doc/user/nhrpd.rst

   1 .. _nhrp:
   2
   3 ****
   4 NHRP
   5 ****
   6
   7 *nhrpd* is an implementation of the :abbr:`NHRP (Next Hop Routing Protocol)`.
   8 NHRP is described in :rfc:`2332`.
   9
  10 NHRP is used to improve the efficiency of routing computer network traffic over
  11 :abbr:`NBMA (Non-Broadcast, Multiple Access)` networks. NHRP provides an
  12 ARP-like solution that allows a system to dynamically learn the NBMA address of
  13 the other systems that are part of that network, allowing these systems to
  14 directly communicate without requiring traffic to use an intermediate hop.
  15
  16 NHRP is a client-server protocol. The server side is called the :abbr:`NHS
  17 (Next Hop Server)` or the hub, while a client is referred to as the :abbr:`NHC
  18 (Next Hop Client)` or the spoke. When a node is configured as an NHC, it
  19 registers its address with the NHS which keeps track of all registered spokes.
  20 An NHC client can then query the addresses of other clients from NHS allowing
  21 all spokes to communicate directly with each other.
  22
  23 Cisco Dynamic Multipoint VPN (DMVPN) is based on NHRP, and |PACKAGE_NAME| nhrpd
  24 implements this scenario.
  25
  26 .. _routing-design:
  27
  28 Routing Design
  29 ==============
  30
  31 nhrpd never handles routing of prefixes itself. You need to run some
  32 real routing protocol (e.g. BGP) to advertise routes over the tunnels.
  33 What nhrpd does it establishes 'shortcut routes' that optimizes the
  34 routing protocol to avoid going through extra nodes in NBMA GRE mesh.
  35
  36 nhrpd does route NHRP domain addresses individually using per-host prefixes.
  37 This is similar to Cisco FlexVPN; but in contrast to opennhrp which uses
  38 a generic subnet route.
  39
  40 To create NBMA GRE tunnel you might use the following (Linux terminal
  41 commands):
  42
  43 .. code-block:: console
  44
  45    ip tunnel add gre1 mode gre key 42 ttl 64
  46    ip addr add 10.255.255.2/32 dev gre1
  47    ip link set gre1 up
  48
  49
  50 Note that the IP-address is assigned as host prefix to gre1. nhrpd will
  51 automatically create additional host routes pointing to gre1 when
  52 a connection with these hosts is established.
  53
  54 The gre1 subnet prefix should be announced by routing protocol from the
  55 hub nodes (e.g. BGP 'network' announce). This allows the routing protocol
  56 to decide which is the closest hub and determine the relay hub on prefix
  57 basis when direct tunnel is not established.
  58
  59 nhrpd will redistribute directly connected neighbors to zebra. Within
  60 hub nodes, these routes should be internally redistributed using some
  61 routing protocol (e.g. iBGP) to allow hubs to be able to relay all traffic.
  62
  63 This can be achieved in hubs with the following bgp configuration (network
  64 command defines the GRE subnet):
  65
  66 .. code-block:: frr
  67
  68   router bgp 65555
  69    address-family ipv4 unicast
  70      network 172.16.0.0/16
  71      redistribute nhrp
  72    exit-address-family
  73
  74
  75 .. _configuring-nhrp:
  76
  77 Configuring NHRP
  78 ================
  79
  80 .. clicmd:: ip nhrp holdtime (1-65000)
  81
  82    Holdtime is the number of seconds that have to pass before stopping to
  83    advertise an NHRP NBMA address as valid. It also controls how often NHRP
  84    registration requests are sent. By default registrations are sent every one
  85    third of the holdtime.
  86
  87 .. clicmd:: ip nhrp map A.B.C.D|X:X::X:X A.B.C.D|local
  88
  89    Map an IP address of a station to the station's NBMA address.
  90
  91 .. clicmd:: ip nhrp network-id (1-4294967295)
  92
  93    Enable NHRP on this interface and set the interface's network ID.  The
  94    network ID is used to allow creating multiple nhrp domains on a router when
  95    multiple interfaces are configured on the router.  Interfaces configured
  96    with the same ID are part of the same logical NBMA network. The ID is a
  97    local only parameter and is not sent to other NHRP nodes and so IDs on
  98    different nodes do not need to match. When NHRP packets are received on an
  99    interface they are assigned to the local NHRP domain for that interface.
