Reply
New Member
Posts: 15
Registered: ‎04-18-2017
Solutions: 1
Accepted Solution

Transit Address Question

Hello, everyone

 

I am needing some guidance on setting up an ER-L with a /29 public block and a assigned /30 for connection to the ISP (ATT Fiber). I would like to use both my transit address and public block of /29 on the EdgeRouter Lite, and configure two IPsec VPN's.

 

Right now, I have my assigned transit network of /30 on eth0, and I utilize NAT to determine which address out of the /29 to go out as on eth0. This brings me to my first question, is that right? Icon Neutral

 

Addtionally, I have two other ER-X's at remote locations that have their own /29 blocks, but with no transit addresses. I am able to build site-to-site VPN's between the to ER-X's and pass traffic, but not on the ER-L. I recieve no output from show vpn ipsec sa, nor do I recieve output from sudo swanctl --log from the Lite.

 

Here is the current VPN config on the ER-L:

 

vpn {
    ipsec {
        auto-firewall-nat-exclude enable
        esp-group FOO0 {
            proposal 1 {
                encryption aes128
                hash sha1
            }
        }
        ike-group FOO0 {
            key-exchange ikev2
            proposal 1 {
                dh-group 14
                encryption aes128
                hash sha1
            }
        }
        site-to-site {
            peer 24.xxx.xxx.xxx {
                authentication {
                    mode pre-shared-secret
                    pre-shared-secret ****************
                }
                connection-type initiate
                description "Theodore to Gulfport"
                ike-group FOO0
                local-address 12.xxx.xxx.xxx
                tunnel 1 {
                    esp-group FOO0
                    local {
                        prefix 192.168.100.0/24
                    }
                    remote {
                        prefix 192.168.2.0/24
                    }
                }
            }
        }
    }
}

And here is the VPN config on one of the ER-X's:

 

vpn {
    ipsec {
        auto-firewall-nat-exclude enable
        esp-group FOO0 {
            proposal 1 {
                encryption aes128
                hash sha1
            }
        }
        ike-group FOO0 {
            key-exchange ikev2
            proposal 1 {
                dh-group 14
                encryption aes128
                hash sha1
            }
        }
        site-to-site {
            peer 12.xxx.xxx.xxx {
                authentication {
                    mode pre-shared-secret
                    pre-shared-secret ****************
                }
                connection-type initiate
                description "Gulfport to Theodore"
                ike-group FOO0
                local-address 24.xxx.xxx.xxx
                tunnel 1 {
                    esp-group FOO0
                    local {
                        prefix 192.168.2.0/24
                    }
                    remote {
                        prefix 192.168.100.0/24
                    }
                }
            }
        }
    }
}

As well as the output of sudo swanctl --log from the same ER-X:

 

15[KNL] creating acquire job for policy 192.168.2.100/32[udp/62449] === 192.168.100.249/32[udp/snmp] with reqid {1}
05[IKE] initiating IKE_SA peer-12.221.xxx.xxx-tunnel-1[1] to 12.221.xxx.xxx
05[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
05[NET] sending packet: from 24.117.xxx.xxx[500] to 12.221.xxx.xxx[500] (432 bytes)
11[IKE] retransmit 1 of request with message ID 0
11[NET] sending packet: from 24.117.xxx.xxx[500] to 12.221.xxx.xxx[500] (432 bytes)
01[IKE] retransmit 2 of request with message ID 0
01[NET] sending packet: from 24.117.xxx.xxx[500] to 12.221.xxx.xxx[500] (432 bytes)
07[IKE] retransmit 3 of request with message ID 0
07[NET] sending packet: from 24.117.xxx.xxx[500] to 12.221.xxx.xxx[500] (432 bytes)
10[IKE] retransmit 4 of request with message ID 0
10[NET] sending packet: from 24.117.xxx.xxx[500] to 12.221.xxx.xxx[500] (432 bytes)
01[IKE] retransmit 5 of request with message ID 0
01[NET] sending packet: from 24.117.xxx3xxx[500] to 12.221.xxx.xxx[500] (432 bytes)
09[IKE] giving up after 5 retransmits
09[IKE] peer not responding, trying again (2/0)

 

 

So, now what?

 

Thanks for your time.

 


Accepted Solutions
Highlighted
New Member
Posts: 15
Registered: ‎04-18-2017
Solutions: 1

Re: Transit Address Question

[ Edited ]

I got this resolved. I realized that I was overthinking it.

