IPSec VTI interface - loopback as source

[Alexey Stytsenko]

Good day, everyone! )

I heard at Cisco Live and lately red in CCDP Cert guide that

A major benefit associated with IPSec VTIs is that the configuration does not require a static mapping of IPSec sessions to a physical interface

Hm, but from my point if we configure tunnel interface and specified source physical interfase for it and tunnel protection ipsec profile , that means that our IPSec session is binded to source physical interface (btw am I right here?). So to deatach IPSec session from physical interface we need to use loopbacks as VTI tunnel source and destination. I tried to configure it but unsuccessfully - tunnel interface protocol state dont come up. I checked liks with wireshark and discvered that packets are not event being tried to sent with VTI configuration, i changed mode from VTI to GRE and noticed that packets are sent by both ends but nodes transmits unencrypted packets but  wait for IPSec encryted packets -

Mar  1 23:16:33.578: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /1.1.1.1, src_addr= 3.3.3.3, prot= 47

As i understand the problem is in that tunnel interface state are tied up to the underlying crypto sa but sa cannot be established due some problems in configuration. And when I remove  tunnel protection ipsec profile TP command from tunnel configuration (in GRE case ofc) everething come up and work.

My config for IPSec on R1 (1.1.1.1):

crypto isakmp policy 1
 encr aes
 authentication pre-share
 group 2
crypto isakmp key cisco address 3.3.3.3
crypto isakmp profile VPN
   keyring default
   match identity address 3.3.3.3 255.255.255.255
   local-address Loopback0
crypto ipsec transform-set TSET ah-sha-hmac
crypto ipsec profile TP
 set transform-set TSET
 set isakmp-profile VPN

Config for tunnel interface:

interface Tunnel1
 ip address 172.16.0.1 255.255.255.0
 ip ospf 1 area 1
 keepalive 10 3
 tunnel source Loopback0
 tunnel destination 3.3.3.3
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile TP
end

So how to fix it and make work with tunnel protection?

[Gajendra R']

Hi Alexey Stytsenko,

What I understood from your post that you want to have Dynamic tunnel by using IPsec.If am right then there are few changes require in your current config is .....

1 Create crypto IPsec profile XXXX

2 set transform-set

3 Create a virtual-template XX

4 tunnel mode ipsec ipv4

5 tunnel protection IPsec profile

6 crypto isakamp profile XXX

7 assign virtual-template XX

Or if you are trying to configure VTI with IP security... I will suggest you to please go through the below link..

http://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd8029d629_ps6635_Products_White_Paper.html

Hope this will help you..

Thanks

[Alexey Stytsenko]

Thanks for reply, but you didnt read what i wrote.

Im truying to configure static VTI or GRE-over-IP tunnel with IPSEC protection (not cryptomaps!!) using loopbacks adress as tunnel source and destination, cos this is is only possibility to prove Cisco statement that

A major benefit associated with IPSec VTIs is that the configuration does not require a static mapping of IPSec sessions to a physical interface

And from what i have observed there is some problem with giving IPSec protection aware of using loopbacks as source of SA.

And I have no problems with configuration of DVTI, SVTI, GRE tunnels with IPSec protection using physical interfaces for tunnel endpoints.

[martin.law]

I have done it with Loooback interfaces as the tunnel endpoint at one end only. I have never had the need or tried it with loopbacks at both ends.

My scenario works great as long as the endpoints can see each other - obviously.

A simple test is trying to telnet / SSH to the remote endpoint using the source as the loopback interface.

Where I haven't got it to work yet is when trying to NAT the loopback behind a physical interface. I can get the tunnel to come up but with no decryption at the remote end.

[Georg Pauwen]

Hello Alexey,

I am running into the same problem, the tunnel being up/down when I use loopbacks as the source for the tunnels. Did you ever get this resolved ?

Thanks in advance for your reply.

[Alexey Stytsenko]

Still does not resolved :(

[Frank DeNofa]

Alexey,

As you mentioned, VTIs are definitely the way to go at this point as long as you have IOS (XE) devices on both ends. Sourcing both tunnels from loopbacks definitely should work, provided that we have IP connectivity between the two loopback addresses. Is there any way for you to attach more of the currently configuration from both of the routers? I'd also be interested in seeing the output generated by "debug crypto isakmp" when you attempt to bring up the tunnel. If it's an option for you, you might want to open a TAC case to get this resolved ASAP.

HTH,

Frank