{"id":1288,"date":"2023-04-03T11:02:39","date_gmt":"2023-04-03T16:02:39","guid":{"rendered":"https:\/\/cloudlearning365.com\/?p=1288"},"modified":"2023-04-03T11:02:42","modified_gmt":"2023-04-03T16:02:42","slug":"aviatrix-high-performance-encryption-pseudo-with-3rd-party-devices","status":"publish","type":"post","link":"https:\/\/cloudlearning365.com\/?p=1288","title":{"rendered":"Aviatrix High Performance Encryption (pseudo) with 3rd party devices"},"content":{"rendered":"\n

Aviatrix Gateways – Spoke, Transit, CloudN, and Edge – offer a simple and efficient way to establish highly available and high-performing data planes. With the Aviatrix Controller, multiple encrypted tunnels can be automatically created, ensuring seamless redundancy and fast throughput. By deploying a pair of gateways at each end, Aviatrix builds four full mesh tunnels, creating a reliable data path with up to 5Gbps of throughput. But what makes Aviatrix truly stand out is its patented High Performance Encryption, which leverages multiple IP addresses and CPU cores to create multiple IPSec tunnels. This unique approach can achieve up to 70Gbps throughput, delivering exceptional performance.<\/p>\n\n\n\n

However, not all customers are ready to implement CloudN or Edge. For these situations, Aviatrix still provides encryption and the ability to create multiple IPSec tunnels for higher throughput. In this blog post, we will delve into how to achieve this and explore the benefits of using Aviatrix Gateways for highly available and high-performing data planes.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n\n\n\n\n

As shown as above diagram. Each Aviatrix Transit Gateway would have it’s own Public IP address assigned. We are using Cisco CSR 1000v running in a separate AWS VPC as the third part device simulate on-prem device. <\/p>\n\n\n\n

With each IP pair, you can establish a single IPSec tunnel. Assuming this connection is coming from Public Internet, if the CSR only have one public IP, we can establish maximum two IPSec tunnels: One from Primary Aviatrix Transit Gateway public IP with CSR single Public IP, another one from HA Aviatrix Transit Gateway public IP with CSR single Public IP. The configuration would be very straightforward, refer to scenario one in my past blog: Aviatrix Site to Cloud Connection demystified<\/a><\/p>\n\n\n\n

To establish more than two IPSec tunnels, we will need to increase number of IP address on Cisco CSR, then we would just create additional Site to Cloud connection from Aviatrix Transit Gateway towards these new Public IPs of CSR, also make sure BGP ECMP is enabled on Aviatrix Transit, as well as on CSR to make sure the traffic is evenly distributed to all IPSec tunnels.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

To enable BGP ECMP in CSR v1000, you can use the following command under IPv4 address family:<\/p>\n\n\n\n

