9.103 for group G1-RED & gm identity 10.1.2.254 fvrf FVRF ivrf FVRF
GETVPN-Client#

The tunnel is still using FRVF for both the ivrf and the fvrf. I'll make some changes, one at a time, changing them back if there is no success. Starting with the crypto keyring:

GETVPN-Client(config)#crypto keyring RED-G1-RED vrf RED
GETVPN-Client(conf-keyring)#pre-shared-key address 10.1.9.103 key CCIE
GETVPN-Client(conf-keyring)#exit
GETVPN-Client(config)#crypto isakmp profile GET-ISAK-Profile-RED
GETVPN-Client(conf-isa-prof)#keyring RED-G1-RED
GETVPN-Client(conf-isa-prof)#
GETVPN-Client(conf-isa-prof)#do clear cry gd
%GDOI-5-GM_REGS_COMPL: Registration to KS 10.1.9.103 complete for group G1-RED using address 10.1.2.254 fvrf FVRF ivrf FVRF
%GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 10.1.9.103 for group G1-RED & gm identity 10.1.2.254 fvrf FVRF ivrf FVRF
GETVPN-Client(conf-isa-prof)#
GETVPN-Client(conf-isa-prof)#!! NOPE !!
GETVPN-Client(conf-isa-prof)#
GETVPN-Client(conf-isa-prof)#no keyring RED-G1
GETVPN-Client(conf-isa-prof)#
GETVPN-Client(conf-isa-prof)#do clear cry gd  
%GDOI-5-GM_REGS_COMPL: Registration to KS 10.1.9.103 complete for group G1-RED using address 10.1.2.254 fvrf FVRF ivrf FVRF
%GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 10.1.9.103 for group G1-RED & gm identity 10.1.2.254 fvrf FVRF ivrf FVRF
GETVPN-Client(conf-isa-prof)#
GETVPN-Client(conf-isa-prof)#!! NOPE !!       
GETVPN-Client(conf-isa-prof)#
GETVPN-Client(conf-isa-prof)#no keyring RED-G1-RED
GETVPN-Client(conf-isa-prof)#keyring RED-G1       
GETVPN-Client(conf-isa-prof)#
GETVPN-Client(conf-isa-prof)#do clear cry gd      
%GDOI-5-GM_REGS_COMPL: Registration to KS 10.1.9.103 complete for group G1-RED using address 10.1.2.254 fvrf FVRF ivrf FVRF
%GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 10.1.9.103 for group G1-RED & gm identity 10.1.2.254 fvrf FVRF ivrf FVRF
GETVPN-Client(conf-isa-prof)#

It's not the keyring. Maybe we need to try connecting from a different interface, such as a loopback:

GETVPN-Client(conf-isa-prof)#do sh run int loop 103 | b interface
interface Loopback103
 ip vrf forwarding RED
 ip address 10.1.103.1 255.255.255.0
end

GETVPN-Client(conf-isa-prof)#int loop 103
GETVPN-Client(config-if)#crypto map G1-RED
GETVPN-Client(config)#int gi0/0
GETVPN-Client(config-if)#no crypto map G1-RED
GETVPN-Client(config-if)#
GETVPN-Client(config-if)#int virtual-template 3
GETVPN-Client(config-if)#tun source loop 103
GETVPN-Client(config-if)#
GETVPN-Client(config-if)#do clear cry gdoi
%GDOI-5-GM_REGS_COMPL: Registration to KS 10.1.9.103 complete for group G1-RED using address 10.1.2.254 fvrf FVRF ivrf FVRF
%GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 10.1.9.103 for group G1-RED & gm identity 10.1.2.254 fvrf FVRF ivrf FVRF
GETVPN-Client(config-if)#

Nope.

GETVPN-Client(config-if)#ip unnum loop 103
GETVPN-Client(config-if)#
GETVPN-Client(config-if)#do clear cry gdo
%GDOI-5-GM_REGS_COMPL: Registration to KS 10.1.9.103 complete for group G1-RED using address 10.1.2.254 fvrf FVRF ivrf FVRF
%GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 10.1.9.103 for group G1-RED & gm identity 10.1.2.254 fvrf FVRF ivrf FVRF
GETVPN-Client(config-if)#

Still nope.

GETVPN-Client(config-if)#crypto gdoi group G1-RED                        
GETVPN-Client(config-gkm-group)#client registration interface loop 103
GETVPN-Client(config-gkm-group)#
%CRYPTO-5-GM_REGSTER: Start registration to KS 10.1.9.103 for group G1-RED using address 10.1.103.1 fvrf RED ivrf RED
GETVPN-Client(config-gkm-group)#
GETVPN-Client(config-gkm-group)#

The first change, but now everything is going through VRF RED, and we are not registering with the GDOI server.

GETVPN-Client(config-gkm-group)#interface Virtual-Template3 type tunnel
GETVPN-Client(config-if)#tunnel source gi0/0
GETVPN-Client(config-if)#
GETVPN-Client(config-if)#do clear cry gdoi
GETVPN-Client(config-if)#
%CRYPTO-5-GM_REGSTER: Start registration to KS 10.1.9.103 for group G1-RED using address 10.1.103.1 fvrf RED ivrf RED
GETVPN-Client(config-if)#
GETVPN-Client(config-if)#

OK, I can spot an issue with the configuration as it currently is:

GETVPN-Client(config-if)#do sh run int virtual-tem 3
interface Virtual-Template3 type tunnel
 ip vrf forwarding RED
 ip unnumbered Loopback103
 tunnel source GigabitEthernet0/0
 tunnel mode ipsec ipv4
 tunnel destination 10.1.9.103
 tunnel vrf FVRF
 tunnel protection ipsec profile GET-IPS-Profile-RED
end

GETVPN-Client(config-if)#do sh run int loop103
interface Loopback103
 ip vrf forwarding RED
 ip address 10.1.103.1 255.255.255.0
 crypto map G1-RED
end

GETVPN-Client(config-if)#do sh run int gi0/0
interface GigabitEthernet0/0
 ip vrf forwarding FVRF
 ip address 10.1.2.254 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
end

GETVPN-Client(config-if)#

The crypto map is applied to an interface that will not be accepting the traffic (loop103). We are just using this for the IP address, not for taking any actual traffic. Let's set up the crypto map on the virtual template:

GETVPN-Client(config-if)#interface Virtual-Template3 type tunnel
GETVPN-Client(config-if)#crypto map G1-RED
% NOTE: crypto map is configured on tunnel interface.
        Currently only GDOI crypto map is supported on tunnel interface.

GETVPN-Client(config-if)#do clear cry gdoi
%CRYPTO-5-GM_REGSTER: Start registration to KS 10.1.9.103 for group G1-RED using address 10.1.103.1 fvrf RED ivrf RED
GETVPN-Client(config-if)#

Still not right.

GETVPN-Client(config-if)#crypto gdoi group G1-RED
GETVPN-Client(config-gkm-group)#client registration interface gi0/0
GETVPN-Client(config-gkm-group)#
%GDOI-5-GM_REGS_COMPL: Registration to KS 10.1.9.103 complete for group G1-RED using address 10.1.2.254 fvrf FVRF ivrf FVRF
%GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 10.1.9.103 for group G1-RED & gm identity 10.1.2.254 fvrf FVRF ivrf FVRF
GETVPN-Client(config-gkm-group)#

After much tooing-and-frowing (including setting up the G2-WHITE GDOI group, I have come to the conclusion that what I am trying to achieve is not possible. Therefore need to reconfigure the network.

