OSPF Encryption

[ja.aljaloud]

Hi guys,

I've got two sites and I want to connect them via OSPF but with encryption, which encryption method is the best and more secure (MD5 or MACSEC) or is there another encryption algorithm?

About the topology:

Each site has two Cisco 9300 switches, the two switches are connected with LACP, and the same for the other site.

Another question:

Can I configure the SW1-1 and SW1-2 with VRRP protocol on site 1 and the same on site 2, and after that I can configure OSPF between the tow sites?

Don't forget that SW1-1 and SW1-2 are connected with LACP.

The goal of the topology to configure OSPF with tow costs, the first one is cost 10 and the second one is cost 100, if the road 1 fails then road 2 can take the work from road 1.

Any suggestions please how to configure it?!

[MHM Cisco World]

Ospf auth is different than macsec' 

If you use ospf auth you can use md5.

For your second Q please can you elaborate more

MHM

[David Ruess]

Hello,

For OSPF encryption you can use the following document which walks you through configuring a key chain where you can choose your encryption algorithm.

IP Routing: OSPF Configuration Guide, Cisco IOS XE Gibraltar 16.10.x - OSPFv2 Cryptographic Authentication [Cisco ASR 1000 Series Aggregation Services Routers] - Cisco

Secondly your other question will need context. For example, you say "Don't forget that SW1-1 and SW1-2 are connected with LACP." How can we forget something we didn't know in the first place. You also ask for help with configuration without providing any configuration you have already completed. Can you provide a topology diagram and configuration of devices?

VRRP is local to the LAN its providing services for so if you configure VRRP in another part of your network then you can utilize the same numbers if that's what you're asking. You should use numbers that make sense for your subnets and VLANs/Networks..

-David

[ja.aljaloud]

Hello,

i have already provided the n topology, see please the label catalyst 9000.

[Giuseppe Larosa]

Hello @ja.aljaloud ,

you mean the following description :

>>

About the topology:

Each site has two Cisco 9300 switches, the two switches are connected with LACP, and the same for the other site.

Ok so we can suppose each site has two indipendent Cat9300 and you are not using SVL to stack them ?

SiteA-Switch 1 ------   connected via ?   -----  SiteB Switch1

Site A- SWitch2 -----   connected via ? ------  Siteb Switch 2

And Site Aswitch1 ===== lacp ====== SiteA Switch2

And

Site B switch1 ===== lacp ============= SiteB switch 2

is this your topology ?

MACSec applies only to directly connected devices if any L2 device is on the path the MACsec negotiation fails.

So I would go for OSPF protection using key chain as suggested by @David Ruess 

Edit :

if your topology is confirmed you can easily make the second inter site link less preferred by using ip ospf cost 1000 on both sides of the link.

With default settings you get ECMP equal cost multi path over the two inter site links.

Hope to help

Giuseppe

[ja.aljaloud]

Hey, that's correct i don't use Stack.

they are connectet with LWL Cabel SW1-1 and SW1-2 and the same on Site B.

Site A SW1-1 connectet with Site B SW2-1 with LWL 10G Cabel.

Site A SW1-2 connectet with Site B SW2-2 with LWL 10G Cabel.

With OSPF Configuration i wanna redistribute alle Static Routes.

So i can configure this Topology as follow:

1: Site A SW1-1 and SW1-2 connected with LACP, and Configure these Switches as VRRP.

2: Site B SW2-1 and SW2-2 connected with LACP, and Configure these Switches as VRRP.

3: Configure OSPF Protocol as mentioned David plus Redistribution Static Routes.

4: Configures Costs

Is so i am on the correct way?!

Thanks

[Giuseppe Larosa]

Hello @ja.aljaloud ,

no you need to run OSPF also on the LACP port-channel between co-located switches , VRRP on the LACP bundle makes little sense. VRRP or other FHRP ( HSRP or GLBP) just provide a virtual default gateway to end user PCs or a resilient next-hop for static routes.

So you should use VRRP on the user facing VLANs that are permitted on the port channel but you should run OSPF on two SVIs between colocated switches ( for redundancy)

Redistributing static routes if done on two different OSPF devices you should use OSPF type 1 as  external metric type 1 and you can influence the primary exit point using different seed metric.

route-map Static-into-OSPF permit 10

match address prefix Statics

set metric type 1

set metric 50

Edit:

are you sure you need to redistribute static routes ?  Or  this need comes for attempting to use VRRP on the LACP port-channel ?

If so just run OSPF on the bundle and avoid each static redistribution that allows you to build a simpler solution.

router ospf 10

redistribute static subnet route-map Static-into-OSPF

route-map Static-into-OSPF permit 10

match address prefix Statics

set metric type 1

set metric 5000

on the other colocated switch

Hope to help

Giuseppe

[ja.aljaloud]

Thanks a lot for your explantion:)

I wanna redistribute static routes, because i have on Site A cluster of Firewall ( Active and Standby), its connect to SW1-1 and SW1-2 as Layer 3 and the same topolgy on Site B.

Anyway tommorow i will be on site to configure them and i will see how i can configure them.

Thanks in advanced

[balaji.bandi]

If the Layer 2 extended between switch to switch, If the Switch has enough Licence feature i go with MACSEC.

Make sure you to enable MACSEC, you need unbundle the ports from LACP and Join back after configuration on each individual ports.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-8/configuration_guide/sec/b_178_sec_9300_cg/macsec_encryption.html

On top of it you can enable OSPF Authenticaiton to join the peers.

[ja.aljaloud]

what is the name of the licence do i need to activate the MACSEC?

[balaji.bandi]

Above document should have that information as pre-requisites.

MACsec should support essential (basic)

https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-9300-series-switches/nb-06-cat9300-ser-data-sheet-cte-en.html#Licensing

FAQ :

https://www.cisco.com/c/en/us/products/collateral/software/one-wireless-subscription/nb-06-dna-acces-wl-sw-faq-ctp-en.html

[MHM Cisco World]

Different between 

Ospf with md5 and macsec 

With ospf with md5 only ospf message is protect between two peer' this prevents any man in middle see or change and prefix exchange between two ospf peers

MacSec is so different it encrypt entire traffic between two point' i.e. ospf and other traffic.

MHM