 

Solution:

 

What I failed to realize is that although I could pass traffic over the IP of my choosing using NAT exclusively, I did not have the public IP's on the NIC, only the transit address. As soon as I added both the transit address and public IP's to eth0, everything came together. Simple mistake, but maybe this will help someone else in the future.

 

What I had before:

 

eth0: 12.xxx.xxx.116/30

 

SNAT rule set to interface eth0 using 12.xxx.xxx.81/29

 

 

What fixed the issue:

 

eth0: 12.xxx.xxx.116/30; 12.xxx.xxx.81/29

 

SNAT rule set to interface eth0 using 12.xxx.xxx.81/29

View solution in original post


All Replies
Veteran Member
Posts: 6,852
Registered: ‎03-24-2016
Kudos: 1780
Solutions: 785

Re: Transit Address Question

Hard to tell without seeing config.

 

I'm thinking in the direction:

You're using transit address as VPN peer, and sNAT rule catches it, translating the source IP.

New Member
Posts: 15
Registered: ‎04-18-2017
Solutions: 1

Re: Transit Address Question

[ Edited ]

Here is the sanatized config. I know that my firewall rules are a little wonky at the moment, but I don't think they are having any ill effect right now, so I will clean them up later unless they are whats causing my issue. Thanks again.

 

EDIT: I have one address-group setup, but I am not using any groups in any of my rules yet.

 

 

firewall {
    all-ping enable
    broadcast-ping disable
    group {
        address-group Milton_Gulfport_WAN {
            description "WAN IPs from Gulfport and Milton"
        }
    }
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name FTGC_Theodore_WAN_In {
        default-action drop
        description "Traffic destined for LAN"
        rule 20 {
            action accept
            description RDP
            destination {
                port xxxxx
            }
            log disable
            protocol tcp_udp
        }
        rule 30 {
            action accept
            description "Allow Established/Related"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 40 {
            action drop
            description "Drop Invalid State"
            log disable
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
        rule 50 {
            action accept
            description "PWW Access"
            destination {
                port 443
            }
            log disable
            protocol tcp
        }
    }
    name FTGC_Theodore_WAN_Local {
        default-action drop
        description "Traffic destined for EdgeRouter"
        rule 10 {
            action accept
            description "IPSec Gulfport"
            destination {
                address 192.168.100.0/24
            }
            ipsec {
                match-ipsec
            }
            log disable
            protocol all
            source {
                address 192.168.2.0/24
            }
        }
        rule 20 {
            action accept
            description GUI
            destination {
                port xxxxx
            }
            log disable
            protocol tcp
        }
        rule 30 {
            action accept
            description IKE
            destination {
                port 500
            }
            log disable
            protocol udp
        }
        rule 40 {
            action accept
            description ESP
            destination {
            }
            log disable
            protocol esp
        }
        rule 50 {
            action accept
            description NAT-T
            destination {
                port 4500
            }
            log disable
            protocol udp
        }
        rule 60 {
            action accept
            description "Allow Established/Related"
            log disable
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
        rule 70 {
            action drop
            description "Drop Invalid State"
            log disable
            protocol all
            state {
                established disable
                invalid enable
                new disable
                related disable
            }
        }
        rule 80 {
            action accept
            description ICMP
            log disable
            protocol icmp
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        address 12.249.xxx.xxx/30
        duplex full
        firewall {
            in {
                name FTGC_Theodore_WAN_In
            }
            local {
                name FTGC_Theodore_WAN_Local
            }
        }
        ip {
        }
        speed 100
        traffic-policy {
            out test
        }
    }
    ethernet eth1 {
        address 192.168.101.1/24
        duplex auto
        speed auto
    }
    ethernet eth2 {
        address 192.168.100.1/24
        duplex auto
        speed auto
    }
    loopback lo {
    }
}
port-forward {
    auto-firewall disable
    hairpin-nat disable
    wan-interface eth0
}
protocols {
    static {
    }
}
service {
    dhcp-server {
        disabled false
        hostfile-update disable
        shared-network-name FTGC_Theodore_DHCP {
            authoritative disable
            subnet 192.168.100.0/24 {
                default-router 192.168.100.1
                dns-server 192.168.100.5
                dns-server 192.168.100.11
                domain-name food.local
                lease 86400
                start 192.168.100.101 {
                    stop 192.168.100.200
                }
            }
        }
        static-arp disable
        use-dnsmasq disable
    }
    dns {
        forwarding {
            listen-on eth2
        }
    }
    gui {
        http-port 80
        https-port 10443
        older-ciphers enable
    }
    nat {
        rule 1 {
            description FTGC_DNAT_PWW
            destination {
                address 12.221.xxx.xxx
                port 443
            }
            inbound-interface eth0
            inside-address {
                address 192.168.100.9
            }
            log disable
            protocol tcp
            type destination
        }
        rule 2 {
            description FTGC_DNAT_ICMP
            destination {
            }
            inbound-interface eth0
            inside-address {
                address 192.168.100.1
            }
            log disable
            protocol icmp
            type destination
        }
        rule 3 {
            description IKE
            destination {
                group {
                    address-group ADDRv4_eth0
                }
                port 500
            }
            inbound-interface eth0
            inside-address {
                address 192.168.100.1
            }
            log disable
            protocol udp
            type destination
        }
        rule 4 {
            description ESP
            destination {
                address 12.221.xxx.xxx
            }
            inbound-interface eth0
            inside-address {
                address 192.168.100.1
            }
            log disable
            protocol esp
            type destination
        }
        rule 5 {
            description NAT-T
            destination {
                address 12.221.xxx.xxx
                port 4500
            }
            inbound-interface eth0
            inside-address {
                address 192.168.100.1
            }
            log disable
            protocol udp
            type destination
        }
        rule 6 {
            description FTGC_DNAT_RDP
            destination {
                address 12.221.xxx.xxx
                port xxxxx
            }
            inbound-interface eth0
            inside-address {
                address 192.168.100.192
                port xxxxx
            }
            log disable
            protocol tcp_udp
            type destination
        }
        rule 7 {
            description FTGC_DNAT_GUI
            destination {
                address 12.221.xxx.xxx
                port xxxxx
            }
            inbound-interface eth0
            inside-address {
                address 192.168.100.1
            }
            log disable
            protocol tcp_udp
            type destination
        }
        rule 8 {
            description FTGC_DNAT_RDP_Terminal
            destination {
                address 12.221.xxx.xxx
                port xxx
            }
            inbound-interface eth0
            inside-address {
                address 192.168.xxx.xxx
                port 