Screw it. We'll go down the same route as all the docs I have found us, which is to use VLANs and sub-interfaces. The clock is ticking and I need to get on

LON-1(config)#int gi0/1
LON-1(config-if)#no ip add
LON-1(config-if)#int gi0/1.1
LON-1(config-subif)#encap dot 10
LON-1(config-subif)#ip address 10.1.2.1 255.255.255.0
LON-1(config-subif)#exi
LON-1(config)#int gi0/1.103
LON-1(config-subif)#encap dot 103
LON-1(config-subif)#ip add 10.1.103.1 255.255.255.0
LON-1(config-subif)#exi
LON-1(config)#int gi0/1.104
LON-1(config-subif)#encap dot 104
LON-1(config-subif)#ip add 10.1.104.1 255.255.255.0
LON-1(config-subif)#do sh ip int bri
Interface                  IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0         10.1.1.1        YES NVRAM  up                    up      
GigabitEthernet0/1         unassigned      YES manual up                    up      
GigabitEthernet0/1.1       10.1.2.1        YES manual up                    up      
GigabitEthernet0/1.103     10.1.103.1      YES manual up                    up      
GigabitEthernet0/1.104     10.1.104.1      YES manual up                    up      
Tunnel0                    192.168.1.11    YES manual up                    up      
LON-1(config-subif)#

ASAv6(config)# int gi0/0
ASAv6(config-if)# no nameif outside
ASAv6(config-if)# no bridge-gro 1
ASAv6(config-if)# 
ASAv6(config-if)# int gi0/0.1
ASAv6(config-subif)# vlan 10
ASAv6(config-subif)# bridge-group 1
ASAv6(config-subif)# exi
ASAv6(config)# int gi0/0.103
ASAv6(config-subif)# vlan 301
ASAv6(config-subif)# bridge-group 103
ASAv6(config-subif)# exi
ASAv6(config)# int gi0/0.104
ASAv6(config-subif)# vlan 104
ASAv6(config-subif)# bridge 104
ASAv6(config-subif)# exit
ASAv6(config)# sh int ip bri
Interface                  IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0         unassigned      YES unset  up                    up  
GigabitEthernet0/0.1       10.1.2.200      YES unset  up                    up  
GigabitEthernet0/0.103     unassigned      YES unset  up                    up  
GigabitEthernet0/0.104     unassigned      YES unset  up                    up  
GigabitEthernet0/1         10.1.2.200      YES unset  up                    up  
BVI1                       10.1.2.200      YES manual up                    up  
ASAv6(config)# int bvi 103
ASAv6(config-if)# ip ad 10.1.103.200 255.255.255.0
ASAv6(config-if)# int bvi 104
ASAv6(config-if)# ip ad 10.1.104.200 255.255.255.0
ASAv6(config-if)# int gi0/1
ASAv6(config-if)# no nameif inside
ASAv6(config-if)# no bridg 1
ASAv6(config-if)# int gi0/1.1
ASAv6(config-subif)# vlan 11
ASAv6(config-subif)# bridge 1
ASAv6(config-subif)# int gi0/1.103
ASAv6(config-subif)# vlan 103
ASAv6(config-subif)# bridg 103
ASAv6(config-subif)# int gi0/1.104
ASAv6(config-subif)# vlan 401
ASAv6(config-subif)# bridge 104
ASAv6(config-subif)#  
ASAv6(config-subif)# int GigabitEthernet0/0.1
ASAv6(config-subif)# nameif Outside
INFO: Security level for "Outside" set to 0 by default.
ASAv6(config-subif)# int GigabitEthernet0/1.1
ASAv6(config-subif)# nameif Inside
INFO: Security level for "Inside" set to 100 by default.
ASAv6(config-subif)# int GigabitEthernet0/0.103
ASAv6(config-subif)# nameif Outside-RED
INFO: Security level for "Outside-RED" set to 0 by default.
ASAv6(config-subif)# int GigabitEthernet0/0.104
ASAv6(config-subif)# nameif Outside-WHITE
INFO: Security level for "Outside-WHITE" set to 0 by default.
ASAv6(config-subif)# int GigabitEthernet0/1.103                      
ASAv6(config-subif)# nameif Inside-RED
INFO: Security level for "Inside-RED" set to 0 by default.
ASAv6(config-subif)# sec 100
ASAv6(config-subif)# int GigabitEthernet0/1.104
ASAv6(config-subif)# nameif Inside-WHITE       
INFO: Security level for "Inside-WHITE" set to 0 by default.
ASAv6(config-subif)# sec 100
ASAv6(config-subif)#    

GETVPN-Client(config)#interface GigabitEthernet0/0
GETVPN-Client(config-if)#no ip vrf forwarding FVRF
GETVPN-Client(config-if)#
GETVPN-Client(config-if)#int gi0/0.1
GETVPN-Client(config-subif)#encap dot 11
GETVPN-Client(config-subif)#ip vrf for FVRF
GETVPN-Client(config-subif)#ip address 10.1.2.254 255.255.255.0
GETVPN-Client(config-subif)#
GETVPN-Client(config-subif)#int gi0/0.103
GETVPN-Client(config-subif)#encap dot 103
GETVPN-Client(config-subif)#ip add 10.1.103.254 255.255.255.0
GETVPN-Client(config-subif)#ip vrf for RED
GETVPN-Client(config-subif)#ip add 10.1.103.254 255.255.255.0
% 10.1.103.0 overlaps with Loopback103
GETVPN-Client(config-subif)#
GETVPN-Client(config-subif)#no int lo 103  
GETVPN-Client(config)#int gi0/1.103                    
GETVPN-Client(config-subif)#ip add 10.1.103.254 255.255.255.0
GETVPN-Client(config-subif)#
GETVPN-Client(config-subif)#no int loo 104
GETVPN-Client(config-subif)#int gi 0/0.104
GETVPN-Client(config-subif)#ip vrf for WHITE
GETVPN-Client(config-subif)#encap dot 401
GETVPN-Client(config-subif)#ip add 10.1.104.254 255.255.255.0
GETVPN-Client(config-subif)#

LON-1(config)#router eigrp 1
LON-1(config-router)#network 10.1.103.0 0.0.0.255
LON-1(config-router)#network 10.1.104.0 0.0.0.255
LON-1(config-router)#no redistr static metric 100 10 255 1 1500 route-map vrf-routes        
LON-1(config-router)#

Now, let's get the GDOI's working!

GETVPN-Client(config-gkm-group)#crypto gdoi group G1-RED
GETVPN-Client(config-gkm-group)#no client registration interface GigabitEthernet0/0.1
GETVPN-Client(config-gkm-group)#crypto gdoi group G2-WHITE
GETVPN-Client(config-gkm-group)#no client registration interface GigabitEthernet0/0.1
GETVPN-Client(config-gkm-group)#
GETVPN-Client(config-gkm-group)#interface Virtual-Template3 type tunnel
GETVPN-Client(config-if)#int gi0/1.103
GETVPN-Client(config-subif)#crypto map G1-RED
GETVPN-Client(config-subif)#   
%CRYPTO-5-GM_REGSTER: Start registration to KS 10.1.9.103 for group G1-RED using address 10.1.103.254 fvrf RED ivrf RED
GETVPN-Client(config-subif)#int gi0/1.104
GETVPN-Client(config-subif)#crypto map G2-WHITE                   
GETVPN-Client(config-subif)#
%CRYPTO-5-GM_REGSTER: Start registration to KS 10.1.9.103 for group G1-RED using address 10.1.103.254 fvrf RED ivrf RED
GETVPN-Client(config-subif)#interface Virtual-Template3 type tunnel
GETVPN-Client(config-if)#no tunnel vrf FVRF
GETVPN-Client(config-if)#interface Virtual-Template4 type tunnel                                       
GETVPN-Client(config-if)#no tunnel vrf FVRF                     
GETVPN-Client(config-if)#exit
GETVPN-Client(config)#ip route vrf RED 0.0.0.0 0.0.0.0 10.1.103.1
GETVPN-Client(config)#ip route vrf WHITE 0.0.0.0 0.0.0.0 10.1.104.1 
GETVPN-Client(config)#

ASAv6(config)# access-list FVRF extended permit icmp host 10.1.2.1 host 10.1.2.254
ASAv6(config)# access-group FVRF in int Outside
ASAv6(config)# access-list RED extended permit icmp host 10.1.103.1 host 10.1.103.254
ASAv6(config)# access-group RED in interface Outside-RED
ASAv6(config)# access-list WHITE extended permit icmp host 10.1.104.1 host 10.1.104.254
ASAv6(config)# access-group WHITE in interface Outside-WHITE  
ASAv6(config)# access-list RED extended permit udp host 10.1.9.103 eq 848 host 10.1.103.254 eq 848
ASAv6(config)# access-list RED extended permit udp host 10.1.9.103 host 10.1.103.254 eq 4500
ASAv6(config)# access-list RED extended permit udp host 10.1.9.103 host 10.1.103.254 eq isakmp
ASAv6(config)# access-list RED extended permit icmp host 10.1.9.103 host 10.1.103.254
ASAv6(config)# access-list WHITE extended permit udp host 10.1.9.104 eq 848 host 10.1.104.254 eq 848
ASAv6(config)# access-list WHITE extended permit udp host 10.1.9.104 host 10.1.104.254 eq 4500
ASAv6(config)# access-list WHITE extended permit udp host 10.1.9.104 host 10.1.104.254 eq isakmp
ASAv6(config)# access-list WHITE extended permit icmp host 10.1.9.104 host 10.1.104.254

