Native Vxlan over IPSEC and loopback interface. advanced configuration

[macarleo]

I allow myself to write this post because I have a lot of difficulty in configuring vxlan over ipsec, the operation is not guaranteed (at least from my experience)

　

from the FortiOS version 5.6.2 vxlan can be used natively

considered that the

[ul]

vxlan over ipsec does not support 802.1q (while internet traffic is encrypted)

native vxlan supports 802.1q (instead internet traffic is not encrypted)[/ul]

　

I decided to make a configuration using IPSEC with loopback interface and use the native vxlan with the loopback interfaces.

With this configuration, traffic with the native vxlan is encrypted with the IPSEC

　

attached the configuration adopted between fortigate 80E and Fortigate 90E

######################### FTG80E ###############

　

##creation of subnet address

　

config firewall address

    edit "LoopBackLocal172.30.31.0"

        set subnet 172.30.31.0 255.255.255.0

    next

    edit "LoopBackRemote172.30.30.0"

        set subnet 172.30.30.0 255.255.255.0

    next

end

########## loopback interface creation ##########

config system interface

edit "Loopback"

        set vdom "root"

        set ip 172.30.31.1 255.255.255.0

        set allowaccess ping https ssh http

        set type loopback

    next

end

########## phase 1 configuration #########

config vpn ipsec phase1-interface

edit "VXlanSuIpsec"

set interface "wan1"

set keylife 28800

set peertype any

set proposal aes128-sha1 aes256-sha256 aes128-sha256 aes256-sha1

set dhgrp 14 2

set remote-gw #remote ip public

set psksecret 123456789

next

end

########## phase 2 configuration ##########

config vpn ipsec phase2-interface

edit "VXlanIpsecPh2"

set phase1name "VXlanSuIpsec"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm

set dhgrp 14 2

set keepalive enable

set src-addr-type name

set dst-addr-type name

set keylifeseconds 3600

set src-name "LoopBackLocal172.30.31.0"

set dst-name "LoopBackRemote172.30.30.0"

next

end

　

######### native vxlan configuration using vpn ipsec with loopback interface ########

config system vxlan

    edit "vxlan"

        set interface "Loopback"

        set vni 1

        set remote-ip "172.30.30.1"

    next

end

config system interface

    edit "vxlan"

        set vdom "root"

        set type vxlan

        set interface "Loopback"

    next

end

######## Virtual Switch Configuration for bridge between native vxlan and port 7. #########

######## port 7 firewall must be configured in trunk on switch port ##########

　

config system switch-interface

edit "Switch-Vxlan"

set vdom "root"

set member "port7" "vxlan"

next

end

　

######## Policy configuration ######

　

config firewall policy

    edit 1

        set name "Loopback TO ipsecVPN"

        set srcintf "Loopback"

        set dstintf "VXlanSuIpsec"

        set srcaddr "LoopBackLocal172.30.31.0"

        set dstaddr "LoopBackRemote172.30.30.0"

        set action accept

        set schedule "always"

        set service "ALL"

        set logtraffic all

    next

    edit 2

        set name "ipsecVPN TO Loopback"

        set srcintf "VXlanSuIpsec"

        set dstintf "Loopback"

        set srcaddr "LoopBackRemote172.30.30.0"

        set dstaddr "LoopBackLocal172.30.31.0"

        set action accept

        set schedule "always"

        set service "ALL"

        set logtraffic all

    next

end

　

############# static route configuration ##########

########## remember to add the default gateway associated with wan1 ############

config router static

    edit 2

        set dst 172.30.30.0 255.255.255.0

        set distance 1

        set device "VXlanSuIpsec"

    next

end

　

　

########################### FTG90E ###############

　

##creation of subnet address

　

config firewall address

    edit "LoopBackLocal172.30.30.0"

        set subnet 172.30.30.0 255.255.255.0

    next

    edit "LoopBackRemote172.30.31.0"

        set subnet 172.30.31.0 255.255.255.0

    next

end

　

########## loopback interface creation ##########

config system interface

    edit "Loopback"

        set vdom "root"

        set ip 172.30.30.1 255.255.255.0

        set allowaccess ping https ssh http

        set type loopback

next

end

　

