IBM Cloud x GCP IPsecVPN/BGP接続

## 目的
IBMCloudとGoogle Cloud Platformをインターネットを介したIPsecVPNで接続する。
その後、BGPを用いた経路交換を実施し、IBMCloudとGCP間で仮想マシン同士の通信ができる事を確認する。

## 構成
* ローカル端末：macOS Monterey 12.6 1台
* プラットフォーム:IBMCloud
    * ルータ:Vyatta AT&T vRouter 5600 1912g 1台
    * 仮想サーバ:CentOS 7.7.1908(Virtual Server for Classic) 1台
* プラットフォーム:Google Cloud Platform(GCP)
    * VPC Network:外部アドレス/VPNGateway/Cloud Router 1サービス
    * Compute Engine:Debian 4.19.132-1 1台

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/703043/7e2d193f-15e2-e378-74d0-602e4832134b.png)
    
## IBMCloud設定
###BYoIP用インタフェースの設定
接続確認用サーバのBYoIPゲートウェイアドレス(172.22.99.254)をルータに追加する。

```
set interfaces bonding dp0bond0 address '10.192.94.xx/26'
set interfaces bonding dp0bond0 lacp-options activity 'active'
set interfaces bonding dp0bond0 mode 'lacp'
set interfaces bonding dp0bond0 vif 2223 address '10.192.229.xx/26'
set interfaces bonding dp0bond0 vif 2223 address '172.22.99.254/24'
```
### GCP接続用VTIインタフェースの設定
IPsecで接続後、IBMCloudとGCP間のルーティングインタフェースを作成する。

```
set interfaces vti vti0 address '169.254.0.1/30'
set interfaces vti vti0 description 'google cloud'
set interfaces vti vti0 mtu '1436'
```

### GCP接続用BGPの設定
IBMCloudとGCP間のBGP設定

* IBMCloud:AS65001
    * 169.254.0.1
    * 広報ネットワーク:172.22.99.0/24
* GCP:AS65002
    * 169.254.0.2

```
set protocols bgp 65001 address-family ipv4-unicast network '172.22.99.0/24'
set protocols bgp 65001 neighbor 169.254.0.2 address-family ipv4-unicast soft-reconfiguration 'inbound'
set protocols bgp 65001 neighbor 169.254.0.2 remote-as '65002'
set protocols bgp 65001 neighbor 169.254.0.2 timers holdtime '90'
set protocols bgp 65001 neighbor 169.254.0.2 timers keepalive '30'
set protocols bgp 65001 parameters router-id '169.254.0.1'
```

### GCP接続用IPsecVPNの設定
GCP側で対応しているIPsecVPNのパラメタは下記ページを参照
このリストにある暗号化、関数、DHセットを使えば、特に問題なく繋がるはず。
参考:[Azure VPNゲートウェイの IPsec/IKE ポリシーのパラメーターについて](https://cloud.google.com/network-connectivity/docs/vpn/concepts/supported-ike-ciphers?hl=ja)

```
set security vpn ipsec esp-group ESP-GCP lifetime '10800'
set security vpn ipsec esp-group ESP-GCP mode 'tunnel'
set security vpn ipsec esp-group ESP-GCP pfs 'enable'
set security vpn ipsec esp-group ESP-GCP proposal 1 encryption 'aes256'
set security vpn ipsec esp-group ESP-GCP proposal 1 hash 'sha2_512'
set security vpn ipsec ike-group IKE-GCP dead-peer-detection action 'restart'
set security vpn ipsec ike-group IKE-GCP dead-peer-detection interval '30'
set security vpn ipsec ike-group IKE-GCP dead-peer-detection timeout '120'
set security vpn ipsec ike-group IKE-GCP ike-version '2'
set security vpn ipsec ike-group IKE-GCP lifetime '36000'
set security vpn ipsec ike-group IKE-GCP proposal 1 dh-group '15'
set security vpn ipsec ike-group IKE-GCP proposal 1 encryption 'aes256'
set security vpn ipsec ike-group IKE-GCP proposal 1 hash 'sha2_512'
set security vpn ipsec site-to-site peer 104.154.144.244 authentication mode 'pre-shared-secret'
set security vpn ipsec site-to-site peer 104.154.144.244 authentication pre-shared-secret 'ibmcloudgcp'
set security vpn ipsec site-to-site peer 104.154.144.244 connection-type 'initiate'
set security vpn ipsec site-to-site peer 104.154.144.244 default-esp-group 'ESP-GCP'
set security vpn ipsec site-to-site peer 104.154.144.244 ike-group 'IKE-GCP'
set security vpn ipsec site-to-site peer 104.154.144.244 local-address '128.168.xx.xx'
set security vpn ipsec site-to-site peer 104.154.144.244 vti bind 'vti0'
set security vpn ipsec site-to-site peer 104.154.144.244 vti esp-group 'ESP-GCP'
```