ASA9(config)# access-list Inside->Outside extended permit udp host 10.1.26.1 host 10.1.103.254 eq 848 
ASA9(config)# access-list Inside->Outside extended permit udp host 10.1.26.1 host 10.1.103.254 eq 4500 
ASA9(config)# access-list Inside->Outside extended permit udp host 10.1.26.1 host 10.1.103.254 eq isakmp 
ASA9(config)# access-list Inside->Outside extended permit icmp host 10.1.26.1 host 10.1.103.254 
ASA9(config)# access-list Inside->Outside extended permit udp host 10.1.11.1 host 10.1.104.254 eq 848 
ASA9(config)# access-list Inside->Outside extended permit udp host 10.1.11.1 host 10.1.104.254 eq 4500 
ASA9(config)# access-list Inside->Outside extended permit udp host 10.1.11.1 host 10.1.104.254 eq isakmp
ASA9(config)# access-list Inside->Outside extended permit icmp host 10.1.11.1 host 10.1.104.254  
ASA9(config)# 

GETVPN-S1#sh run | s crypto
crypto keyring RED-Keyring  
  pre-shared-key address 10.1.2.254 key CCIE
crypto ikev2 profile GET-IKEv2-Profile
 match address local interface GigabitEthernet0/1
 match identity remote address 10.1.2.254 255.255.255.255 
 authentication remote pre-share
 authentication local pre-share
crypto ipsec transform-set GET-TS esp-3des esp-sha-hmac 
 mode tunnel
crypto ipsec profile GET-Profile
crypto gdoi group G1-RED
 identity number 103
 server local
  rekey algorithm aes 128
  rekey retransmit 10 number 3
  rekey authentication mypubkey rsa GET-RSA-Key
  rekey transport unicast
  registration interface GigabitEthernet0/1
  sa ipsec 103
   profile GET-Profile
   match address ipv4 103
   replay counter window-size 64
   no tag
  address ipv4 10.1.26.1
GETVPN-S1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
GETVPN-S1(config)#crypto keyring RED-Keyring
GETVPN-S1(conf-keyring)#no pre-shared-key address 10.1.2.254 key CCIE
GETVPN-S1(conf-keyring)#pre-shared-key address 10.1.103.254 key CCIE
GETVPN-S1(conf-keyring)#crypto ikev2 profile GET-IKEv2-Profile
GETVPN-S1(config-ikev2-profile)#no match identity remote address 10.1.2.254 255.255.255.255      
GETVPN-S1(config-ikev2-profile)#match identity remote address 10.1.103.254 255.255.255.255       
GETVPN-S1(config-ikev2-profile)#

GETVPN-S2#sh run | s crypto
crypto keyring WHITE-Keyring  
  pre-shared-key address 10.1.2.254 key CCIE
crypto ikev2 profile GET-IKEv2-Profile
 match address local interface GigabitEthernet0/0
 match identity remote address 10.1.2.254 255.255.255.255 
 authentication remote pre-share
 authentication local pre-share
crypto ipsec transform-set GET-TS esp-3des esp-sha-hmac 
 mode tunnel
crypto ipsec profile GET-Profile
crypto gdoi group G2-WHITE
 identity number 104
 server local
  rekey algorithm aes 128
  rekey retransmit 10 number 3
  rekey authentication mypubkey rsa GET-RSA-Key
  rekey transport unicast
  registration interface GigabitEthernet0/0
  sa ipsec 104
   profile GET-Profile
   match address ipv4 104
   replay counter window-size 64
   no tag
  address ipv4 10.1.11.1
GETVPN-S2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
GETVPN-S2(config)#line con 0
GETVPN-S2(config-line)#width 255
GETVPN-S2(config-line)#exit
GETVPN-S2(config)#crypto keyring WHITE-Keyring
GETVPN-S2(conf-keyring)#no pre-shared-key address 10.1.2.254 key CCIE
GETVPN-S2(conf-keyring)#pre-shared-key address 10.1.104.254 key CCIE
GETVPN-S2(conf-keyring)#crypto ikev2 profile GET-IKEv2-Profile
GETVPN-S2(config-ikev2-profile)#no match identity remote address 10.1.2.254 255.255.255.255
GETVPN-S2(config-ikev2-profile)#match identity remote address 10.1.104.254 255.255.255.255
GETVPN-S2(config-ikev2-profile)#

GETVPN-Client(conf-isa-prof)#do sh run | s crypto
crypto keyring RED-G1 vrf FVRF 
  pre-shared-key address 10.1.9.103 key CCIE
crypto keyring RED-G1-RED vrf RED 
  pre-shared-key address 10.1.9.103 key CCIE
crypto keyring WHITE-G2-WHITE vrf WHITE 
  pre-shared-key address 10.1.9.104 key CCIE
crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2
 lifetime 3600
crypto isakmp policy 20
 encr aes 256
 authentication pre-share
 group 2
crypto isakmp key CCIE address 10.1.9.103     
crypto isakmp key CCIE address 10.1.9.104     
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 10
crypto isakmp profile GET-ISAK-Profile-RED
   vrf RED
   keyring RED-G1-RED
   match identity address 10.1.9.103 255.255.255.255 
crypto isakmp profile GET-ISAK-Profile-WHITE
   vrf WHITE
   keyring WHITE-G2-WHITE
   match identity address 10.1.9.104 255.255.255.255 
crypto ipsec transform-set GET-TS esp-3des esp-sha-hmac 
 mode tunnel
crypto ipsec profile GET-IPS-Profile-RED
 set group G1-RED
 set transform-set GET-TS 
 set isakmp-profile GET-ISAK-Profile-RED
crypto ipsec profile GET-IPS-Profile-WHITE
 set group G2-WHITE
 set transform-set GET-TS 
 set isakmp-profile GET-ISAK-Profile-WHITE
crypto gdoi group G1-RED
 identity number 103
 server address ipv4 10.1.9.103
crypto gdoi group G2-WHITE
 identity number 104
 server address ipv4 10.1.9.104
crypto map G1-RED local-address GigabitEthernet0/0.103
crypto map G1-RED isakmp-profile GET-ISAK-Profile-RED
crypto map G1-RED 103 gdoi 
 set group G1-RED
crypto map G2-WHITE local-address GigabitEthernet0/0.104
crypto map G2-WHITE isakmp-profile GET-ISAK-Profile-WHITE
crypto map G2-WHITE 104 gdoi 
 set group G2-WHITE
 crypto map G1-RED
 crypto map G2-WHITE
GETVPN-Client(conf-isa-prof)#

GETVPN-Client(conf-isa-prof)#do sh cry gdo | i Group Name|status
    Group Name               : G1-RED
       Registration status   : Registered
       SA Track (OID/status) : disabled
    Group Name               : G2-WHITE
       Registration status   : Registered
       SA Track (OID/status) : disabled
GETVPN-Client(conf-isa-prof)#

It's working but I am actually pretty annoyed. I have spent way too long battling against this, probably five days (not constant, I still went to work, cooked food, had family time, took the boys to a party and did family stuff), but it's five days worth of study that I could have spent studying something else.

Trying to put a positive spin on things, this is actually a good lesson for the lab. If something is taking too long then move on. Either you'll figure it out later, something else will give you a clue, you'll fix a prerequisite, or you'll leave that exercise and get points on something else that you'd otherwise have missed because of taking too long to fix one thing instead of moving on.

So, the things I still don't get are why it would not work, and whether I am trying to fix something that will never work, or whether it's an issue with vIOS and this is the reason it's not working, Maybe the topology and constraints were wrong from the start. Maybe someone else can solve this one, but I need to be strict and move on. With only 72 days to go, I need to spend the time wisely, and not get like a dog with a bone when it comes to an issue.

In the next post, we'll be extending the routes coming into the GETVPN servers, so that we have access to the WWW and ACS servers, and setting up IKEv1 between NYC and the IKEv1 router.

Challenge: Can GETVPN support virtual-templates, VRFs and fvrf/ivrf?

I think I am really close to a solution, but the fvrf/ivrf seem to be all one or the other.

The set up is GETVPN-client connects to two networks, one in VRF RED, one on VRF WHITE on separate interfaces. Gi0/0 connects to a transparent firewall and has a default route out to another router.