########## phase 1 configuration #########

config vpn ipsec phase1-interface

edit "VXlanSuIpsec"

set interface "wan1"

set keylife 28800

set peertype any

set proposal aes128-sha1 aes256-sha256 aes128-sha256 aes256-sha1

set dhgrp 14 2

set remote-gw #remote ip public

set psksecret 123456789

next

end

########## phase 2 configuration ##########

config vpn ipsec phase2-interface

edit "VXlanIpsecPh2"

set phase1name "VXlanSuIpsec"

set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm

set dhgrp 14 2

set keepalive enable

set src-addr-type name

set dst-addr-type name

set keylifeseconds 3600

set src-name "LoopBackLocal172.30.30.0"

set dst-name "LoopBackRemote172.30.31.0"

next

end

######### native vxlan configuration using vpn ipsec with loopback interface ########

config system vxlan

    edit "vxlan"

        set interface "Loopback"

        set vni 1

        set remote-ip "172.30.31.1"

    next

end

config system interface

    edit "vxlan"

        set vdom "root"

        set type vxlan

        set interface "Loopback"

    next

end

　

######## Virtual Switch Configuration for bridge between native vxlan and port 7. #########

######## port 7 firewall must be configured in trunk on switch port ##########

config system switch-interface

edit "Switch-Vxlan"

set vdom "root"

set member "internal7" "vxlan"

next

end

　

######## Policy configuration ######

config firewall policy

    edit 1

        set name "Loopback TO ipsecVPN"

        set srcintf "Loopback"

        set dstintf "VXlanSuIpsec"

        set srcaddr "LoopBackLocal172.30.30.0"

        set dstaddr "LoopBackRemote172.30.31.0"

        set action accept

        set schedule "always"

        set service "ALL"

        set logtraffic all

    next

    edit 2

        set name "ipsecVPN TO Loopback"

        set srcintf "VXlanSuIpsec"

        set dstintf "Loopback"

        set srcaddr "LoopBackRemote172.30.31.0"

        set dstaddr "LoopBackLocal172.30.30.0"

        set action accept

        set schedule "always"

        set service "ALL"

        set logtraffic all

    next

end

########## loopback interface creation ##########

########## remember to add the default gateway associated with wan1 ############

config router static

    edit 2

        set dst 172.30.31.0 255.255.255.0

        set distance 1

        set device "VXlanSuIpsec"

    next

end

　

[boneyard]

thank you for this guide @macarleo

im running into the 802.1q issue with this native VXLAN setup im afraid. does anyone have a working setup in which you don't have to lower the MTU on the end user devices and use 802.1q with tagged VLANs over native VXLAN?

macarleo you are saying you do, but your guide doesn't include 802.1q config anywhere, how / where did you configure that?

im kinda wondering if it might require 6.0 as there the documentation has this section (and 5.6 doesn't)

http://help.fortinet.com/...Ns%20over%20VXLANs.htm

[boneyard]

i can know confirm that Native VXLAN like @macarleo posted it functions fine with VLAN tagged traffic.

when you configure VLANs on the software switch you can have the FortiGate(s) participate in the VLAN on layer 3 also.

so far my main issue is doing VXLAN traffic through a interVDOMlink, that seems to break it partially.

[krystianm]

Your config is slightly different to mine. Have you tested ie HTTPS over vxlan? It doesn't work for me. I've checked few scenerios, like voip phones, cisco APs, PCs that receive IP from DHCP and etc. but never get HTTPS working as well as IP printing across the vxlan.

[boneyard]

that sounds like a MTU issue. in principle the FortiGate should handle this for you, so if it doesn't the question is how your setup is exactly and which FortiOS version you are using.

currently i have this working fine on FortiOS 6.2 with VLAN tagged traffic. In FortiOS 6.0 i expect it to work with untagged traffic.

[emnoc]

Adjust the tcp.mss in the firewall policy and your mtu issues will go away.

http://socpuppet.blogspot.com/2013/05/tcp-mss-adjusment-fortigate-style.html

Ken Felix