OSPF Over IPSEC

[vmahendra]

Hello All,

I am trying to understand how ospf works over ipsec tunnel as OSPF used multicast to discover neighbourship and ipsec does not support OSPF.

I understand we can configure non broadcast link and define remote IP under tunnel interface.

as our tunnel interface ip is a private ip then how does ipsec takes this private tunnel ip communication to other side of the tunnel.

[Toshi_Esumi]

First, it has to be interface mode IPsec (current default) otherwise you can't configure interface IPs for both ends. Then you need to specify it as "point-to-point". In CLI, configured like below:
config router ospf
  config ospf-interface
    edit "ipsec_name"
      set interface "ipsec_name"
      set network-type point-to-point
    next
  end
end

For the network types, it's explained in any OSPF document/articles like below:
https://study-ccna.com/ospf-network-types/

Toshi

[vmahendra]

Hi @Toshi_Esumi 

Thanks for the valuable comment.

I understand point to point link can form a neighbourship over unicast communication.

On ipsec tunnel interface we will configure private IP's then how to private ip's will communicate with each other over ipsec tunnel to form neighborship.

as per my knowledge tunnel interface ip will not be configured under phase 2 interesting traffic.

kindly share any links or document which explains how ipsec will handel tunnel interface communication.

[robertogoaraujo]

Hi vmahendra. You just need 2 IPs that can communicate to each other. If each IP can reach the other one, you are able to form neighborship. Use point-to-point and may be you need to use ignore-mtu option in ospf interface, because in VPN IPSec you can´t use broadcast, but unicast.

About phase2, I think you don´t need to specify as you are using OSPF to "learn" network prefixes to each side of tunnel.

Did you think about using BGP than OSPF? I just have configured OSPF in IPSec in past, but BGP is more flexible to decide which prefix will exchanged.

Good luck!

[Toshi_Esumi]

There are multiple examples you can find, which how I found this, just Googling it. But this is one of them containing all parts of OSPF config over IPsec.
https://docs.fortinet.com/document/fortigate/6.2.16/cookbook/632796/ospf-with-ipsec-vpn-for-network-...

Toshi

[vmahendra]

Thanks for sharing the links.

Iam not looking for any config examples i am trying to understand how traffic will be handelled for tunnel interface IP to form neighborship.

tunnel interface ip will not be configured in phase2  then how it will be transfered over wan link to reach other side of the tunnel.

[Toshi_Esumi]

As in the config example, the tunnel interface IP is configured on the "interface"(same as the phase1-name because it's automatically generated when you configure the phase1-interface) under config system interface. It's quite similar to Cisco's, and others', Tunnel Interface config.
In the interface config, you have to configure "remote-ip" as in the example. Those /32 IPs would be injected into the routing table as connected routes. That's why you can simply ping the other end even before configuring any routing protocol. We use this for BGP, which uses unicast.

If you configure on your FGT (I'm assuming you have one already) with an IPsec, you can see how it's working. The other end can be any device as long as it supports point-to-point network type. 

Toshi