Gi0/0 is in VRF FRVF and the KS (GETVPN-S1) is reachable over this VRF. ICMP and UDP/848 allowed through the transparent ASA and intermediate ASAs, and I can ping from the GM to the KS using VRF FVRF, so routing and firewalls are not the problem.

So far my config is:

GETVPN-Client#sh run int gi0/0 | b interf
interface GigabitEthernet0/0
 ip vrf forwarding FVRF
 ip address 10.1.2.254 255.255.255.0
end
GETVPN-Client#sh run int lo 103 | b inter
interface Loopback103
 ip vrf forwarding RED
 ip address 10.1.103.1 255.255.255.0
 crypto map G1-RED
end
GETVPN-Client#sh run int virtual-tem 3 | b inter
interface Virtual-Template3 type tunnel
 ip vrf forwarding RED
 ip unnumbered Loopback103
 tunnel source Loopback103
 tunnel mode ipsec ipv4
 tunnel destination 10.1.9.103
 tunnel vrf FVRF
 tunnel protection ipsec profile GET-IPS-Profile-RED
end
GETVPN-Client#sh run | s crypto
crypto keyring RED-G1 vrf RED 
  pre-shared-key address 10.1.9.103 key CCIE
crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2
crypto isakmp policy 20
 encr aes 256
 authentication pre-share
 group 2
crypto isakmp keepalive 10
crypto isakmp profile GET-ISAK-Profile-RED
   vrf RED
   keyring RED-G1
   match identity address 10.1.9.103 255.255.255.255 FVRF
   virtual-template 3
crypto ipsec transform-set GET-TS esp-3des esp-sha-hmac 
 mode transport
crypto ipsec profile GET-IPS-Profile-RED
 set group G1-RED
 set transform-set GET-TS 
 set isakmp-profile GET-ISAK-Profile-RED
crypto gdoi group G1-RED
 identity number 103
 server address ipv4 10.1.9.103
crypto map G1-RED isakmp-profile GET-ISAK-Profile-RED
crypto map G1-RED 103 gdoi 
 set group G1-RED
 crypto map G1-RED
GETVPN-Client#
GETVPN-Client#sh run | i ip route
ip route vrf FVRF 0.0.0.0 0.0.0.0 10.1.2.1
GETVPN-Client#

ip vrf FVRF
 rd 100:100
ip vrf RED
 rd 103:103
ip vrf WHITE
 rd 104:104

Whatever I do, the GDOI registration wants to use either RED/RED for the fvrf/ivrf, or FVRF/FVRF.. for example:

GETVPN-Client(config-gkm-group)#do sh cry gdo | i ivr              
       fvrf/ivrf             : FVRF/FVRF
GETVPN-Client(config-gkm-group)#no client registration interface gi0/0
GETVPN-Client(config-gkm-group)#do sh cry gdo | i ivr                 
       fvrf/ivrf             : RED/RED
GETVPN-Client(config-gkm-group)#
GETVPN-Client(config-if)#tunnel sou gi0/0
GETVPN-Client(config-if)#
GETVPN-Client(config-if)#do sh cry gdoi | i ivrf
       fvrf/ivrf             : RED/RED
GETVPN-Client(config-if)#crypto gdoi group G1-RED
GETVPN-Client(config-gkm-group)#client reg in gi0/0
GETVPN-Client(config-gkm-group)#do sh cry gdoi | i ivrf 
       fvrf/ivrf             : FVRF/FVRF
GETVPN-Client(config-gkm-group)#

I am sure it can be done, and what I need is for the fvrf to be FVRF and the ivrf to be RED, but I am having a really hard time finding supporting documentation - most have sub-interfaces on the Gi0/0 interface for the different VRFs... Been trying this since Saturday night! I am pretty sure I am only one "no" command away from a solution, but it's baffling me!

Hoping someone might have an idea!

Let's make it interesting, without a) creating sub-interfaces for the VRFs, or b) making other IP addressing/topological changes, see if you can get this to work, you won't need to replicate the entire setup, in fact it only needs two routers LON-1 with gi0/1 set with the IP address 10.1.2.1/24, and GETVPN-Client with Gi0/0 in VRF FVRF with the IP address 10.1.2.254, and a static default route to LON-1.

The first correct answer/solution will win a £5 Amazon voucher!

CCIE Security Lab: GET VPN, ISAKMP and when less is more.

GET VPN or Group Encrypted Transport is next in the list of VPNs to cover.

Much of the configuration will be the same as we have seen before (ISAKMP policies, transform sets, IPSec profiles), but some will be quite new (GDOI groups).

Before we start with the fun stuff, we'll need to set up the basic connectivity (and it will be very basic):

GDOI-Server(config)#router ospf 1
GDOI-Server(config-router)#router-id 7.7.7.7
GDOI-Server(config-router)#network 10.1.12.0 0.0.0.255 area 1
GDOI-Server(config-router)#
*Jul  5: %OSPF-4-NOVALIDKEY: No valid authentication send key is available on interface GigabitEthernet0/0
GDOI-Server(config-router)#int gi 0/0
GDOI-Server(config-if)#ip ospf auth mess
GDOI-Server(config-if)#ip ospf mess 1 md5 cisco
GDOI-Server(config-if)#

ISP-3(config)#router ospf 1
ISP-3(config-router)#router-id 10.1.12.1 
ISP-3(config-router)#area 1 auth mess
ISP-3(config-router)#network 10.1.12.0 0.0.0.255 area 1
ISP-3(config-router)#network 10.1.13.0 0.0.0.255 area 1
ISP-3(config-router)#network 10.1.14.0 0.0.0.255 area 1
ISP-3(config-router)#
ISP-3(config-router)#int rang
ISP-3(config-router)#int rang gi 0/0 - 2
ISP-3(config-if-range)#ip ospf auth messa  
ISP-3(config-if-range)#ip ospf mess 1 md5 cisco
ISP-3(config-if-range)#

GDOI-G1(config)#router ospf 1
GDOI-G1(config-router)#router-id 8.8.8.8
GDOI-G1(config-router)#network 10.1.13.0 0.0.0.255 area 1
GDOI-G1(config-router)#area 1 authe mess
GDOI-G1(config-router)#network 8.8.8.8 0.0.0.0 area 1
GDOI-G1(config-router)#
GDOI-G1(config-router)#int gi 0/0
GDOI-G1(config-if)#int gi 0/1
GDOI-G1(config-if)#ip ospf auth mess
GDOI-G1(config-if)#ip ospf mess 1 md5 cisco
GDOI-G1(config-if)#
*Jul  5: %OSPF-5-ADJCHG: Process 1, Nbr 10.1.12.1 on GigabitEthernet0/1 from LOADING to FULL, Loading Done
GDOI-G1(config-if)#

GDOI-G2(config)#router ospf 1
GDOI-G2(config-router)#router-id 9.9.9.9
GDOI-G2(config-router)#network 9.9.9.9 0.0.0.0 a 1
GDOI-G2(config-router)#network 10.1.14.0 0.0.0.255 area 1
GDOI-G2(config-router)#area 1 auth mess
GDOI-G2(config-router)#int gi 0/2
GDOI-G2(config-if)#ip ospf auth mess
GDOI-G2(config-if)#ip os mess 1 md cisco
GDOI-G2(config-if)#
*Jul  5: %OSPF-5-ADJCHG: Process 1, Nbr 10.1.12.1 on GigabitEthernet0/2 from LOADING to FULL, Loading Done
GDOI-G2(config-if)#

GDOI-Server#ping 8.8.8.8 so lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of 7.7.7.7 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/5 ms
GDOI-Server#ping 9.9.9.9 so lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 9.9.9.9, timeout is 2 seconds:
Packet sent with a source address of 7.7.7.7 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/7 ms
GDOI-Server#

OK, let's begin in the same way as we did with dual-hub DMVPN, and chuck the basics into notepad and paste then into the routers:

crypto isakmp policy 10
encryption 3des
authentication pre-share
hash sha
group 2
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
crypto ipsec transform-set GET-TS esp-3des esp-sha-hmac
exit
crypto ipsec profile GET-Profile
set transform-set GET-TS
exit

This time, I put the commands on the GDOI-Server router first, then copied them to notepad and pasted into the clients, this way it means that any fat-fingering will be picked up on quicker, and not transferred to the clients:

GDOI-G1(config)#crypto isakmp policy 10
GDOI-G1(config-isakmp)#encryption 3des
GDOI-G1(config-isakmp)#authentication pre-share
GDOI-G1(config-isakmp)#hash sha
GDOI-G1(config-isakmp)#group 2
GDOI-G1(config-isakmp)#crypto isakmp key cisco address 0.0.0.0 0.0.0.0
GDOI-G1(config)#crypto ipsec transform-set GET-TS esp-3des esp-sha-hmac
GDOI-G1(cfg-crypto-trans)#exit
GDOI-G1(config)#crypto ipsec profile GET-Profile
GDOI-G1(ipsec-profile)#set transform-set GET-TS
GDOI-G1(ipsec-profile)#exit
GDOI-G1(config)#

GDOI-G2(config)#crypto isakmp policy 10
GDOI-G2(config-isakmp)#encryption 3des
GDOI-G2(config-isakmp)#authentication pre-share
GDOI-G2(config-isakmp)#hash sha
GDOI-G2(config-isakmp)#group 2
GDOI-G2(config-isakmp)#crypto isakmp key cisco address 0.0.0.0 0.0.0.0
GDOI-G2(config)#crypto ipsec transform-set GET-TS esp-3des esp-sha-hmac
GDOI-G2(cfg-crypto-trans)#exit
GDOI-G2(config)#crypto ipsec profile GET-Profile
GDOI-G2(ipsec-profile)#set transform-set GET-TS
GDOI-G2(ipsec-profile)#exit

Now, let's head back to the server and see what GET VPN has in store. I will be making heavy use of the context-sensitive help here, and putting notes in the output:

GDOI-Server(config)#crypto gdoi ?
  group  Configure a GKM (Group Key Management, GDOI or G-IKEv2) Group

GDOI-Server(config)#crypto gdoi group ?
  WORD  Group Name
  ipv6  IPv6 GKM (Group Key Management) Group

GDOI-Server(config)#crypto gdoi group GDOI-G1
GDOI-Server(config-gkm-group)#?
GKM (Group Key Management) Group configuration commands:
  client    Set the group dsclient parameters
  default   Set a command to its defaults
  exit      Exit the group mode
  identity  Set the identity of the group
  no        Negate a command or set its defaults
  passive   Set the group in passive mode
  server    Set the group server for of the group

GDOI-Server(config-gkm-group)#server ?
  address   Identify the group server by address
  hostname  Identify the group server by hostname
  local     Configure GKM group server defined locally

GDOI-Server(config-gkm-group)#server local ?
  

GDOI-Server(config-gkm-group)#server local 
GDOI-Server(gkm-local-server)#
*Jul  5: %CRYPTO-6-GDOI_ON_OFF: GDOI is ON
GDOI-Server(gkm-local-server)#address ?       
  ipv4  Set ipv4 address of local server

GDOI-Server(gkm-local-server)#address ipv4 ?
  A.B.C.D  IPv4 local address

GDOI-Server(gkm-local-server)#address ipv4 7.7.7.7
GDOI-Server(gkm-local-server)#sa ?
  d3p               Enable IP delivery delay detection protocol for all SAs
                    within the group
  ipsec             Configure an IPsec SA
  pair-wise-keying  Enable KGS pair-wise-keying
  receive-only      Configure SA to work only in inbound direction

GDOI-Server(gkm-local-server)#sa ipsec ?
    Sequence to insert into SA list

GDOI-Server(gkm-local-server)#sa ipsec 1
GDOI-Server(gkm-sa-ipsec)#?
GKM local server IPsec SA configuration commands:
  default  Set a command to its defaults
  exit     Exit the sa ipsec mode
  match    Match characteristics of packets to encrypt
  no       Negate a command or set its defaults
  profile  Configure an ipsec profile for the SA
  replay   Set replay method
  tag      Set inline tagging method

GDOI-Server(gkm-sa-ipsec)#profile GET-Profile 
GDOI-Server(gkm-sa-ipsec)#match ?    
  address  Match addresses of packets to encrypt

GDOI-Server(gkm-sa-ipsec)#match address ?
  ipv4  Match ipv4 packets
  ipv6  Match ipv6 packets

GDOI-Server(gkm-sa-ipsec)#match address ipv4 ?
      IP access-list number
    IP access-list number (expanded range)
  WORD         Access-list name

GDOI-Server(gkm-sa-ipsec)#match address ipv4 G1
GDOI-Server(gkm-sa-ipsec)#exit
GDOI-Server(gkm-local-server)#exit
GDOI-Server(config-gkm-group)#end
GDOI-Server#sh run 
crypto isakmp policy 10
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key cisco address 0.0.0.0        
crypto ipsec transform-set GET-TS esp-3des esp-sha-hmac 
 mode tunnel
crypto ipsec profile GET-Profile
 set transform-set GET-TS 
crypto gdoi group GDOI-G1
 identity number 1
 server local
  sa ipsec 1
   ! Incomplete
   ! Match address is not configured
   profile GET-Profile
   match address ipv4 G1
   replay counter window-size 64
   no tag
  address ipv4 7.7.7.7
GDOI-Server#

One thing I do find very useful is that the IOS will tell me what I am missing. It doesn't do this for everything (it's not a mind-reader), but here it is very useful and shows me that the gdoi group is incomplete, and I am missing a match address statement. Let's fix that by permitting our overlay IP address (VPN range, like we have in DMVPN):

GDOI-Server(config)#ip access-list extended G1 
GDOI-Server(config-ext-nacl)#remark Probably our VPN IP range 
GDOI-Server(config-ext-nacl)#permit ip 192.168.2.0 0.0.0.255 192.168.2.0 0.0.0.255
GDOI-Server(config-ext-nacl)#do sh run | s crypto gdoi                  
crypto gdoi group GDOI-G1
 identity number 1
 server local
  sa ipsec 1
   profile GET-Profile
   match address ipv4 G1
   replay counter window-size 64
   no tag
  address ipv4 7.7.7.7
GDOI-Server(config-ext-nacl)#! better!
GDOI-Server(config-ext-nacl)#

Makes sense really! Let's have a look at a few show commands:

GDOI-Server#sh crypto gdoi group GDOI-G1
    Group Name               : GDOI-G1 (Multicast)
    Re-auth on new CRL       : Disabled
    Group Identity           : 1
    Group Type               : GDOI (ISAKMP)
    Crypto Path              : ipv4
    Key Management Path      : ipv4
    Group Members            : 0
    IPSec SA Direction       : Both
    Group Rekey Lifetime     : 86400 secs
    Rekey Retransmit Period  : 10 secs
    Rekey Retransmit Attempts: 2

      IPSec SA Number        : 1
      IPSec SA Rekey Lifetime: 3600 secs
      Profile Name           : GET-Profile
      Replay method          : Count Based
      Replay Window Size     : 64
      Tagging method         : Disabled
      ACL Configured         : access-list G1

     Group Server list       : Local
                               
GDOI-Server#sh crypto gdoi ks           
Total group members registered to this box: 0

Key Server Information For Group GDOI-G1:
    Group Name               : GDOI-G1
    Re-auth on new CRL       : Disabled
    Group Identity           : 1
    Group Type               : GDOI (ISAKMP)
    Group Members            : 0
    Rekey Acknowledgement Cfg: Cisco
    IPSec SA Direction       : Both
    CKM status               : Disable
    ACL Configured: 
        access-list G1


GDOI-Server#
GDOI-Server#sh crypto gdoi              
GROUP INFORMATION

    Group Name               : GDOI-G1 (Multicast)
    Re-auth on new CRL       : Disabled
    Group Identity           : 1
    Group Type               : GDOI (ISAKMP)
    Crypto Path              : ipv4
    Key Management Path      : ipv4
    Group Members            : 0
    IPSec SA Direction       : Both
    Group Rekey Lifetime     : 86400 secs
    Rekey Retransmit Period  : 10 secs
    Rekey Retransmit Attempts: 2

      IPSec SA Number        : 1
      IPSec SA Rekey Lifetime: 3600 secs
      Profile Name           : GET-Profile
      Replay method          : Count Based
      Replay Window Size     : 64
      Tagging method         : Disabled
      ACL Configured         : access-list G1

     Group Server list       : Local
                               
GDOI-Server#

Nothing registered yet, but thats not surprising as we have not configured any client. Let's create the second group:

GDOI-Server(config)#crypto gdoi group GDOI-G2
GDOI-Server(config-gkm-group)#identity number 2
GDOI-Server(config-gkm-group)#server local
GDOI-Server(gkm-local-server)#sa ipsec 1
GDOI-Server(gkm-sa-ipsec)#profile GET-Profile
GDOI-Server(gkm-sa-ipsec)#match address ipv4 G2
GDOI-Server(gkm-sa-ipsec)#replay counter window-size 64
GDOI-Server(gkm-sa-ipsec)#no tag
GDOI-Server(gkm-sa-ipsec)#exit
GDOI-Server(gkm-local-server)#address ipv4 7.7.7.7                    
GDOI-Server(gkm-local-server)#exit
GDOI-Server(config-gkm-group)#exit
GDOI-Server(config)#ip access-list extended G2                           
GDOI-Server(config-ext-nacl)#permit ip 192.168.3.0 0.0.0.255 192.168.3.0 0.0.0.255
GDOI-Server(config-ext-nacl)#exit
GDOI-Server(config)#do sh run | s crypto gdoi
crypto gdoi group GDOI-G1
 identity number 1
 server local
  sa ipsec 1
   profile GET-Profile
   match address ipv4 G1
   replay counter window-size 64
   no tag
  address ipv4 7.7.7.7
crypto gdoi group GDOI-G2
 identity number 2
 server local
  sa ipsec 1
   profile GET-Profile
   match address ipv4 G2
   replay counter window-size 64
   no tag
  address ipv4 7.7.7.7
GDOI-Server(config)#

OK, I have kind of bumbled my way through that, but let's see if we can get one of the clients to connect...

