L3 で VyOS VPN (IKEv2)

[前回書いたもの](/jp_yen/items/ed0377a0a1719fffe944) は VyOS のドキュメントに引っ張られて余計な dum0 インターフェースなどを作っていたので、余計なものを削除してやり直し。

# 1対1 VPN
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/306041/98629bb2-bd9d-74a3-985c-b36adba4bd4f.png)
10.1.0.254 は OPNsense FW で、管理 LAN からアクセスする用の port forwading ルータ。

NAT : インターネットへの出口
L3 : VyOS 間のルーティング (プライオとか、IWAN [Interconnected WAN] とかを想定)
VyOS の外側は固定 IP アドレス

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/306041/02e35482-af35-743b-01cc-5a4a83207d51.png)

<details><summary>VyOS に流し込むデフォルト</summary>

### VyOS 共通設定
```config:VyOS default
stty rows 30 columns 130

configure
delete service
delete protocols static
delete interfaces ethernet
delete vpn
delete vrf 
delete system login

set system domain-name 'my.home'
set system host-name 'NAT'

set system time-zone 'Asia/Tokyo'

set system ipv6 disable-forwarding

set service lldp interface all
set service lldp legacy-protocols cdp
set service ssh
set service ssh vrf MGT

set system login user vyos authentication plaintext-password vyos
set system login user vyos authentication public-keys 'user01' key 'AAAA～～～～'
set system login user vyos authentication public-keys 'user01' type 'ssh-ed25519'

set vrf name MGT table '100'
set vrf name MGT protocols static route 0.0.0.0/0 next-hop 10.1.0.254

set interfaces ethernet eth0 description 'MGT_RT'
set interfaces ethernet eth0 vrf MGT

set system name-server 192.168.0.252
set system name-server 1.0.0.1
```

</details>


<details><summary>NAT, L3 の Config</summary>

NAT に流し込む config (VyOS)
```config
set interfaces ethernet eth0 address '10.1.0.253/24'
set interfaces ethernet eth0 description 'MGT_RT'
set interfaces ethernet eth0 vrf MGT

set interfaces ethernet eth1 address 'dhcp'
set interfaces ethernet eth1 description 'to_Internet'

set interfaces ethernet eth2 address '172.16.0.254/24'
set interfaces ethernet eth2 description 'LAN_RT'

set protocols static route 172.16.0.0/16 next-hop 172.16.0.1

set nat source rule 1 outbound-interface name 'eth1'
set nat source rule 1 translation address 'masquerade'

commit
save
```

L3 に流し込む config (Cisco)
```config
clock timezone JST 9 0

service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
no service password-encryption
service sequence-numbers

lldp run

username admin algorithm-type sha256 secret Cisco1
enable algorithm-type sha256 secret Cisco1

hostname L3
ip domain name my.home

crypto key generate rsa modulus 4096
ip ssh version 2

line vty 0 4
 transport input ssh
 login local


ip vrf MGT
 rd 1:100

no ip http server
no ip http secure-server

spanning-tree portfast bpduguard

interface Ethernet0/0
 ip address 192.168.2.254 255.255.255.0
 no shutdown

interface Ethernet0/1
 ip address 192.168.1.254 255.255.255.0
 no shutdown

interface Ethernet0/2
 ip address 192.168.10.254 255.255.255.0
 no shutdown

interface Ethernet2/3
 ip vrf forwarding MGT
 ip address 10.1.0.252 255.255.255.0
 no shutdown
 exit

ip route vrf MGT 0.0.0.0 0.0.0.0 10.1.0.254
```
</details>

