doc/user/nhrpd.rst

   1 .. _nhrp:
   2
   3 ****
   4 NHRP
   5 ****
   6
   7 *nhrpd* is an implementation of the :abbr:`NHRP (Next Hop Routing Protocol)`.
   8 NHRP is described in :rfc:`2332`.
   9
  10 NHRP is used to improve the efficiency of routing computer network traffic over
  11 :abbr:`NBMA (Non-Broadcast, Multiple Access)` networks. NHRP provides an
  12 ARP-like solution that allows a system to dynamically learn the NBMA address of
  13 the other systems that are part of that network, allowing these systems to
  14 directly communicate without requiring traffic to use an intermediate hop.
  15
  16 NHRP is a client-server protocol. The server side is called the :abbr:`NHS
  17 (Next Hop Server)` or the hub, while a client is referred to as the :abbr:`NHC
  18 (Next Hop Client)` or the spoke. When a node is configured as an NHC, it
  19 registers its address with the NHS which keeps track of all registered spokes.
  20 An NHC client can then query the addresses of other clients from NHS allowing
  21 all spokes to communicate directly with each other.
  22
  23 Cisco Dynamic Multipoint VPN (DMVPN) is based on NHRP, and |PACKAGE_NAME| nhrpd
  24 implements this scenario.
  25
  26 .. _routing-design:
  27
  28 Routing Design
  29 ==============
  30
  31 nhrpd never handles routing of prefixes itself. You need to run some
  32 real routing protocol (e.g. BGP) to advertise routes over the tunnels.
  33 What nhrpd does it establishes 'shortcut routes' that optimizes the
  34 routing protocol to avoid going through extra nodes in NBMA GRE mesh.
  35
  36 nhrpd does route NHRP domain addresses individually using per-host prefixes.
  37 This is similar to Cisco FlexVPN; but in contrast to opennhrp which uses
  38 a generic subnet route.
  39
  40 To create NBMA GRE tunnel you might use the following (Linux terminal
  41 commands):
  42
  43 .. code-block:: console
  44
  45    ip tunnel add gre1 mode gre key 42 ttl 64
  46    ip addr add 10.255.255.2/32 dev gre1
  47    ip link set gre1 up
  48
  49
  50 Note that the IP-address is assigned as host prefix to gre1. nhrpd will
  51 automatically create additional host routes pointing to gre1 when
  52 a connection with these hosts is established.
  53
  54 The gre1 subnet prefix should be announced by routing protocol from the
  55 hub nodes (e.g. BGP 'network' announce). This allows the routing protocol
  56 to decide which is the closest hub and determine the relay hub on prefix
  57 basis when direct tunnel is not established.
  58
  59 nhrpd will redistribute directly connected neighbors to zebra. Within
  60 hub nodes, these routes should be internally redistributed using some
  61 routing protocol (e.g. iBGP) to allow hubs to be able to relay all traffic.
  62
  63 This can be achieved in hubs with the following bgp configuration (network
  64 command defines the GRE subnet):
  65
  66 .. code-block:: frr
  67
  68   router bgp 65555
  69    address-family ipv4 unicast
  70      network 172.16.0.0/16
  71      redistribute nhrp
  72    exit-address-family
  73
  74
  75 .. _configuring-nhrp:
  76
  77 Configuring NHRP
  78 ================
  79
  80 .. clicmd:: ip nhrp holdtime (1-65000)
  81
  82    Holdtime is the number of seconds that have to pass before stopping to
  83    advertise an NHRP NBMA address as valid. It also controls how often NHRP
  84    registration requests are sent. By default registrations are sent every one
  85    third of the holdtime.
  86
  87 .. clicmd:: ip nhrp map A.B.C.D|X:X::X:X A.B.C.D|local
  88
  89    Map an IP address of a station to the station's NBMA address.
  90
  91 .. clicmd:: ip nhrp network-id (1-4294967295)
  92
  93    Enable NHRP on this interface and set the interface's network ID.  The
  94    network ID is used to allow creating multiple nhrp domains on a router when
  95    multiple interfaces are configured on the router.  Interfaces configured
  96    with the same ID are part of the same logical NBMA network. The ID is a
  97    local only parameter and is not sent to other NHRP nodes and so IDs on
  98    different nodes do not need to match. When NHRP packets are received on an
  99    interface they are assigned to the local NHRP domain for that interface.
 100
 101 .. clicmd:: ip nhrp nhs A.B.C.D nbma A.B.C.D|FQDN
 102
 103    Configure the Next Hop Server address and its NBMA address.
 104
 105 .. clicmd:: ip nhrp nhs dynamic nbma A.B.C.D
 106
 107    Configure the Next Hop Server to have a dynamic address and set its NBMA
 108    address.
 109
 110 .. clicmd:: ip nhrp registration no-unique
 111
 112    Allow the client to not set the unique flag in the NHRP packets. This is
 113    useful when a station has a dynamic IP address that could change over time.
