到Azure的基于路由的冗余站点到站点VPN(IKEv2/IPsec上的BGP)¶
本指南展示了一个基于IKEv2站点到站点VPN到Azure的冗余(主动)路由的示例,使用VTI和BGP进行动态路由更新。
先决条件¶
一对Azure VNet网关,部署在启用BGP的活动配置中。
部署在Azure中的本地网络网关,表示Vyos设备,与下面的Vyos设置匹配,除了地址空间,它只需要Vyos专用IP,在本例中为10.10.0.5/32
部署在Azure中的连接资源,用于链接Azure VNet网关和表示Vyos设备的本地网络网关。
例¶
WAN 接口 |
eth0 |
本地地址空间 |
10.10.0.0/16 |
Azure地址空间 |
10.0.0.0/16 |
Vyos公共IP |
198.51.100.3 |
Vyos私有IP |
10.10.0.5 |
Azure VNet网关1公用IP |
203.0.113.2 |
Azure VNet网关2公共IP |
203.0.113.3 |
Azure VNet网关BGP IP |
10.0.0.4,10.0.0.5 |
预共享密钥 |
ch00s3-4-s3cur3-psk |
Vyos ASN |
64499 |
Azure ASN |
65540 |
Vyos配置¶
配置IKE和ESP设置,以匹配Azure支持的子集:
set vpn ipsec esp-group AZURE compression 'disable'
set vpn ipsec esp-group AZURE lifetime '3600'
set vpn ipsec esp-group AZURE mode 'tunnel'
set vpn ipsec esp-group AZURE pfs 'dh-group2'
set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'
set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'
set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
set vpn ipsec ike-group AZURE ikev2-reauth 'yes'
set vpn ipsec ike-group AZURE key-exchange 'ikev2'
set vpn ipsec ike-group AZURE lifetime '28800'
set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'
在eth0上启用IPsec
set vpn ipsec ipsec-interfaces interface 'eth0'
配置两个VTI,每个VTI都有一个虚拟IP地址
set interfaces vti vti1 address '10.10.1.5/32'
set interfaces vti vti1 description 'Azure Primary Tunnel'
set interfaces vti vti2 address '10.10.1.6/32'
set interfaces vti vti2 description 'Azure Secondary Tunnel'
夹紧VTI的MSS至1350以避免PMTU黑洞。
set firewall options interface vti1 adjust-mss 1350
set firewall options interface vti2 adjust-mss 1350
配置VPN隧道
set vpn ipsec site-to-site peer 203.0.113.2 authentication id '198.51.100.3'
set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
set vpn ipsec site-to-site peer 203.0.113.3 authentication id '198.51.100.3'
set vpn ipsec site-to-site peer 203.0.113.3 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 203.0.113.3 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
set vpn ipsec site-to-site peer 203.0.113.3 authentication remote-id '203.0.113.3'
set vpn ipsec site-to-site peer 203.0.113.3 connection-type 'respond'
set vpn ipsec site-to-site peer 203.0.113.3 description 'AZURE SECONDARY TUNNEL'
set vpn ipsec site-to-site peer 203.0.113.3 ike-group 'AZURE'
set vpn ipsec site-to-site peer 203.0.113.3 ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer 203.0.113.3 local-address '10.10.0.5'
set vpn ipsec site-to-site peer 203.0.113.3 vti bind 'vti2'
set vpn ipsec site-to-site peer 203.0.113.3 vti esp-group 'AZURE'
重要提示:添加接口路由,以访问Azure的BGP侦听器
set protocols static route 10.0.0.4/32 interface vti1
set protocols static route 10.0.0.5/32 interface vti2
配置BGP设置
set protocols bgp 64499 neighbor 10.0.0.4 remote-as '65540'
set protocols bgp 64499 neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound'
set protocols bgp 64499 neighbor 10.0.0.4 timers holdtime '30'
set protocols bgp 64499 neighbor 10.0.0.4 timers keepalive '10'
set protocols bgp 64499 neighbor 10.0.0.5 remote-as '65540'
set protocols bgp 64499 neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound'
set protocols bgp 64499 neighbor 10.0.0.5 timers holdtime '30'
set protocols bgp 64499 neighbor 10.0.0.5 timers keepalive '10'
重要提示:禁用连接检查,否则从Azure学习的路由将不会导入路由表。
set protocols bgp 64499 neighbor 10.0.0.4 disable-connected-check
set protocols bgp 64499 neighbor 10.0.0.5 disable-connected-check