 100
 101 .. clicmd:: ip nhrp nhs A.B.C.D nbma A.B.C.D|FQDN
 102
 103    Configure the Next Hop Server address and its NBMA address.
 104
 105 .. clicmd:: ip nhrp nhs dynamic nbma A.B.C.D
 106
 107    Configure the Next Hop Server to have a dynamic address and set its NBMA
 108    address.
 109
 110 .. clicmd:: ip nhrp registration no-unique
 111
 112    Allow the client to not set the unique flag in the NHRP packets. This is
 113    useful when a station has a dynamic IP address that could change over time.
 114
 115 .. clicmd:: ip nhrp shortcut
 116
 117    Enable shortcut (spoke-to-spoke) tunnels to allow NHC to talk to each others
 118    directly after establishing a connection without going through the hub.
 119
 120 .. clicmd:: ip nhrp mtu
 121
 122    Configure NHRP advertised MTU.
 123
 124
 125 .. _hub-functionality:
 126
 127 Hub Functionality
 128 =================
 129
 130 In addition to routing nhrp redistributed host prefixes, the hub nodes
 131 are also responsible to send NHRP Traffic Indication messages that
 132 trigger creation of the shortcut tunnels.
 133
 134 nhrpd sends Traffic Indication messages based on network traffic captured
 135 using NFLOG. Typically you want to send Traffic Indications for network
 136 traffic that is routed from gre1 back to gre1 in rate limited manner.
 137 This can be achieved with the following iptables rule.
 138
 139 .. code-block:: shell
 140
 141    iptables -A FORWARD -i gre1 -o gre1 \\
 142        -m hashlimit --hashlimit-upto 4/minute --hashlimit-burst 1 \\
 143        --hashlimit-mode srcip,dstip --hashlimit-srcmask 24 --hashlimit-dstmask 24 \\
 144        --hashlimit-name loglimit-0 -j NFLOG --nflog-group 1 --nflog-range 128
 145
 146
 147 You can fine tune the src/dstmask according to the prefix lengths you announce
 148 internal, add additional IP range matches, or rate limitation if needed.
 149 However, the above should be good in most cases.
 150
 151 This kernel NFLOG target's nflog-group is configured in global nhrp config
 152 with:
 153
 154 .. clicmd:: nhrp nflog-group (1-65535)
 155
 156 To start sending these traffic notices out from hubs, use the nhrp
 157 per-interface directive:
 158
 159 .. clicmd:: ip nhrp redirect
 160
 161 This enable redirect replies on the NHS similar to ICMP redirects except this
 162 is managed by the nhrp protocol. This setting allows spokes to communicate with
 163 each others directly.
 164
 165 .. _integration-with-ike:
 166
 167 Integration with IKE
 168 ====================
 169
 170 nhrpd needs tight integration with IKE daemon for various reasons.
 171 Currently only strongSwan is supported as IKE daemon.
 172
 173 nhrpd connects to strongSwan using VICI protocol based on UNIX socket which
 174 can be configured using the command below (default to /var/run/charon.vici).
 175
 176 strongSwan currently needs few patches applied. Please check out the
 177 original patches at:
 178 https://git-old.alpinelinux.org/user/tteras/strongswan/
 179
 180 Actively maintained patches are also available at:
 181 https://gitlab.alpinelinux.org/alpine/aports/-/tree/master/main/strongswan
 182
 183 .. _multicast-functionality:
 184
 185 Multicast Functionality
 186 =======================
 187
 188 nhrpd can be configured to forward multicast packets, allowing routing
 189 protocols that use multicast (such as OSPF) to be supported in the DMVPN
 190 network.
 191
 192 This support requires an iptables NFLOG rule to allow nhrpd to intercept
 193 multicast packets. A second iptables rule is also usually used to drop the
 194 original multicast packet.