            log disable
            protocol tcp
            type destination
        }
        rule 5001 {
            description FTGC_SNAT_82
            log disable
            outbound-interface eth0
            outside-address {
                address 12.221.xxx.xxx
            }
            protocol all
            source {
                address 192.168.100.0/24
            }
            type source
        }
    }
   
system {
    domain-name food.local
    gateway-address 12.249.xxx.xxx
    host-name FTGCT-ERL
    
    }
    name-server 1.1.1.1
    name-server 1.0.0.1
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone UTC
    traffic-analysis {
        dpi enable
        export enable
    }
}
traffic-control {
}
traffic-policy {
    }
    shaper ATT-up {
        bandwidth 50mbit
        default {
            bandwidth 100%
            burst 16k
        }
    }
}
vpn {
    ipsec {
        auto-firewall-nat-exclude enable
        esp-group FOO0 {
            proposal 1 {
                encryption aes128
                hash sha1
            }
        }
        ike-group FOO0 {
            key-exchange ikev2
            proposal 1 {
                dh-group 14
                encryption aes128
                hash sha1
            }
        }
        site-to-site {
            peer 24.117.xxx.xxx {
                authentication {
                    mode pre-shared-secret
                    pre-shared-secret ****************
                }
                connection-type initiate
                description "Theodore to Gulfport"
                ike-group FOO0
                local-address 12.221.xxx.xxx
                tunnel 1 {
                    esp-group FOO0
                    local {
                        prefix 192.168.100.0/24
                    }
                    remote {
                        prefix 192.168.2.0/24
                    }
                }
            }
        }
    }
}


 

Highlighted
New Member
Posts: 15
Registered: ‎04-18-2017
Solutions: 1

Re: Transit Address Question

[ Edited ]

I got this resolved. I realized that I was overthinking it.

 

Solution:

 

What I failed to realize is that although I could pass traffic over the IP of my choosing using NAT exclusively, I did not have the public IP's on the NIC, only the transit address. As soon as I added both the transit address and public IP's to eth0, everything came together. Simple mistake, but maybe this will help someone else in the future.

 

What I had before:

 

eth0: 12.xxx.xxx.116/30

 

SNAT rule set to interface eth0 using 12.xxx.xxx.81/29

 

 

What fixed the issue:

 

eth0: 12.xxx.xxx.116/30; 12.xxx.xxx.81/29

 

SNAT rule set to interface eth0 using 12.xxx.xxx.81/29

Reply