IPv6 multicast over IPv6 IPSec VTI
October 7, 2013 Leave a comment
IPv4 IPSec doesn’t support multicast, we need to use GRE (unicast) to encapsulate multicast traffic and encrypt it. As a consequence, more complication and an additional level of routing, so less performance.
One of the advantages of IPv6 is the support of IPSec authentication and encryption (AH, ESP) right in the extension headers, which makes it natively support IPv6 multicast.
In this lab we will be using IPv6 IPSec site-to-site protection using VTI to natively support IPv6 multicast.
The configuration involves three topics: IPv6 routing, IPv6 IPSec and IPv6 multicast. Each process is built on the top the previous one, so before touching IPsec, make sure you have local connectivity for each segment of the network and complete reachability through IPv6 routing.
Next step, you can move to IPv6 IPSec and change routing configuration accordingly (through VTI).
IPv6 multicast relies on a solid foundation of unicast reachability, so once you have routes exchanged between the two sides through the secure connection you can start configuring IPv6 multicast (BSR, RP, client and server simulation).
Picture1: Lab topology
Lab outline
- Routing
- OSPFv3
- EIGRP for IPv6
- IPv6 IPSec
- Using IPv6 IPSec VTI
- Using OSPFv3 IPSec security feature
- IPv6 Multicast
- IPv6 PIM BSR
- Offline lab
- Troubleshooting cases
- Performance testing
Routing
Note: IPv6 Routing relies on link-local addresses, so for troubleshooting purpose, link-local IPs are configured to be similar to their respective global addresses, so they are easily recognisable. This will be of a tremendous help during troubleshooting. Otherwise you will find yourself trying to decode the matrix : ) |
OSPFv3
Needs an interface configured with IPv4 address for Router-id
OSPFv3 offloads security to IPv6 native IPv6, so you can secure OSPFv3 communications on purpose: per- interface or per-area basis.
Table1: OSPFv3 configuration
R2 | R1 | |
IPv6 routing processes need IPv4-format router ids | ipv6 router ospf 12 router-id 2.2.2.2 |
ipv6 router ospf 12 router-id 1.1.1.1 |
Announce respective LAN interfaces | interface FastEthernet0/1 ipv6 ospf 12 area 22 |
interface FastEthernet0/1 ipv6 ospf 12 area 11 |
Disable routing on the physical BTB connection to avoid RPF failure | interface FastEthernet0/0 ipv6 ospf 12 … |
interface FastEthernet0/0 ipv6 ospf 12 … |
IPv6 gateways exchange routes through the VTI encrypted interface | interface Tunnel12 ipv6 ospf network point-to-point ipv6 ospf 12 area 0 |
interface Tunnel12 ipv6 ospf network point-to-point ipv6 ospf 12 area 0 |
Set the ospf network type on loopback interfaces if you want to advertise masks other that 128-length | interface Loopback0 ipv6 ospf network point-to-point ipv6 ospf 12 area 0 |
interface Loopback0 ipv6 ospf network point-to-point ipv6 ospf 12 area 0 |
Table2: EIGRP for IPv6 configuration
R2 | R1 | |
IPv6 routing processes need IPv4-format router ids | ipv6 router eigrp 12 eigrp router-id 2.2.2.2 |
ipv6 router eigrp 12 eigrp router-id 1.1.1.1 |
Announce respective LAN interfaces | interface FastEthernet0/1 ipv6 eigrp 12 |
interface FastEthernet0/1 ipv6 eigrp 12 |
Disable routing on the physical BTB connection to avoid RPF failure | interface FastEthernet0/0 ipv6 eigrp 12 |
interface FastEthernet0/0 ipv6 eigrp 12 |
IPv6 gateways exchange routes through the VTI encrypted interface | interface Tunnel12 ipv6 eigrp 12 |
interface Tunnel12 ipv6 eigrp 12 |
Set the ospf network type on loopback interfaces if you want to advertise masks other that 128-length | interface Loopback0 ipv6 ospf network point-to-point ipv6 ospf 12 area 0 |
interface Loopback0 ipv6 ospf network point-to-point ipv6 ospf 12 area 0 |
Enable EIGRP process | ipv6 router eigrp 12 no shutdown |
ipv6 router eigrp 12 no shutdown |
In case you want to configure EIGRP for IPv6:
– No shutdown inside EIGRP configuration mode
– Similarly to OSPFv3, we need an interface configured with IPv4 address for Router-id
IPv6 IPSec
- Using IPv6 IPSec VTI
Table3: IPSec configuration
R1 | R2 | |
Set the type of ISAKMP authentication | crypto keyring keyring1 pre-shared-key address ipv6 2001:DB8::2/128 key cisco |