router bgp <AS number>\naddress-family ipv4\nmaximum-paths <number of paths>\n<\/code><\/pre>\n\n\n\n
For example, if you want to enable BGP ECMP with two paths, you can use:<\/p>\n\n\n\n
router bgp 65000\naddress-family ipv4\nmaximum-paths 2<\/code><\/pre>\n\n\n\n
In AWS, after you launch CSR in public subnet, it will be assigned a NIC with private IP, as well as you need to assign an EIP (Elastic IP – static Public IP) to it’s primary NIC. To add additional private IP \/ public IP pair to the CSR, first add private IP by following this article<\/a>.<\/p>\n\n\n\n
\"\"
On the CSR instance -> Action -> Networking -> Manage IP addresses<\/figcaption><\/figure>\n\n\n\n
\"\"
Shown 172.31.8.208 been added as secondary private IP<\/figcaption><\/figure>\n\n\n\n
Allocate a new EIP and associate with the secondary private IP<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"
Assign EIP to instance and specify the secondary private IP<\/figcaption><\/figure>\n\n\n\n
In CSR interface configuration for GigabitEthernet1, explicitly specify 172.31.8.208 as secondary IP<\/p>\n\n\n\n
interface GigabitEthernet1\r\n ip address 172.31.8.208 255.255.0.0 secondary\r<\/mark>\n ip address 172.31.8.207 255.255.0.0\r\n ip nat outside\r\n negotiation auto\r\n no mop enabled\r\n no mop sysid<\/code><\/pre>\n\n\n\n
When use Aviatrix Transit Gateway external connection generate the BGP\/IPSec configuration, export as CSR configuration. The following example shows how to configure tunnels with the CSR secondary IP<\/p>\n\n\n\n
Generated code:<\/p>\n\n\n\n
crypto isakmp policy <crypto_policy_number>\n  encryption 256-aes\n  authentication pre-share\n  hash sha256\n  group 14\n  lifetime 28800\n  exit<\/code><\/pre>\n\n\n\n
Replace <crypto_policy_number><\/p>\n\n\n\n
crypto isakmp policy 2<\/mark>\n  encryption 256-aes\n  authentication pre-share\n  hash sha256\n  group 14\n  lifetime 28800\n  exit<\/code><\/pre>\n\n\n\n
Generated code:<\/p>\n\n\n\n
interface Tunnel <tunnel_number1>\n  ip address 169.254.39.157 255.255.255.252\n  ip mtu 1436\n  ip tcp adjust-mss 1387\n  tunnel source <ios_wan_interface1>\n  tunnel mode ipsec ipv4\n  tunnel destination 44.211.111.125\n  tunnel protection ipsec profile 3.133.193.97-44.211.111.125\n  ip virtual-reassembly\n  exit<\/code><\/pre>\n\n\n\n
Replace <tunnel_number1> with the tunnel number, and <ios_wan_interface1> with the private IP<\/p>\n\n\n\n
interface Tunnel 3<\/mark>\n  ip address 169.254.39.157 255.255.255.252\n  ip mtu 1436\n  ip tcp adjust-mss 1387\n  tunnel source 172.31.8.208<\/mark>\n  tunnel mode ipsec ipv4\n  tunnel destination 44.211.111.125\n  tunnel protection ipsec profile 3.133.193.97-44.211.111.125\n  ip virtual-reassembly\n  exit<\/code><\/pre>\n\n\n\n
BGP configuration sample, shows four BGP peers via the IPSec tunnels:<\/p>\n\n\n\n
ip-172-31-8-207#show running-config | section router\r\nrouter bgp 65300\r\n bgp log-neighbor-changes\r\n neighbor 169.254.39.158 remote-as 65001\r\n neighbor 169.254.39.158 timers 60 180\r\n neighbor 169.254.48.130 remote-as 65001\r\n neighbor 169.254.48.130 timers 60 180\r\n neighbor 169.254.87.138 remote-as 65001\r\n neighbor 169.254.87.138 timers 60 180\r\n neighbor 169.254.177.102 remote-as 65001\r\n neighbor 169.254.177.102 timers 60 180\r\n !\r\n address-family ipv4\r\n  redistribute connected\r\n  neighbor 169.254.39.158 activate\r\n  neighbor 169.254.39.158 soft-reconfiguration inbound\r\n  neighbor 169.254.48.130 activate\r\n  neighbor 169.254.48.130 soft-reconfiguration inbound\r\n  neighbor 169.254.87.138 activate\r\n  neighbor 169.254.87.138 soft-reconfiguration inbound\r\n  neighbor 169.254.177.102 activate\r\n  neighbor 169.254.177.102 soft-reconfiguration inbound\r\n  maximum-paths 4\r\n exit-address-family<\/code><\/pre>\n\n\n\n
Also make sure CSR instance have Source\/destination check disabled to allow it to forward traffic:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
In CSR, confirm route have been received in ECMP manner:<\/p>\n\n\n\n
ip-172-31-8-207#show ip bgp\r\nBGP table version is 17, local router ID is 192.168.88.88\r\nStatus codes: s suppressed, d damped, h history, * valid, > best, i - internal,\r\n              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,\r\n              x best-external, a additional-path, c RIB-compressed,\r\n              t secondary path, L long-lived-stale,\r\nOrigin codes: i - IGP, e - EGP, ? - incomplete\r\nRPKI validation codes: V valid, I invalid, N Not found\r\n\r\n     Network          Next Hop            Metric LocPrf Weight Path\r\n *m   10.16.0.0\/24     169.254.48.130           0             0 65001 i\r\n *m                    169.254.39.158           0             0 65001 i\r\n *m                    169.254.87.138           0             0 65001 i\r\n *>                    169.254.177.102          0             0 65001 i<\/mark>\r\n *>   169.254.39.156\/30\r\n                      0.0.0.0                  0         32768 ?\r\n *>   169.254.48.128\/30\r\n                      0.0.0.0                  0         32768 ?\r\n *>   169.254.87.136\/30\r\n                      0.0.0.0                  0         32768 ?\r\n *>   169.254.177.100\/30\r\n                      0.0.0.0                  0         32768 ?\r\n *>   172.31.0.0       0.0.0.0                  0         32768 ?\r\n *>   192.168.88.0     0.0.0.0                  0         32768 ?<\/code><\/pre>\n\n\n\n
A test Loopback has been configured on the CSR, with redistribute connected in BGP configuration, it should gets propagated to Aviatrix Transit:<\/p>\n\n\n\n
interface Loopback1\r\n ip address 192.168.88.88 255.255.255.0<\/code><\/pre>\n\n\n\n
In Aviatrix CoPilot, validate IPSec tunnels, and BGP:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Sample Aviatrix External Connections towards the two CSR Public IPs – exported<\/p>\n\n\n\n
vpc-00f6fdafdfcaf63cd-CSR1<\/a>Download<\/a><\/div>\n\n\n\n
vpc-00f6fdafdfcaf63cd-CSR2<\/a>Download<\/a><\/div>\n\n\n\n
Sample Aviatrix External Connections towards the two CSR Public IPs – filled with <crypto_policy_number>, <tunnel_number> with the tunnel number, and <ios_wan_interface><\/p>\n\n\n\n
vpc-00f6fdafdfcaf63cd-CSR1-filled<\/a>Download<\/a><\/div>\n\n\n\n
vpc-00f6fdafdfcaf63cd-CSR2-filled<\/a>Download<\/a><\/div>\n\n\n\n
CSR running config<\/p>\n\n\n\n
running<\/a>Download<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"
Aviatrix Gateways – Spoke, Transit, CloudN, and Edge – offer a simple and efficient way to establish highly available and high-performing data planes. With the Aviatrix Controller, multiple encrypted tunnels can be automatically created, ensuring seamless redundancy and fast throughput. … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[2,11],"tags":[],"class_list":["post-1288","post","type-post","status-publish","format-standard","hentry","category-aviatrix","category-cisco"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts\/1288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1288"}],"version-history":[{"count":1,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts\/1288\/revisions"}],"predecessor-version":[{"id":1348,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts\/1288\/revisions\/1348"}],"wp:attachment":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}