Dynamic Multipoint VPN (DMVPN) Phase 3 with Quagga NHRPd

= Overview =
This is a follow-up of the most famous document,
since opennhrp has been rewritten as quagga plugin [1], supporting interoperability with new Cisco's FlexVPN and Strongswan.
This NHRP implementation has some limits yet (Multicast is not ready, so you need to use BGP rather than OSPF), though is usable in a production environment.
This How-To will show you how to configure a DMVPN solution with this key items:
.1 VPN setup with Strongswan with PSK for the authentication (same PSK between all of the spokes and hub)
.2 DMVPN setup with quagga.nhrpd; 
.3 iBGP used for announce LAN subnet
.4 Awall rules to allow NHRP shortcuts between spokes
The goal is making private network of spoke's nodes and hub to communicate each other over VPN created dynamically.
Routes are learned via BGP, and hte IPSEC VPN is authenticated via PSK.
The logical setup is configured as shown:
= Terminology =
;NBMA: Non-Broadcast Multi-Access network as described in RFC 2332
;Hub: the Next Hop Server (NHS) performing the Next Hop Resolution Protocol service within the NBMA cloud.
;Spoke: the Next Hop Resolution Protocol Client (NHC) which initiates NHRP requests of various types in order to obtain access to the NHRP service.
= Hardware =
For supporting VIA Padlock engine enable its modules:
= Alpine Installation =
Follow the instructions about how to create a bootable USB.
= Spoke Nodes =
== Spoke Node 1 ==
== Networking ==
We're going to setup the spoke node 1 as follow:
Host 	Interface	Description	Subnet
Spoke 1	eth0 	Internet 	DHCP
Spoke 1	eth1 	LAN 	192.168.10.0/24
Spoke 1	gre1 	Tunnel 	172.16.1.1
Spoke 2	eth0 	Internet 	DHCP
Spoke 2	eth1 	LAN 	192.168.20.0/24
Spoke 2	gre1 	Tunnel 	172.16.2.1
Spoke 3	eth0 	Internet 	90.100.150.200
Spoke 3	eth1 	LAN 	192.168.30.0/24
Spoke 3	gre1 	Tunnel 	172.16.3.1
With your favorite editor open /etc/network/interfaces and add interfaces:
== SSH ==
Remove password authentication and DNS reverse lookup:
Restart ssh:
== GRE Tunnel ==
With your favorite editor open /etc/network/interfaces and add the following:
Bring up the new gre1 interface:
== IPSEC ==
Install package(s):
Start service(s):
== Routing ==
This section will configure the routing protocol suite quagga patched with NHRP support.
}
Fix permissions:
}
Start all the daemons:
Configure it to start from boot:
Now we're going to configure it with vtysh cli:
= Hub Node =
We will document only what changes from the Spoke node setup.
== Networking ==
The NHS (Hub) has the following settings:
Host	Interface	Description	Subnet
Hub 	eth0 	Internet 	50.60.70.80
Hub 	eth1 	LAN 	192.168.1.0/24
With your favorite editor open /etc/network/interfaces and add interfaces:
== GRE Tunnel ==
With your favorite editor open /etc/network/interfaces and add the following:
Bring up the new gre1 interface:
== Routing ==
Again, routing is configured directly with vtysh
Add the lines neighbor %Spoke1_GRE_IP%... for each spoke node you have.
For instance, if you want to add spoke node with gre1 address 172.16.3.1: 
== Awall ==
Differently from DMVPN Phase 2, in the Phase 3 DMVPN the HUB is the default gateway for all the spokes, then the spokes are able to communicate directly each other by means of NHRP redirects.
(For a good explanation of the differences between Phase 1, Phase 2 and Phase 3 DMVPN, see https://ine.com/blog/2008-12-23-dmvpn-phase-3).
This is implemented by sending traffic indication notifications with iptables nflog.
This is the complete firewall configuration for the HUB, using Alpine Firewall Framework, Awall.
With your favorite editor open /etc/awall/optional/zones.json:
Now, create /etc/awall/optional/inet.json:
Now, the DMVPN rule:
Management interface allowed traffic:
NHRP redirects rule:
Enable awall rules:
Apply awall rules:
== IPSEC ==
Install package(s):
Start service(s):
Now, test if it works.
In this example, spoke 1 tries to connect to spoke 3, who announces his subnet 192.168.30.0/24 via iBGP, the gre1 address is 172.16.3.1 and the public ip address is 90.100.150.200.
The first traffic goes from through the HUB.
Then, once the VPN is created, the traffic goes directly to the spoke node.
 
With ipsec --status-all you can see alle the VPNs created:
= See also =
* Dynamic Multipoint VPN (DMVPN)
* Setup of DMVPN on Alpine linux
category: VPN