 195
 196  .. code-block:: shell
 197
 198    iptables -A OUTPUT -d 224.0.0.0/24 -o gre1 -j NFLOG --nflog-group 2
 199    iptables -A OUTPUT -d 224.0.0.0/24 -o gre1 -j DROP
 200
 201 .. clicmd:: nhrp multicast-nflog-group (1-65535)
 202
 203    Sets the nflog group that nhrpd will listen on for multicast packets. This
 204    value must match the nflog-group value set in the iptables rule.
 205
 206 .. clicmd:: ip nhrp map multicast A.B.C.D|X:X::X:X A.B.C.D|dynamic
 207
 208    Sends multicast packets to the specified NBMA address. If dynamic is
 209    specified then destination NBMA address (or addresses) are learnt
 210    dynamically.
 211
 212 .. _nhrp-events:
 213
 214 NHRP Events
 215 ===========
 216
 217 .. clicmd:: nhrp event socket SOCKET
 218
 219    Configure the Unix path for the event socket.
 220
 221 .. _show-nhrp:
 222
 223 Show  NHRP
 224 ==========
 225
 226 .. clicmd:: show [ip|ipv6] nhrp cache [json]
 227
 228    Dump the cache entries.
 229
 230 .. clicmd:: show [ip|ipv6] nhrp opennhrp [json]
 231
 232    Dump the cache entries with opennhrp format.
 233
 234 .. clicmd:: show [ip|ipv6] nhrp nhs [json]
 235
 236    Dump the hub context.
 237
 238 .. clicmd:: show dmvpn [json]
 239
 240    Dump the security contexts.
 241
 242 Configuration Example
 243 =====================
 244
 245 .. figure:: ../figures/fig_dmvpn_topologies.png
 246    :alt: image
 247
 248    image
 249
 250 IPSec configurration example
 251 ----------------------------
 252
 253 This changes required on all nodes as HUB and Spokes.
 254
 255 ipsec.conf file
 256
 257 .. code-block:: shell
 258
 259   config setup
 260   conn dmvpn
 261       authby=secret
 262       auto=add
 263       keyexchange=ikev2
 264       ike=aes256-aes256-sha256-modp2048
 265       esp=aes256-aes256-sha256-modp2048
 266       dpdaction=clear
 267       dpddelay=300s
 268       left=%any
 269       leftid=%any
 270       right=%any
 271       rightid=%any
 272       leftprotoport=gre
 273       rightprotoport=gre
 274       type=transport
 275       keyingtries=%forever
 276
 277 ipsec.secrets file
 278
 279 .. code-block:: shell
 280
 281   %any : PSK "some_s3cret!"
 282
 283
 284 HUB configuration example
 285 -------------------------
 286
 287 Creating gre interface
 288
 289 .. code-block:: console
 290
 291    ip tunnel add gre1 mode gre key 42 ttl 64
 292    ip addr add 10.0.0.254/32 dev gre1
 293    ip link set gre1 up
 294
 295 Adding iptables rules to provide possibility shortcut tunnels and connect spokes directly
 296
 297 .. code-block:: shell
 298
 299    iptables -A FORWARD -i gre1 -o gre1 \\
 300        -m hashlimit --hashlimit-upto 4/minute --hashlimit-burst 1 \\
 301        --hashlimit-mode srcip,dstip --hashlimit-srcmask 24 --hashlimit-dstmask 24 \\
 302        --hashlimit-name loglimit-0 -j NFLOG --nflog-group 1 --nflog-range 128
 303
 304 FRR config on HUB
 305
 306 .. code-block:: frr
 307
 308   nhrp nflog-group 1
 309   !
 310   interface gre1
 311    description DMVPN Tunnel Interface
 312    ip address 10.0.0.254/32
 313    ip nhrp network-id 1
 314    ip nhrp redirect
 315    ip nhrp registration no-unique
 316    ip nhrp shortcut
 317    tunnel protection vici profile dmvpn
 318    tunnel source eth0
 319    !