## GCP設定

###静的アドレスの取得
####GUIでやる場合
VPCネットワークのメニューから、**外部IPアドレス** -> **静的アドレスを予約**を選択
![外部_IP_アドレス_–_VPC_ネットワーク_–_qwiklabs-gcp-01-bc4…_–_Google_Cloud_Platform.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/703043/88837d56-4215-853c-4d74-97ce64475bde.png)

**任意の名前** -> **任意のリージョン**を選択し、**予約**を選択 
![静的アドレスの予約_–_VPC_ネットワーク_–_qwiklabs-gcp-01-bc4…_–_Google_Cloud_Platform-2.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/703043/ee0ae800-73a5-c9db-6947-68ba6ea1dc37.png)

#### CloudShellでやる場合
```
gcloud compute addresses create vpn-ip --project=khoshi-gcp-01-bc4453ed28ec --region=us-central1
```

### クラウドルータ作成
#### GUIでやる場合
ハイブリッド接続のメニューから、**クラウドルーター** -> **ルーターを作成**を選択
![Cloud_Router_–_ハイブリッド接続_–_qwiklabs-gcp-01-bc4…_–_Google_Cloud_Platform.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/703043/7dcfd673-b0db-8250-c6fe-7e60c0e322bf.png)

* 名前:任意の名前
* ネットワーク:VPN接続するネットワークを含むVPC(今回の場合は10.5.4.0/24を含むVPC)
* リージョン:任意のリージョン
* GoogleASN:65002(IBMCloud側とは別のASN)

<font color=blue>利用できるASN（64512～65534、4200000000～4294967294）</font>
![Cloud_Router_の作成_–_ハイブリッド接続_–_qwiklabs-gcp-01-bc4…_–_Google_Cloud_Platform.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/703043/6a2ca31f-dbd3-88ee-f5f4-a7b78e3891b1.png)

#### CloudShellでやる場合
```
gcloud compute routers create bpg-router --project=khoshi-gcp-01-bc4453ed28ec --region=us-central1 --network=vpn-network-1 --asn=65002
```

### VPN作成
#### GUIでやる場合
ハイブリッド接続のメニューから、**VPN** -> **VPN接続を作成**を選択
![Google_Cloud_Platform.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/703043/077d2793-ab5d-3176-10b8-c33f9cba0c07.png)

**Classic VPN** -> **続行**を選択
![VPN_の作成_–_ハイブリッド接続_–_qwiklabs-gcp-01-bc4…_–_Google_Cloud_Platform.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/703043/8ba02471-841d-1ec5-9dea-3587abf02839.png)

* 名前:任意の名前
* ネットワーク:VPN接続するネットワークを含むVPC(今回の場合は10.5.4.0/24を含むVPC)
* リージョン:任意のリージョン
* IPアドレス:取得した静的グローバルIP(今回は104.154.144.244)

![Google_Cloud_Platform-2.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/703043/d1fe449d-47e6-6030-2de6-b512f6cfd0e0.png)

* 名前:任意の名前
* リモートピアIPアドレス:IBMCloud側のグローバルIPアドレス(今回は128.168.xx.xx)
* IKEバージョン:IKEバージョンを指定(IBMCloud側と合わせる)
* IKE事前共有キー:IBMCloud側と一致したキー
* ルーティングオプション:BGPを選択
* CloudRouter:作成済みのクラウドルータを選ぶ

![Google_Cloud_Platform-3.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/703043/324a0bb5-358b-95b7-d552-cee2ccae9304.png)