 114
 115 .. clicmd:: ip nhrp shortcut
 116
 117    Enable shortcut (spoke-to-spoke) tunnels to allow NHC to talk to each others
 118    directly after establishing a connection without going through the hub.
 119
 120 .. clicmd:: ip nhrp mtu
 121
 122    Configure NHRP advertised MTU.
 123
 124
 125 .. _hub-functionality:
 126
 127 Hub Functionality
 128 =================
 129
 130 In addition to routing nhrp redistributed host prefixes, the hub nodes
 131 are also responsible to send NHRP Traffic Indication messages that
 132 trigger creation of the shortcut tunnels.
 133
 134 nhrpd sends Traffic Indication messages based on network traffic captured
 135 using NFLOG. Typically you want to send Traffic Indications for network
 136 traffic that is routed from gre1 back to gre1 in rate limited manner.
 137 This can be achieved with the following iptables rule.
 138
 139 .. code-block:: shell
 140
 141    iptables -A FORWARD -i gre1 -o gre1 \\
 142        -m hashlimit --hashlimit-upto 4/minute --hashlimit-burst 1 \\
 143        --hashlimit-mode srcip,dstip --hashlimit-srcmask 24 --hashlimit-dstmask 24 \\
 144        --hashlimit-name loglimit-0 -j NFLOG --nflog-group 1 --nflog-range 128
 145
 146
 147 You can fine tune the src/dstmask according to the prefix lengths you announce
 148 internal, add additional IP range matches, or rate limitation if needed.
 149 However, the above should be good in most cases.
 150
 151 This kernel NFLOG target's nflog-group is configured in global nhrp config
 152 with:
 153
 154 .. clicmd:: nhrp nflog-group (1-65535)
 155
 156 To start sending these traffic notices out from hubs, use the nhrp
 157 per-interface directive:
 158
 159 .. clicmd:: ip nhrp redirect
 160
 161 This enable redirect replies on the NHS similar to ICMP redirects except this
 162 is managed by the nhrp protocol. This setting allows spokes to communicate with
 163 each others directly.
 164
 165 .. _integration-with-ike:
 166
 167 Integration with IKE
 168 ====================
 169
 170 nhrpd needs tight integration with IKE daemon for various reasons.
 171 Currently only strongSwan is supported as IKE daemon.
 172
 173 nhrpd connects to strongSwan using VICI protocol based on UNIX socket which
 174 can be configured using the command below (default to /var/run/charon.vici).
 175
 176 strongSwan currently needs few patches applied. Please check out the
 177 original patches at:
 178 https://git-old.alpinelinux.org/user/tteras/strongswan/
 179
 180 Actively maintained patches are also available at:
 181 https://gitlab.alpinelinux.org/alpine/aports/-/tree/master/main/strongswan
 182
 183 .. _nhrp-events:
 184
 185 NHRP Events
 186 ===========
 187
 188 .. clicmd:: nhrp event socket SOCKET
 189
 190    Configure the Unix path for the event socket.
 191
 192 .. _show-nhrp:
 193
 194 Show  NHRP
 195 ==========
 196
 197 .. clicmd:: show [ip|ipv6] nhrp cache [json]
 198
 199    Dump the cache entries.
 200
 201 .. clicmd:: show [ip|ipv6] nhrp opennhrp [json]
 202
 203    Dump the cache entries with opennhrp format.
 204
 205 .. clicmd:: show [ip|ipv6] nhrp nhs [json]
 206
 207    Dump the hub context.
 208
 209 .. clicmd:: show dmvpn [json]
 210
 211    Dump the security contexts.
 212
 213 Configuration Example
 214 =====================
 215
 216 .. figure:: ../figures/fig_dmvpn_topologies.png
 217    :alt: image
 218
 219    image
 220
 221 IPSec configurration example
 222 ----------------------------
 223
 224 This changes required on all nodes as HUB and Spokes.
 225
 226 ipsec.conf file
 227
 228 .. code-block:: shell
 229
 230   config setup
 231   conn dmvpn
 232       authby=secret
 233       auto=add
 234       keyexchange=ikev2
 235       ike=aes256-aes256-sha256-modp2048
 236       esp=aes256-aes256-sha256-modp2048
 237       dpdaction=clear
 238       dpddelay=300s
 239       left=%any
 240       leftid=%any
 241       right=%any
 242       rightid=%any
 243       leftprotoport=gre
 244       rightprotoport=gre
 245       type=transport
 246       keyingtries=%forever
 247
 248 ipsec.secrets file
 249
 250 .. code-block:: shell
 251
 252   %any : PSK "some_s3cret!"
 253
 254
 255 HUB configuration example
 256 -------------------------
 257
 258 Creating gre interface
 259
 260 .. code-block:: console
 261
 262    ip tunnel add gre1 mode gre key 42 ttl 64
 263    ip addr add 10.0.0.254/32 dev gre1
 264    ip link set gre1 up
 265
 266 Adding iptables rules to provide possibility shortcut tunnels and connect spokes directly
 267
 268 .. code-block:: shell
 269
 270    iptables -A FORWARD -i gre1 -o gre1 \\
 271        -m hashlimit --hashlimit-upto 4/minute --hashlimit-burst 1 \\
 272        --hashlimit-mode srcip,dstip --hashlimit-srcmask 24 --hashlimit-dstmask 24 \\
 273        --hashlimit-name loglimit-0 -j NFLOG --nflog-group 1 --nflog-range 128
 274
 275 FRR config on HUB
 276
 277 .. code-block:: frr
 278
 279   nhrp nflog-group 1
 280   !