 320    router bgp 65000
 321     bgp router-id 10.0.0.254
 322     no bgp ebgp-requires-policy
 323     neighbor SPOKES peer-group
 324     neighbor SPOKES disable-connected-check
 325     neighbor 10.0.0.1 remote-as 65001
 326     neighbor 10.0.0.1 peer-group SPOKES
 327     neighbor 10.0.0.2 remote-as 65002
 328     neighbor 10.0.0.2 peer-group SPOKES
 329     neighbor 10.0.0.3 remote-as 65003
 330     neighbor 10.0.0.3 peer-group SPOKES
 331     !
 332     address-family ipv4 unicast
 333      network 172.16.0.0/24
 334      redistribute nhrp
 335     exit-address-family
 336
 337 Spoke1 configuration
 338 --------------------
 339
 340 Creating gre interface
 341
 342 .. code-block:: console
 343
 344    ip tunnel add gre1 mode gre key 42 ttl 64
 345    ip addr add 10.0.0.1/32 dev gre1
 346    ip link set gre1 up
 347
 348
 349 FRR config on Spoke1
 350
 351 .. code-block:: frr
 352
 353   interface gre1
 354    description DMVPN Tunnel Interface
 355    ip address 10.0.0.1/32
 356    ip nhrp network-id 1
 357    ip nhrp nhs dynamic nbma 198.51.100.1
 358    ip nhrp redirect
 359    ip nhrp registration no-unique
 360    ip nhrp shortcut
 361    no link-detect
 362    tunnel protection vici profile dmvpn
 363    tunnel source eth0
 364   !
 365   router bgp 65001
 366    no bgp ebgp-requires-policy
 367    neighbor 10.0.0.254 remote-as 65000
 368    neighbor 10.0.0.254 disable-connected-check
 369    !
 370    address-family ipv4 unicast
 371     network 172.16.1.0/24
 372    exit-address-family
 373
 374
 375 Spoke2 configuration
 376 --------------------
 377
 378 Creating gre interface
 379
 380 .. code-block:: console
 381
 382    ip tunnel add gre1 mode gre key 42 ttl 64
 383    ip addr add 10.0.0.1/32 dev gre1
 384    ip link set gre1 up
 385
 386 FRR config on Spoke2
 387
 388 .. code-block:: frr
 389
 390   interface gre1
 391    description DMVPN Tunnel Interface
 392    ip address 10.0.0.2/32
 393    ip nhrp network-id 1
 394    ip nhrp nhs dynamic nbma 198.51.100.1
 395    ip nhrp redirect
 396    ip nhrp registration no-unique
 397    ip nhrp shortcut
 398    no link-detect
 399    tunnel protection vici profile dmvpn
 400    tunnel source eth0
 401   !
 402   router bgp 65002
 403    no bgp ebgp-requires-policy
 404    neighbor 10.0.0.254 remote-as 65000
 405    neighbor 10.0.0.254 disable-connected-check
 406    !
 407    address-family ipv4 unicast
 408     network 172.16.2.0/24
 409    exit-address-family
 410
 411
 412 Spoke3 configuration
 413 --------------------
 414
 415 Creating gre interface
 416
 417 .. code-block:: console
 418
 419    ip tunnel add gre1 mode gre key 42 ttl 64
 420    ip addr add 10.0.0.3/32 dev gre1
 421    ip link set gre1 up
 422
 423 FRR config on Spoke3
 424
 425 .. code-block:: frr
 426
 427   interface gre1
 428    description DMVPN Tunnel Interface
 429    ip address 10.0.0.3/32
 430    ip nhrp network-id 1
 431    ip nhrp nhs dynamic nbma 198.51.100.1
 432    ip nhrp redirect
 433    ip nhrp registration no-unique
 434    ip nhrp shortcut
 435    no link-detect
 436    tunnel protection vici profile dmvpn
 437    tunnel source eth0
 438   !
 439   router bgp 65003
 440    no bgp ebgp-requires-policy
 441    neighbor 10.0.0.254 remote-as 65000
 442    neighbor 10.0.0.254 disable-connected-check
 443    !
 444    address-family ipv4 unicast
 445     network 172.16.3.0/24
 446    exit-address-family
 447