# VPN 設定前の状態
L3 部分をプライオと想定して eth1 を mtu 1444 に設定する


<details><summary>VPN設定前</summary>

VyOS default に続けて流し込む config


### 設定前 RT-00
```config:RT-00
set interfaces ethernet eth0 address '10.1.0.100/24'
set interfaces ethernet eth0 description 'MGT_RT-00'
set interfaces ethernet eth0 vrf MGT

set interfaces ethernet eth1 address '192.168.2.1/24'
set interfaces ethernet eth1 description 'L3_RT-00'
set interfaces ethernet eth1 mtu 1444

set interfaces ethernet eth2 address '172.16.0.1/24'
set interfaces ethernet eth2 description 'LAN_RT-00'

set protocols static route 0.0.0.0/0 next-hop 172.16.0.254 interface eth2
set protocols static route 192.168.0.0/16 next-hop 192.168.2.254 interface eth1

commit
save
```

### 設定前 RT-10
```config:RT-10
set interfaces ethernet eth0 address '10.1.0.110/24'
set interfaces ethernet eth0 description 'MGT_RT-10'
set interfaces ethernet eth0 vrf MGT

set interfaces ethernet eth1 address '192.168.10.1/24'
set interfaces ethernet eth1 description 'L3_RT-10'
set interfaces ethernet eth1 mtu 1444

set interfaces ethernet eth2 address '172.16.10.1/24'
set interfaces ethernet eth2 description 'LAN_RT-10'

set protocols static route 192.168.0.0/16 next-hop 192.168.10.254 interface eth1

commit
save
```

</details>

# VPN 設定の共通部分

```config:VPN共通設定
# ESP,IKE 暗号化方式の設定 (プロファイルの作成)
# IKE 👉 sa (ipsec v1 の phase1)
# ESP 👉 child-sa (ipsec v1 の phase2)
set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group14'
set vpn ipsec esp-group ESP_DEFAULT proposal 1 encryption 'aes256gcm128'
set vpn ipsec esp-group ESP_DEFAULT proposal 1 hash 'sha512'
set vpn ipsec ike-group IKE_DEFAULT dead-peer-detection action 'restart'
set vpn ipsec ike-group IKE_DEFAULT dead-peer-detection interval '15'
set vpn ipsec ike-group IKE_DEFAULT dead-peer-detection timeout '30'
set vpn ipsec ike-group IKE_DEFAULT ikev2-reauth
set vpn ipsec ike-group IKE_DEFAULT key-exchange 'ikev2'
set vpn ipsec ike-group IKE_DEFAULT lifetime '28800'
set vpn ipsec ike-group IKE_DEFAULT proposal 1 dh-group '31'
set vpn ipsec ike-group IKE_DEFAULT proposal 1 encryption 'chacha20poly1305'
set vpn ipsec ike-group IKE_DEFAULT proposal 1 hash 'sha512'

# VPN間通信 (WAN側, トンネル)
set vpn ipsec interface eth1
set protocols static route 169.254.0.0/24 interface vti10

# 推奨設定
set vpn ipsec options disable-route-autoinstall

# site-to-site のプロファイル
set vpn ipsec site-to-site peer Site2Site ike-group 'IKE_DEFAULT'
set vpn ipsec site-to-site peer Site2Site vti esp-group 'ESP_DEFAULT'
set vpn ipsec site-to-site peer Site2Site authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer Site2Site ikev2-reauth inherit
set vpn ipsec site-to-site peer Site2Site vti bind 'vti10'
set vpn ipsec site-to-site peer Site2Site connection-type 'initiate'
```

## 個別設定

[「フレッツ・VPN プライオ」でVPN装置（CPE）下部へルータを設置する場合のMTU値設定について](https://business.ntt-east.co.jp/bizdrive/column/vpnprio_router_mtu.html) によると、トンネルインターフェースの mss は 1334 になるそうな。
西日本はオプションが付いて小さくなるとか言っていたような、いなかったような...。取りあえず mss は 1334 で。