GDOI-G1(config)#crypto gdoi group GDOI-G1
GDOI-G1(config-gkm-group)#?
GKM (Group Key Management) Group configuration commands:
  client    Set the group client parameters
  default   Set a command to its defaults
  exit      Exit the group mode
  identity  Set the identity of the group
  no        Negate a command or set its defaults
  passive   Set the group in passive mode
  server    Set the group server for of the group

GDOI-G1(config-gkm-group)#server ?
  address   Identify the group server by address
  hostname  Identify the group server by hostname
  local     Configure GKM group server defined locally

GDOI-G1(config-gkm-group)#server address ?
  ipv4  Set the IPv4 address of the group server

GDOI-G1(config-gkm-group)#server address ipv4 ?
  A.B.C.D  Group server IPv4 address

GDOI-G1(config-gkm-group)#server address ipv4 7.7.7.7
GDOI-G1(config-gkm-group)#identity ?
  address  Set the identity of the group as an address
  number   Set the identity of the group as a number

GDOI-G1(config-gkm-group)#identity number 1
GDOI-G1(config-gkm-group)#exit
GDOI-G1(config)#crypto isakmp profile GET-Profile
GDOI-G1(conf-isa-prof)#match ?
  certificate  Peer certificate attributes
  identity     Peer identity

GDOI-G1(conf-isa-prof)#match identity ?
  address    IP Address(es)
  group      Group name
  host       match a hostname/domain
  user-fqdn  match a username/domain

GDOI-G1(conf-isa-prof)#match identity address ?
  A.B.C.D  IP address prefix
  ipv6     IPv6 Address(es)

GDOI-G1(conf-isa-prof)#match identity address 7.7.7.7  
GDOI-G1(conf-isa-prof)#exit
GDOI-G1(config)#crypto map GDOI-G1 isakmp-profile GET-Profile
GDOI-G1(config)#crypto map G1 10 gdoi 
% NOTE: This new crypto map will remain disabled until a valid
        group has been configured.
GDOI-G1(config-crypto-map)#set group GDOI-G1
GDOI-G1(config-crypto-map)#int gi0/1
GDOI-G1(config-if)#crypto ?
  ipsec  Set IPSec parameters
  map    Assign a Crypto Map

GDOI-G1(config-if)#crypto map ?
  WORD  Crypto Map tag

GDOI-G1(config-if)#crypto map G1
GDOI-G1(config-if)#
*Jul  5: %CRYPTO-6-GDOI_ON_OFF: GDOI is ON
*Jul  5: %CRYPTO-5-GM_REGSTER: Start registration to KS 7.7.7.7 for group GDOI-G1 using address 10.1.13.8 fvrf default ivrf default
*Jul  5: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Main mode failed with peer at 7.7.7.7
GDOI-G1(config-if)#
GDOI-G1(config-if)#
*Jul  5: %CRYPTO-4-IKMP_NO_SA: IKE message from 7.7.7.7 has no SA and is not an initialization offer
*Jul  5: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Main mode failed with peer at 7.7.7.7

OK... some issues here. Let's try setting the client interface:

GDOI-G1(config)#crypto gdoi group GDOI-G1                         
GDOI-G1(config-gkm-group)#client ?  
  bypass-policy          Allow group-key management traffic sent to this GM
                         only
  protocol               Group Member Registration & Rekey Protocol
  recovery-check         Specify GM recovery check parameters
  registration           Set the group client management/register interface
  rekey                  Set the group client acceptable rekey ciphers and
                         hashs
  status                 group-member status
  transform-sets         Specify list of group client acceptable transform sets
  transport-encrypt-key  Enforce group or pair-wise keying

GDOI-G1(config-gkm-group)#client registration interface gi0/1

Still no dice, but then I left out a whole load of possible commands for the rekey. This blog post is pretty useful, and kind of mirrors the same set-up that I have. So let's add the rekey information and see if that helps.

GDOI-Server(config)#crypto gdoi group GDOI-G1
GDOI-Server(config-gkm-group)#server local
GDOI-Server(gkm-local-server)# rekey retransmit 10 number 3
GDOI-Server(gkm-local-server)# rekay authentication mypubkey rsa GDOI-Server-Key
GDOI-Server(gkm-local-server)# rekey transport unicast

I am still seeing the same errors on GDOI-G1 though. I think, from reading the post linked above, that this may be due to the ACL being incorrect. Unlike the other VPN solutions, we are not overlaying, and by this, I mean that in "standard" tunnels, we have a separate IP addressing scheme, such as the 192.168.1.0/24 subnet we used with DMVPN. GETVPN doesn't work like this, so let's change the ACL and permit the subnets. The interesting thing about GET VPN (well, GDOI to be exact) is that the Key Server (GDOI-Server in our example), downloads the IPSec policy to the GMs (Group members, which are GDOI-G1 and GDOI-G2). In this ACL we define the traffic we need to encrypt, but also the traffic which needs to excluded (OSPF and the GETVPN traffic, UDP port 848). We can have different ACLs per group, so we now get something along the lines of:

ip access-list extended G1
no permit ip 192.168.2.0 0.0.0.255 192.168.2.0 0.0.0.255
deny udp any eq 848 any eq 848
deny tcp any host 224.0.0.5
deny tcp any host 224.0.0.6
permit ip 10.1.12.0 0.0.0.255 10.1.13.0 0.0.0.255
ip access-list extended G2
no permit ip 192.168.3.0 0.0.0.255 192.168.3.0 0.0.0.255
deny udp any eq 848 any eq 848
deny tcp any host 224.0.0.5
deny tcp any host 224.0.0.6
permit ip 10.1.12.0 0.0.0.255 10.1.14.0 0.255.255.255

Even with the change in ACL the same errors occurred. It was only when switching to the physical interface on the GDOI-Server, that there was some success:

GDOI-Server(config)#crypto gdoi group GDOI-G1
GDOI-Server(config-gkm-group)#server local
GDOI-Server(gkm-local-server)#address ipv4 10.1.12.7

GDOI-G1#sh crypto gdoi
GROUP INFORMATION

    Group Name               : GDOI-G1
    Group Identity           : 1
    Group Type               : GDOI (ISAKMP)
    Crypto Path              : ipv4
    Key Management Path      : ipv4
    Rekeys received          : 2
    IPSec SA Direction       : Both

     Group Server list       : 10.1.12.7

Group Member Information For Group GDOI-G1:
    IPSec SA Direction       : Both
    ACL Received From KS     : gdoi_group_GDOI-G1_temp_acl

    Group member             : 10.1.13.8       vrf: None
       Local addr/port       : 10.1.13.8/848
       Remote addr/port      : 10.1.12.7/848
       fvrf/ivrf             : None/None
       Version               : 1.0.12
       Registration status   : Registered
       Registered with       : 10.1.12.7
       Re-registers in       : 3366 sec
       Succeeded registration: 1
       Attempted registration: 1
       Last rekey from       : 10.1.12.7
       Last rekey seq num    : 0
       Unicast rekey received: 2
       Rekey ACKs sent       : 2
       Rekey Rcvd(hh:mm:ss)  : 00:00:08
       DP Error Monitoring   : OFF
       IPSEC init reg executed    : 0
       IPSEC init reg postponed   : 0
       Active TEK Number     : 2
       SA Track (OID/status) : disabled

       allowable rekey cipher: any
       allowable rekey hash  : any
       allowable transformtag: any ESP