#### CloudShellでやる場合
```
gcloud compute --project "khoshi-gcp-01-bc4453ed28ec" target-vpn-gateways create "vpn-1" --region "us-central1" --network "vpn-network-1"
gcloud compute --project "khoshi-gcp-01-bc4453ed28ec" forwarding-rules create "vpn-1-rule-esp" --region "us-central1" --address "104.154.144.244" --ip-protocol "ESP" --target-vpn-gateway "vpn-1"
gcloud compute --project "khoshi-gcp-01-bc4453ed28ec" forwarding-rules create "vpn-1-rule-udp500" --region "us-central1" --address "104.154.144.244" --ip-protocol "UDP" --ports "500" --target-vpn-gateway "vpn-1"
gcloud compute --project "khoshi-gcp-01-bc4453ed28ec" forwarding-rules create "vpn-1-rule-udp4500" --region "us-central1" --address "104.154.144.244" --ip-protocol "UDP" --ports "4500" --target-vpn-gateway "vpn-1"
gcloud compute --project "khoshi-gcp-01-bc4453ed28ec" vpn-tunnels create "vpn-1-tunnel-1" --region "us-central1" --peer-address "128.168.89.185" --shared-secret "ibmcloud-gcp" --ike-version "2" --target-vpn-gateway "vpn-1"
```

#### BGPセッション作成
VPNルータ作成画面の**BGPセッション**の右下にあるペンマークを選択
![Google_Cloud_Platform-4.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/703043/47fbdbfe-e903-617c-4f03-3b0625bfd637.png)

* 名前:任意の名前
* ピアASN:IBMCloud側のBGP ASNを指定
* Cloud RouterのBGP IP:GCP側のIP
* BGPピアIP:IBMCloud側のIP

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/703043/1266ab2f-d6f4-f530-e2a8-eaadd06b8fe2.png)

**完了** -> **作成**を選択
![Google_Cloud_Platform-6.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/703043/100a9990-893e-53fd-654f-a23d96c30d6e.png)


## 動作確認

### IBMCloud
BGPでルートが取得できているか

```
$ show ip route bgp
B    *> 10.5.4.0/24 [20/100] via 169.254.0.2, vti0, 00:02:43
```
BGPネイバーの状態

```
$ show ip bgp neighbors
BGP neighbor is 169.254.0.2, remote AS 65002, local AS 65001, external link
  BGP version 4, remote router ID 169.254.0.2
  BGP state = Established, up for 00:03:33
  Last read 00:03:33, hold time is 60, keepalive interval is 20 seconds
  Configured hold time is 90, keepalive interval is 30 seconds
  Neighbor capabilities:
    Route refresh: advertised and received (old and new)
    Address family IPv4 Unicast: advertised and received
  Received 13 messages, 0 notifications, 0 in queue
  Sent 14 messages, 0 notifications, 0 in queue
  Route refresh request: received 0, sent 0
  Minimum time between advertisement runs is 30 seconds
 For address family: IPv4 Unicast
  BGP table version 6, neighbor version 6
  Index 1, Offset 0, Mask 0x2
    Graceful restart: received
  Inbound soft reconfiguration allowed
  Community attribute sent to this neighbor (both)
  1 accepted prefixes
  1 announced prefixes

 Connections established 4; dropped 3
Local host: 169.254.0.1, Local port: 179
Foreign host: 169.254.0.2, Foreign port: 41861
Nexthop: 169.254.0.1
Nexthop global: ::
Nexthop local: ::
BGP connection: non shared network
Last Reset: 00:03:38, due to BGP Notification sent
Notification Error Message: (Cease/Other Configuration Change.)
```

### GCP-VMインスタンス
GCPからIBMCloud側への通信確認

```
$ ping 172.22.99.1
PING 172.22.99.1 (172.22.99.1) 56(84) bytes of data.
64 bytes from 172.22.99.1: icmp_seq=1 ttl=63 time=135 ms
64 bytes from 172.22.99.1: icmp_seq=2 ttl=63 time=135 ms
64 bytes from 172.22.99.1: icmp_seq=3 ttl=63 time=135 ms
64 bytes from 172.22.99.1: icmp_seq=4 ttl=63 time=135 ms
64 bytes from 172.22.99.1: icmp_seq=5 ttl=63 time=136 ms
```

### IBM-VMインスタンス
IBMCloudからGCP側への通信確認

```
# ping 10.5.4.2
PING 10.5.4.2 (10.5.4.2) 56(84) bytes of data.
64 bytes from 10.5.4.2: icmp_seq=1 ttl=62 time=136 ms
64 bytes from 10.5.4.2: icmp_seq=2 ttl=62 time=135 ms
64 bytes from 10.5.4.2: icmp_seq=3 ttl=62 time=135 ms
64 bytes from 10.5.4.2: icmp_seq=4 ttl=62 time=135 ms
64 bytes from 10.5.4.2: icmp_seq=5 ttl=62 time=135 ms
```