crypto keyring keyring1 pre-shared-key address ipv6 2001:DB8::1/128 key cisco |
crypto isakmp key cisco address ipv6 2001:DB8::2/128 | crypto isakmp key cisco address ipv6 2001:DB8::1/128 | |
ISAKMP profile | crypto isakmp policy 10 encr 3des hash md5 authentication pre-share lifetime 3600 |
crypto isakmp policy 10 encr 3des hash md5 authentication pre-share lifetime 3600 |
Transform sets: symmetric encryption and signed hash algorithms | crypto ipsec transform-set 3des ah-sha-hmac esp-3des | crypto ipsec transform-set 3des ah-sha-hmac esp-3des |
crypto ipsec profile profile0 set transform-set 3des |
crypto ipsec profile profile0 set transform-set 3des |
|
Tunnel mode and bind the ipsec profile | interface Tunnel12 ipv6 address FE80::DB8:12:1 link-local ipv6 address 2001:DB8:12::1/64 tunnel source FastEthernet0/0 tunnel destination 2001:DB8::2 tunnel mode ipsec ipv6 tunnel protection ipsec profile profile0 |
interface Tunnel12 ipv6 address FE80::DB8:12:2 link-local ipv6 address 2001:DB8:12::2/64 tunnel source FastEthernet0/0 tunnel destination 2001:DB8::1 tunnel mode ipsec ipv6 tunnel protection ipsec profile profile0 |
Make sure to not advertise the routes through the physical interface to avoid RPF failures (when the source of the multicast traffic is reached from an different interface than the one provided by the RIB) | interface FastEthernet0/0 ipv6 address FE80::DB8:1 link-local ipv6 address 2001:DB8::1/64 ipv6 enable |
interface FastEthernet0/0 ipv6 address FE80::DB8:2 link-local ipv6 address 2001:DB8::2/64 ipv6 enable |
Here is a capture of the traffic (secured) between R1 and R2 gateways
Picture2: Wireshark IPv6 IPSec trafic capture
What could go wrong?
– Encryption doesn’t match
– Shared key doesn’t match
– Wrong ISAKMP peers
– ACL in the path between the 2 gateways blocking gateways IPs or protocol 500
– IPSec profile no assigned to the tunnel int ( tunnel protection ipsec profile < …>)
– Ipsec Encryption and/or signed hashes don’t match.
- Using OSPFv3 IPSec security feature
You still can use IPv6 IPSec to encrypt and authenticate only OSPF per-interface basis.
OSPFv3 will use the IPv6-enabled IP Security (IPsec) secure socket API.
R1
interface FastEthernet0/0 ipv6 ospf 12 area 0 ipv6 ospf encryption ipsec spi 256 esp 3des 123456789A123456789A123456789A123456789A12345678 md5 123456789A123456789A123456789A12 |
R2
interface FastEthernet0/0 ipv6 ospf 12 area 0 ipv6 ospf encryption ipsec spi 256 esp 3des 123456789A123456789A123456789A123456789A12345678 md5 123456789A123456789A123456789A12 |
Picture4: Wireshark traffic capture – OSPFv3 IPSec feature :
Note only OSPFv3 traffic is encrypted
IPv6 Multicast
IPv6 PIM BSR
The RP (Rendez-vous point) is the point where multicast server offer meets member’s demand.
First hop routers build (S,G) source trees with candidate RPs and register directly connected multicast sources.
Candidate- RPs announce themselves to candidate-BSRs, and the latter announce the inf. to all PIM routers.
All PIM routers looking for a particular multicast group learn Candidate RP IP addresses from BSR and build (*, G) shared trees.
Table4: Multicast configuration
R1(candidate RP) | R2(candidate BSR) | |
Enable multicast routing | ipv6 multicast-routing | ipv6 multicast-routing |
R1 announced as BSR candidate | ipv6 pim bsr candidate bsr 2001:DB8:10::1 | |
R2 announced as RP candidate | ipv6 pim bsr candidate rp 2001:DB8:20::2 | |
Everything should be routed through the tunnel interface, to be encrypted | ipv6 route ::/0 Tunnel12 FE80::DB8:12:2 | ipv6 route ::/0 Tunnel12 FE80::DB8:12:1 |
For testing purpose, make one router join a multicast traffic and ping it from a LAN router on the other side or you can opt for more fun by running VLC on one host to read a network stream and stream a video from a host on the other side. | interface FastEthernet0/1 ipv6 mld join-group ff0E::5AB |
Make sure that:
- At least one router is manually configured as a candidate RP
- At least one router is manually configured as a candidate BSR
– (*,G) shared tree is spread over PIM routers from the last hop router (connected to multicast members).