### RT-00
```config:RT-00 の VPN設定

# 列挙した IP アドレスで使用する共通鍵 (psk)
set vpn ipsec authentication psk Site2Site id RT-00
set vpn ipsec authentication psk Site2Site id RT-10
set vpn ipsec authentication psk Site2Site secret 'secret_ABC-def'

set vpn ipsec site-to-site peer Site2Site authentication local-id  RT-00
set vpn ipsec site-to-site peer Site2Site authentication remote-id  RT-10
set vpn ipsec site-to-site peer Site2Site local-address '192.168.2.1'
set vpn ipsec site-to-site peer Site2Site remote-address '192.168.10.1'

# トンネル用アドレス
set interfaces vti vti10 address '169.254.0.100/24'
set interfaces vti vti10 description 'RT-00_tunnel'
set interfaces vti vti10 ip adjust-mss '1334'

# VPN 用ルート
set protocols static route 172.16.10.0/24 next-hop 169.254.0.110 interface vti10
```

### RT-10
```config:RT-10 の VPN設定

# 列挙した IP アドレスで使用する共通鍵 (psk)
set vpn ipsec authentication psk Site2Site id RT-10
set vpn ipsec authentication psk Site2Site id RT-00
set vpn ipsec authentication psk Site2Site secret 'secret_ABC-def'

set vpn ipsec site-to-site peer Site2Site authentication local-id RT-10
set vpn ipsec site-to-site peer Site2Site authentication remote-id RT-00
set vpn ipsec site-to-site peer Site2Site local-address '192.168.10.1'
set vpn ipsec site-to-site peer Site2Site remote-address '192.168.2.1'

# トンネル用アドレス
set interfaces vti vti10 address '169.254.0.110/24'
set interfaces vti vti10 description 'RT-10_tunnel'
set interfaces vti vti10 ip adjust-mss '1334'

set protocols static route 0.0.0.0/0 interface vti10
# NAT の向こうへ traceroute が通らないので
set protocols static route 192.168.0.0/24 interface vti10
```

# 通信試験
通信試験用端末の 172.16.0.10
インターネットの 1.1.1.1
に夫れ夫れ traceroute をうってみる

```shell:通信試験
vyos@RT-10:~$ traceroute 172.16.0.10 no-resolve
traceroute to 172.16.0.10 (172.16.0.10), 30 hops max, 60 byte packets
 1  169.254.0.100  2.517 ms  2.322 ms  2.210 ms
 2  172.16.0.10  2.123 ms  2.048 ms  1.964 ms
vyos@RT-10:~$
vyos@RT-10:~$ traceroute 1.1.1.1 source-address 172.16.10.1 no-resolve
traceroute to 1.1.1.1 (1.1.1.1), 30 hops max, 60 byte packets
 1  169.254.0.100  2.287 ms  2.115 ms  2.042 ms
 2  172.16.0.254  3.593 ms  3.519 ms  3.339 ms
 3  192.168.0.254  5.119 ms  7.039 ms  7.010 ms
 4  192.168.10.254  7.234 ms  8.428 ms  9.046 ms
.....(略)
13  162.158.4.25  9.974 ms  9.796 ms 162.158.4.43  7.245 ms
14  1.1.1.1  6.193 ms  7.334 ms  11.229 ms
vyos@RT-10:~$
```
無事、接続できましたね。