    Rekeys cumulative
       Total received        : 2
       After latest register : 2
       Rekey Acks sents      : 2

 ACL Downloaded From KS 10.1.12.7:
   access-list   deny udp any port = 848 any port = 848
   access-list   deny tcp any host 224.0.0.5
   access-list   deny tcp any host 224.0.0.6
   access-list   permit ip 10.1.12.0 0.0.0.255 10.1.13.0 0.0.0.255

KEK POLICY:
    Rekey Transport Type     : Unicast
    Lifetime (secs)          : 86370
    Encrypt Algorithm        : 3DES
    Key Size                 : 192
    Sig Hash Algorithm       : HMAC_AUTH_SHA
    Sig Key Length (bits)    : 1296

TEK POLICY for the current KS-Policy ACEs Downloaded:
  GigabitEthernet0/1:
    IPsec SA:
        spi: 0x7CD79516(2094503190)
        transform: esp-3des esp-sha-hmac
        sa timing:remaining key lifetime (sec): (3572)
        Anti-Replay(Counter Based) : 64
        tag method : disabled
        alg key size: 24 (bytes)
        sig key size: 20 (bytes)
        encaps: ENCAPS_TUNNEL

    IPsec SA:
        spi: 0x23E7E211(602399249)
        transform: esp-3des esp-sha-hmac
        sa timing:remaining key lifetime (sec): (152)
        Anti-Replay(Counter Based) : 64
        tag method : disabled
        alg key size: 24 (bytes)
        sig key size: 20 (bytes)
        encaps: ENCAPS_TUNNEL

GDOI-G1#

GDOI-Server#sh crypto gdoi
GROUP INFORMATION

    Group Name               : GDOI-G1 (Unicast)
    Re-auth on new CRL       : Disabled
    Group Identity           : 1
    Group Type               : GDOI (ISAKMP)
    Crypto Path              : ipv4
    Key Management Path      : ipv4
    Group Members            : 1
    IPSec SA Direction       : Both
    Group Rekey Lifetime     : 86400 secs
    Group Rekey
        Remaining Lifetime   : 86232 secs
        Time to Rekey        : 85997 secs
        Acknowledgement Cfg  : Cisco
    Rekey Retransmit Period  : 10 secs
    Rekey Retransmit Attempts: 3
    Group Retransmit
        Remaining Lifetime   : 0 secs

      IPSec SA Number        : 1
      IPSec SA Rekey Lifetime: 3600 secs
      Profile Name           : GET-Profile
      Replay method          : Count Based
      Replay Window Size     : 64
      Tagging method         : Disabled
      SA Rekey
         Remaining Lifetime  : 3433 secs
        Time to Rekey        : 3037 secs
      ACL Configured         : access-list G1

     Group Server list       : Local

GDOI-Server#

Let's finish off and add the other group in. This time we will set the isakmp profile to match the physical address of the server. This makes more sense, but the G1 router is still using 7.7.7.7, so what will happen?:

GDOI-G2(config)#crypto isakmp policy 10
GDOI-G2(config-isakmp)# encr 3des
GDOI-G2(config-isakmp)# authentication pre-share
GDOI-G2(config-isakmp)# hash sha
GDOI-G2(config-isakmp)# group 2
GDOI-G2(config-isakmp)# lifetime 3600
GDOI-G2(config-isakmp)#crypto isakmp key cisco address 10.1.12.7
GDOI-G2(config)#crypto isakmp invalid-spi-recovery
GDOI-G2(config)#crypto isakmp keepalive 10
GDOI-G2(config)#crypto isakmp profile GET-Profile
% A profile is deemed incomplete until it has match identity statements
GDOI-G2(conf-isa-prof)#   match identity address 10.1.12.7 255.255.255.255
GDOI-G2(conf-isa-prof)#!
GDOI-G2(conf-isa-prof)#!
GDOI-G2(conf-isa-prof)#$c transform-set GET-TS esp-3des esp-sha-hmac
GDOI-G2(cfg-crypto-trans)# mode tunnel
GDOI-G2(cfg-crypto-trans)#!
GDOI-G2(cfg-crypto-trans)#crypto ipsec profile GET-Profile
GDOI-G2(ipsec-profile)# set transform-set GET-TS
GDOI-G2(ipsec-profile)#!
GDOI-G2(ipsec-profile)#!
GDOI-G2(ipsec-profile)#crypto gdoi group GDOI-G2
GDOI-G2(config-gkm-group)# identity number 2
GDOI-G2(config-gkm-group)# server address ipv4 10.1.12.7
GDOI-G2(config-gkm-group)# client registration interface GigabitEthernet0/2
GDOI-G2(config-gkm-group)#!
GDOI-G2(config-gkm-group)#!
GDOI-G2(config-gkm-group)#crypto map G2 10 gdoi
% NOTE: This new crypto map will remain disabled until a valid
        group has been configured.
GDOI-G2(config-crypto-map)# set group GDOI-G2
GDOI-G2(config-crypto-map)#!
GDOI-G2(config-crypto-map)#crypto map GDOI-G2 isakmp-profile GET-Profile
GDOI-G2(config)#!
GDOI-G2(config)#interface GigabitEthernet0/2
GDOI-G2(config-if)# crypto map G2
GDOI-G2(config-if)#
*Jul  6: %CRYPTO-6-GDOI_ON_OFF: GDOI is ON
*Jul  6: %CRYPTO-5-GM_REGSTER: Start registration to KS 10.1.12.7 for group GDOI-G2 using address 10.1.14.9 fvrf default ivrf default
*Jul  6: %CRYPTO-4-IKMP_NO_SA: IKE message from 10.1.12.7 has no SA and is not an initialization offer
GDOI-G2(config-if)#
*Jul  6: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Main mode failed with peer at 10.1.12.7
GDOI-G2(config-if)#

We see the same issues with the SA until we change the match statement in the ipsec profile:

GDOI-G2(config)#crypto isakmp profile GET-Profile
GDOI-G2(conf-isa-prof)#   match identity address 7.7.7.7 255.255.255.255
GDOI-G2(conf-isa-prof)#no   match identity address 10.1.12.7 255.255.255.0
GDOI-G2(conf-isa-prof)#int gi 0/2
GDOI-G2(config-if)#shut
GDOI-G2(config-if)#
*Jul  6: %OSPF-5-ADJCHG: Process 1, Nbr 10.1.12.1 on GigabitEthernet0/2 from FULL to DOWN, Neighbor Down: Interface down or detached
GDOI-G2(config-if)#
*Jul  6: %LINK-5-CHANGED: Interface GigabitEthernet0/2, changed state to administratively down
*Jul  6: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/2, changed state to down
GDOI-G2(config-if)#
GDOI-G2(config-if)#no shut
GDOI-G2(config-if)#
*Jul  6: %LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to up
*Jul  6: %CRYPTO-5-GM_REGSTER: Start registration to KS 10.1.12.7 for group GDOI-G2 using address 10.1.14.9 fvrf default ivrf default
*Jul  6: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/2, changed state to up
*Jul  6: %OSPF-5-ADJCHG: Process 1, Nbr 10.1.12.1 on GigabitEthernet0/2 from LOADING to FULL, Loading Done
*Jul  6: %CRYPTO-4-IKMP_NO_SA: IKE message from 10.1.12.7 has no SA and is not an initialization offer
*Jul  6: %GDOI-5-SA_TEK_UPDATED: SA TEK was updated
*Jul  6: %GDOI-5-SA_KEK_UPDATED: SA KEK was updated 0x24FF75BFCD871C9755FE4868CC8A1369
*Jul  6: %GDOI-5-GM_REGS_COMPL: Registration to KS 10.1.12.7 complete for group GDOI-G2 using address 10.1.14.9 fvrf default ivrf default
*Jul  6: %GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 10.1.12.7 for group GDOI-G2 & gm identity 10.1.14.9 fvrf default ivrf default
GDOI-G2(config-if)#do sh crypto gdoi
GROUP INFORMATION

    Group Name               : GDOI-G2
    Group Identity           : 2
    Group Type               : GDOI (ISAKMP)
    Crypto Path              : ipv4
    Key Management Path      : ipv4
    Rekeys received          : 0
    IPSec SA Direction       : Both