 281   interface gre1
 282    description DMVPN Tunnel Interface
 283    ip address 10.0.0.254/32
 284    ip nhrp network-id 1
 285    ip nhrp redirect
 286    ip nhrp registration no-unique
 287    ip nhrp shortcut
 288    tunnel protection vici profile dmvpn
 289    tunnel source eth0
 290    !
 291    router bgp 65000
 292     bgp router-id 10.0.0.254
 293     no bgp ebgp-requires-policy
 294     neighbor SPOKES peer-group
 295     neighbor SPOKES disable-connected-check
 296     neighbor 10.0.0.1 remote-as 65001
 297     neighbor 10.0.0.1 peer-group SPOKES
 298     neighbor 10.0.0.2 remote-as 65002
 299     neighbor 10.0.0.2 peer-group SPOKES
 300     neighbor 10.0.0.3 remote-as 65003
 301     neighbor 10.0.0.3 peer-group SPOKES
 302     !
 303     address-family ipv4 unicast
 304      network 172.16.0.0/24
 305      redistribute nhrp
 306     exit-address-family
 307
 308 Spoke1 configuration
 309 --------------------
 310
 311 Creating gre interface
 312
 313 .. code-block:: console
 314
 315    ip tunnel add gre1 mode gre key 42 ttl 64
 316    ip addr add 10.0.0.1/32 dev gre1
 317    ip link set gre1 up
 318
 319
 320 FRR config on Spoke1
 321
 322 .. code-block:: frr
 323
 324   interface gre1
 325    description DMVPN Tunnel Interface
 326    ip address 10.0.0.1/32
 327    ip nhrp network-id 1
 328    ip nhrp nhs dynamic nbma 198.51.100.1
 329    ip nhrp redirect
 330    ip nhrp registration no-unique
 331    ip nhrp shortcut
 332    no link-detect
 333    tunnel protection vici profile dmvpn
 334    tunnel source eth0
 335   !
 336   router bgp 65001
 337    no bgp ebgp-requires-policy
 338    neighbor 10.0.0.254 remote-as 65000
 339    neighbor 10.0.0.254 disable-connected-check
 340    !
 341    address-family ipv4 unicast
 342     network 172.16.1.0/24
 343    exit-address-family
 344
 345
 346 Spoke2 configuration
 347 --------------------
 348
 349 Creating gre interface
 350
 351 .. code-block:: console
 352
 353    ip tunnel add gre1 mode gre key 42 ttl 64
 354    ip addr add 10.0.0.1/32 dev gre1
 355    ip link set gre1 up
 356
 357 FRR config on Spoke2
 358
 359 .. code-block:: frr
 360
 361   interface gre1
 362    description DMVPN Tunnel Interface
 363    ip address 10.0.0.2/32
 364    ip nhrp network-id 1
 365    ip nhrp nhs dynamic nbma 198.51.100.1
 366    ip nhrp redirect
 367    ip nhrp registration no-unique
 368    ip nhrp shortcut
 369    no link-detect
 370    tunnel protection vici profile dmvpn
 371    tunnel source eth0
 372   !
 373   router bgp 65002
 374    no bgp ebgp-requires-policy
 375    neighbor 10.0.0.254 remote-as 65000
 376    neighbor 10.0.0.254 disable-connected-check
 377    !
 378    address-family ipv4 unicast
 379     network 172.16.2.0/24
 380    exit-address-family
 381
 382
 383 Spoke3 configuration
 384 --------------------
 385
 386 Creating gre interface
 387
 388 .. code-block:: console
 389
 390    ip tunnel add gre1 mode gre key 42 ttl 64
 391    ip addr add 10.0.0.3/32 dev gre1
 392    ip link set gre1 up
 393
 394 FRR config on Spoke3
 395
 396 .. code-block:: frr
 397
 398   interface gre1
 399    description DMVPN Tunnel Interface
 400    ip address 10.0.0.3/32
 401    ip nhrp network-id 1
 402    ip nhrp nhs dynamic nbma 198.51.100.1
 403    ip nhrp redirect
 404    ip nhrp registration no-unique
 405    ip nhrp shortcut
 406    no link-detect
 407    tunnel protection vici profile dmvpn
 408    tunnel source eth0
 409   !
 410   router bgp 65003
 411    no bgp ebgp-requires-policy
 412    neighbor 10.0.0.254 remote-as 65000
 413    neighbor 10.0.0.254 disable-connected-check
 414    !
 415    address-family ipv4 unicast
 416     network 172.16.3.0/24
 417    exit-address-family
 418