ルーティングなど
```shell:RT-10
vyos@RT-10:~$ show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface    IP Address        MAC                VRF        MTU  S/L    Description
-----------  ----------------  -----------------  -------  -----  -----  -------------
eth0         10.1.0.110/24     50:00:00:04:00:00  MGT       1500  u/u    MGT_RT-10
eth1         192.168.10.1/24   50:00:00:04:00:01  default   1444  u/u    L3_RT-10
eth2         172.16.10.1/24    50:00:00:04:00:02  default   1500  u/u    LAN_RT-10
eth3         -                 50:00:00:04:00:03  default   1500  u/u
lo           127.0.0.1/8       00:00:00:00:00:00  default  65536  u/u
             ::1/128
vti10        169.254.0.110/24  n/a                default   1500  u/u    RT-10_tunnel
vyos@RT-10:~$ show ip route
Codes: K - kernel route, C - connected, S - static, R - RIP,
       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
       f - OpenFabric,
       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
       t - trapped, o - offload failure

S>* 0.0.0.0/0 [1/0] is directly connected, vti10, weight 1, 00:45:58
S   169.254.0.0/24 [1/0] is directly connected, vti10, weight 1, 00:45:58
C>* 169.254.0.0/24 is directly connected, vti10, 00:45:58
C>* 172.16.10.0/24 is directly connected, eth2, 00:46:05
S>* 192.168.0.0/16 [1/0] via 192.168.10.254, eth1, weight 1, 00:46:02
S>* 192.168.0.0/24 [1/0] is directly connected, vti10, weight 1, 00:44:03
C>* 192.168.10.0/24 is directly connected, eth1, 00:46:06
```

# 接続時の状態
```shell:VPN接続状態 (RT-00)
vyos@RT-00:~$ show vpn ipsec connections
Connection     State    Type    Remote address    Local TS    Remote TS    Local id    Remote id    Proposal
-------------  -------  ------  ----------------  ----------  -----------  ----------  -----------  ---------------------------------------
Site2Site      up       IKEv2   192.168.10.1      -           -            RT-00       RT-10        CHACHA20_POLY1305/None/None/CURVE_25519
Site2Site-vti  up       IPsec   192.168.10.1      0.0.0.0/0   0.0.0.0/0    RT-00       RT-10        AES_GCM/256/None/None
                                                  ::/0        ::/0
vyos@RT-00:~$
vyos@RT-00:~$
vyos@RT-00:~$ show vpn ike sa
Peer ID / IP                            Local ID / IP
------------                            -------------
192.168.10.1 RT-10                      192.168.2.1 RT-00

    State  IKEVer  Encrypt      Hash          D-H Group      NAT-T  A-Time  L-Time
    -----  ------  -------      ----          ---------      -----  ------  ------
    up     IKEv2   CHACHA20_POLY1305 n/a           CURVE_25519    no     1489    26637

Peer ID / IP                            Local ID / IP
------------                            -------------
192.168.10.1 RT-10                      192.168.2.1 RT-00

    State  IKEVer  Encrypt      Hash          D-H Group      NAT-T  A-Time  L-Time
    -----  ------  -------      ----          ---------      -----  ------  ------
    up     IKEv2   CHACHA20_POLY1305 n/a           CURVE_25519    no     1449    24794

vyos@RT-00:~$
vyos@RT-00:~$
vyos@RT-00:~$ show vpn ipsec sa
Connection     State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
-------------  -------  --------  --------------  ----------------  ----------------  -----------  --------------
Site2Site-vti  up       24m14s    0B/0B           0/0               192.168.10.1      RT-10        AES_GCM_16_256
Site2Site-vti  up       24m54s    0B/0B           0/0               192.168.10.1      RT-10        AES_GCM_16_256
vyos@RT-00:~$
vyos@RT-00:~$
vyos@RT-00:~$ show interfaces
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface    IP Address        MAC                VRF        MTU  S/L    Description
-----------  ----------------  -----------------  -------  -----  -----  -------------
eth0         10.1.0.100/24     50:00:00:05:00:00  MGT       1500  u/u    MGT_RT-00
eth1         192.168.2.1/24    50:00:00:05:00:01  default   1444  u/u    L3_RT-00
eth2         172.16.0.1/24     50:00:00:05:00:02  default   1500  u/u    LAN_RT-00
eth3         -                 50:00:00:05:00:03  default   1500  A/D
lo           127.0.0.1/8       00:00:00:00:00:00  default  65536  u/u
             ::1/128
vti10        169.254.0.100/24  n/a                default   1500  u/u    RT-00_tunnel
vyos@RT-00:~$
```

センターを 2台にして冗長化...は追記予定