     Group Server list       : 10.1.12.7

Group Member Information For Group GDOI-G2:
    IPSec SA Direction       : Both
    ACL Received From KS     : gdoi_group_GDOI-G2_temp_acl

    Group member             : 10.1.14.9       vrf: None
       Local addr/port       : 10.1.14.9/848
       Remote addr/port      : 10.1.12.7/848
       fvrf/ivrf             : None/None
       Version               : 1.0.12
       Registration status   : Registered
       Registered with       : 10.1.12.7
       Re-registers in       : 1097 sec
       Succeeded registration: 1
       Attempted registration: 8
       Last rekey from       : 0.0.0.0
       Last rekey seq num    : 0
       Unicast rekey received: 0
       Rekey ACKs sent       : 0
       Rekey Received        : never
       DP Error Monitoring   : OFF
       IPSEC init reg executed    : 0
       IPSEC init reg postponed   : 0
       Active TEK Number     : 1
       SA Track (OID/status) : disabled

       allowable rekey cipher: any
       allowable rekey hash  : any
       allowable transformtag: any ESP

    Rekeys cumulative
       Total received        : 0
       After latest register : 0
       Rekey Acks sents      : 0

 ACL Downloaded From KS 10.1.12.7:
   access-list   deny udp any port = 848 any port = 848
   access-list   deny tcp any host 224.0.0.5
   access-list   deny tcp any host 224.0.0.6
   access-list   permit ip 10.1.12.0 0.0.0.255 10.1.14.0 0.0.0.255

KEK POLICY:
    Rekey Transport Type     : Unicast
    Lifetime (secs)          : 83974
    Encrypt Algorithm        : 3DES
    Key Size                 : 192
    Sig Hash Algorithm       : HMAC_AUTH_SHA
    Sig Key Length (bits)    : 1296

TEK POLICY for the current KS-Policy ACEs Downloaded:
  GigabitEthernet0/2:
    IPsec SA:
        spi: 0xA6F83D47(2801286471)
        transform: esp-3des esp-sha-hmac
        sa timing:remaining key lifetime (sec): (1176)
        Anti-Replay(Counter Based) : 64
        tag method : disabled
        alg key size: 24 (bytes)
        sig key size: 20 (bytes)
        encaps: ENCAPS_TUNNEL

GDOI-G2(config-if)#

This seems pretty counter-intuitive. The ISAKMP profile is matching the loopback address, instead of the physical interface IP address on the GDOI-Server. surely, it would make more sense to match the interface that is sourcing the packets, right? Well, if you look at the linked blog post, there is no ISAKMP profile set, so do we need one? Let's remove it and find out:

GDOI-G1(config)#no crypto map GDOI-G1 isakmp-profile GET-Profile
GDOI-G1(config)#no crypto isakmp profile GET-Profile
GDOI-G1(config)#end

GDOI-G2(config)#no crypto map GDOI-G2 isakmp-profile GET-Profile
GDOI-G2(config)#no crypto isakmp profile GET-Profile
GDOI-G2(config)#end

GDOI-Server#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
10.1.12.7       10.1.13.8       GDOI_IDLE         1025 ACTIVE
10.1.12.7       10.1.14.9       GDOI_IDLE         1027 ACTIVE

IPv6 Crypto ISAKMP SA

GDOI-Server#
GDOI-Server#sh crypto gdoi | i Name|Members
    Group Name               : GDOI-G1 (Unicast)
    Group Members            : 1
      Profile Name           : GET-Profile
    Group Name               : GDOI-G2 (Multicast)
    Group Members            : 1
      Profile Name           : GET-Profile
GDOI-Server#

So, less is more! Whilst we need an ISAKMP profile for Easy VPN, we don't need for GET VPN, and we didn't use it for DMVPN either. This is confirmed by reading this post from INE. this then begs the question, when do we use ISAKMP profiles?

ISAKMP Profiles

ISAKMP profiles are used under these conditions:

• When a router has two or more IPSec connections that have different Phase 1 parameters
• When using Easy VPN
• If different IKE v1 policies are used between different peers
• When using VRFs with different IKE Phase 1 parameters, but the same IP address.

ISAKMP profiles match peers on one or more attributes, such as address, hostname, username and so on. We can then use these to set different parameters, such as QoS groupings.

Here is the link (again) to the Cisco doc, with some useful scenario configurations for ISAKMP profiles.

Now that this is fixed, can we go back to hosting our GETVPN frm the loopback address?

GDOI-Server(config)#crypto gdoi group GDOI-G1
GDOI-Server(config-gkm-group)#server local
GDOI-Server(gkm-local-server)#sa ipsec 1
GDOI-Server(gkm-sa-ipsec)#address ipv4 7.7.7.7
GDOI-Server(gkm-sa-ipsec)
GDOI-Server(gkm-sa-ipsec)#crypto gdoi group GDOI-G2
GDOI-Server(config-gkm-group)#server local
GDOI-Server(gkm-local-server)#sa ipsec 1
GDOI-Server(gkm-sa-ipsec)#address ipv4 7.7.7.7
GDOI-Server(gkm-local-server)#

GDOI-G1(config)#crypto gdoi group GDOI-G1
GDOI-G1(config-gkm-group)#no server address ipv4 10.1.12.7
GDOI-G1(config-gkm-group)#server address ipv4 7.7.7.7
GDOI-G1(config-gkm-group)#
*Jul  6: %GDOI-4-GM_RE_REGISTER: The IPSec SA created for group GDOI-G1 may have expired/been cleared, or didn't go through. Re-register to KS.
*Jul  6: %CRYPTO-5-GM_REGSTER: Start registration to KS 7.7.7.7 for group GDOI-G1 using address 10.1.13.8 fvrf default ivrf default
*Jul  6: %CRYPTO-4-IKMP_NO_SA: IKE message from 7.7.7.7 has no SA and is not an initialization offer
*Jul  6: %GDOI-5-SA_TEK_UPDATED: SA TEK was updated
*Jul  6: %GDOI-5-SA_KEK_UPDATED: SA KEK was updated 0x6F792E443640770041679976AEFA1022
*Jul  6: %GDOI-5-GM_REGS_COMPL: Registration to KS 7.7.7.7 complete for group GDOI-G1 using address 10.1.13.8 fvrf default ivrf default
*Jul  6: %GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 7.7.7.7 for group GDOI-G1 & gm identity 10.1.13.8 fvrf default ivrf default
GDOI-G1(config-gkm-group)#

GDOI-G2(config)#crypto gdoi grou GDOI-G2
GDOI-G2(config-gkm-group)#no server address ipv4 10.1.12.7
GDOI-G2(config-gkm-group)#server address ipv4 7.7.7.7
GDOI-G2(config-gkm-group)#
*Jul  6: %GDOI-4-GM_RE_REGISTER: The IPSec SA created for group GDOI-G2 may have expired/been cleared, or didn't go through. Re-register to KS.
*Jul  6: %CRYPTO-5-GM_REGSTER: Start registration to KS 7.7.7.7 for group GDOI-G2 using address 10.1.14.9 fvrf default ivrf default
*Jul  6: %GDOI-5-SA_TEK_UPDATED: SA TEK was updated
*Jul  6: %GDOI-5-GM_REGS_COMPL: Registration to KS 7.7.7.7 complete for group GDOI-G2 using address 10.1.14.9 fvrf default ivrf default
*Jul  6: %GDOI-5-GM_INSTALL_POLICIES_SUCCESS: SUCCESS: Installation of Reg/Rekey policies from KS 7.7.7.7 for group GDOI-G2 & gm identity 10.1.14.9 fvrf default ivrf default
GDOI-G2(config-gkm-group)#


GDOI-Server#sh crypto isakmp sa            
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
7.7.7.7         10.1.13.8       GDOI_IDLE         1028 ACTIVE
7.7.7.7         10.1.14.9       GDOI_IDLE         1029 ACTIVE

IPv6 Crypto ISAKMP SA

GDOI-Server#sh crypto gdoi | i Name|Members
    Group Name               : GDOI-G1 (Unicast)
    Group Members            : 1
      Profile Name           : GET-Profile
    Group Name               : GDOI-G2 (Unicast)
    Group Members            : 1
      Profile Name           : GET-Profile
GDOI-Server#

Yes we can. It looks like the ISAKMP profile was stopping the ability to have the loopback address on the GDOI-Server as the pinpoint for the client VPNs, once this was fixed, everything works as it should.

For our needs so far, we have not needed to use ISAKMP profiles, though, but that will change when we come to look at Easy VPN, which is up next.