– (S,G) source tree is established between the first hop router (connected to the multicast server) and the RP.
– The idea behind IPv6 PIM BSR is the same as in IPv4; here an animation explaining the process for IPv4.
Let’s check end-to-end multicast streaming:
Before going to troubleshooting here is the offline lab with all commands:
Troubleshooting
If something doesn’t work and you are stuck, isolate the area of work and inspect each process separately step by step.
Check each step using “show…” commands, so you know each time what you are looking for to spot what is wrong.
“sh run” and script comparison technique is limited by the visual perception capability which is illusory and far from being reliable.
Common routing issues
– Make sure you have successful back-to-back connectivity everywhere.
– With EIGRP for IPv6 make sure the process is enabled.
– If routing neighbors are connected through NBMA network, make sure to enable pseudo broadcasting and manually set neighbor commands.
Common IPSec issues
– ISAKMP phase
– Wrong peer
– Wrong shared password
– Not matching isakmp profile
– IPSec phase
– Not matching ipsec profile
Common PIM issues
– If routing neighbors are connected through NBMA network, make sure C-RPs and C-BSRs are locate on the main site.
– Issue with the client: => no (*,G)
– MLD query issue with the last hop.
– Last hop PIM router cannot build the shared tree.
– Issue with RP registration => no (S,G)
– Multicast server MLD issue with the 1st hop router
– 1st hop router cannot register with th RP.
– Issue with C-BSR candidate doesn’t advertise RP inf. to PIM routers (BSRs collect all candidate RPs and announce them to all PIM routers to choose the best RP for each group)
– Issue with C-RP candidate doesn’t announce themselves to C-BSRs (RPs announce to C-BSRs which multicast groups they are responsible for)
-RPF failure (the interface used to reach the multicast source, through RIB, is not the interface sourcing the multicast traffic)
Picture5: RPF Failure
Replace test case 6 with RPF failure (enable PIM & routing through physical int.)
Table5: troubleshooting cases
Case | Description | Simulated wrong configuration | Correct configuration |
1 | ISAKMP policy, encryption key mismatch | crypto isakmp policy 10 encr aes |
crypto isakmp policy 10 encr 3des |
2 | ISAKMP policy, Hash algorithm mismatch | crypto isakmp policy 10 Hash sha |
crypto isakmp policy 10 Hash md5 |
3 | Wrong ISAKMP peer | crypto isakmp key cisco address ipv6 2001:DB8::3/128 | crypto isakmp key cisco address ipv6 2001:DB8::2/128 |
4 | Wrong ISAKMP key | crypto isakmp key cisco1 address ipv6 2001:DB8::2/128 | crypto isakmp key cisco address ipv6 2001:DB8::2/128 |
5 | Wrong tunnel destination | interface Tunnel12 tunnel destination 2001:DB8::3 |
interface Tunnel12 tunnel destination 2001:DB8::2 |
6 | Wrong tunnel source | interface Tunnel12 tunnel source FastEthernet0/1 |
interface Tunnel12 tunnel source FastEthernet0/0 |
For more details about each case, refer to the offline lab below, you will find an extensive coverage of all important commands along with debug for each case:
Performance testing
Three cases are tested: multicast traffic between R1 and R2 is routed through:
– Physical interfaces (serial connection): MTU=1500 bytes
– IPv6 GRE: MTU=1456 bytes
– IPv6 IPSec VTI: MTU=1391 bytes
The following tests are performed using iperf in GNS3 lab environment, so results are to keep relative.
Picture6: Iperf testing
References
http://www.faqs.org/rfcs/rfc6226.html
http://tools.ietf.org/html/rfc5059
http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-multicast.html#wp1055997
https://supportforums.cisco.com/docs/DOC-27971
http://www.cisco.com/web/learning/le21/le39/docs/TDW_112_Prezo.pdf
http://networklessons.com/multicast/ipv6-pim-mld-example/
http://www.gogo6.com/profiles/blogs/ietf-discusses-deprecating-ipv6-fragments
http://tools.ietf.org/html/draft-taylor-v6ops-fragdrop-01
https://datatracker.ietf.org/doc/draft-bonica-6man-frag-deprecate