Subject: [IPsec] Can one IPsec SA be established via two internet ports on one device?

From: Linda Dunbar <[email-masked]>
Date: Mon, 19 Nov 2018 19:19:32 +0000

IPsec experts,

In the following diagram, CPE1 has two internet ports, A1 by one service provider, A2 by another service provider.
CPE2 also have two ports facing two different internet service providers

Question: can I establish ONE IPsec SA between CPE1 & CPE2? (i.e. between 10.1.1.1 & 10.1.2.1)?
But the actual packets sent out from A1 port has to use A1 as Source-Address, and using B1 or other public address as Destination address.

Or is it necessary to have one IPsec SA between A1<->B1, one IPsec SA between A1<->B2, one IPsec SA between A2<->B1, and one IPsec SA between A2<->B2?

Thanks, Linda Dunbar

---

From: joel jaeggli <[email-masked]>
Date: Mon, 19 Nov 2018 12:17:40 -0800

> On Nov 19, 2018, at 11:19, Linda Dunbar <[email-masked] <mailto:[email-masked]>> wrote:
> 
> IPsec experts, 
>  

If in your example the source and destination IPs are sourced loopbacks that are part of a prefix exported to  the the isp(s) in each site then you could in fact have one association…

If the CPEs are using a provider assigned ip for tunnel termination  you’re going to need 4.

We do the former all the time with sites multi-homed via bgp.

> _______________________________________________
> IPsec mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/ipsec <https://www.ietf.org/mailman/listinfo/ipsec>

---

From: Linda Dunbar <[email-masked]>
Date: Mon, 19 Nov 2018 21:15:57 +0000

Joel,

Thanks for the help.

When you said “IPs are sourced loopbacks that are part of a prefix exported to the the isp(s) in each site”, do you mean that the private Loopback addresses of CPE1 & CPE2 are routable in all four  ISPs’ that connected to A1, A2, B1, B2?

Linda

From: joel jaeggli [mailto:[email-masked]]
Sent: Monday, November 19, 2018 2:18 PM
To: Linda Dunbar <[email-masked]>
Cc: IPsecME WG <[email-masked]>
Subject: Re: [IPsec] Can one IPsec SA be established via two internet ports on one device?

On Nov 19, 2018, at 11:19, Linda Dunbar <[email-masked]<mailto:[email-masked]>> wrote:

IPsec experts,

Thanks, Linda Dunbar
_______________________________________________
IPsec mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Michael Richardson <[email-masked]>
Date: Mon, 19 Nov 2018 17:24:25 -0500

Linda Dunbar <[email-masked]> wrote:
    > When you said “IPs are sourced loopbacks that are part of a prefix
    > exported to the the isp(s) in each site”, do you mean that the private
    > Loopback addresses of CPE1 & CPE2 are routable in all four ISPs’ that
    > connected to A1, A2, B1, B2?

No, he is saying that the CPE1 and CPE2 are each using provider independent
address space and are multihomed to ISP1/ISP2 and ISP3/ISP4 respectively.

If the *private* addresss space of CPE1/CPE2 were visible to the ISPs,
then it wouldn't really be a V*Private*N.  Such things are common in MPLS,
ATM, FrameRelay, and the newer L3VPN technologies that are sold as managed
solutions.

You need four IPsec SAs.  They could be transport+GRE/IPIP tunnels rather
than IPsec Tunnel model SAs with a routing protocol on-top though.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Paul Wouters <[email-masked]>
Date: Mon, 19 Nov 2018 22:23:42 -0500 (EST)

On Mon, 19 Nov 2018, Linda Dunbar wrote:

> When you said “IPs are sourced loopbacks that are part of a prefix exported to the the isp(s) in each site”,
> do you mean that the private Loopback addresses of CPE1 & CPE2 are routable in all four  ISPs’ that

And to clarify, assuming your IPsec connection does not cover the IPs
used on both endpoints, but instead is some kind of subnet behind your
servers, then you can one IPsec SA. It does require some tricks if you
really want to limit it to one IPsec SA.

Remember that while you can choose which outgoing interface to use,
you cannot choose the incoming device, so it would be a poor load balance.

It is far easier to use two IPsec SA's that cover the same site-to-site
range.

On Linux, the easiest would be to setup two identical subnet-to-subnet
IPsec SA with a different XFRM mark. Then create a VTI device for each
of these. Then you can use routing and traffic shaping/control to send
packets to one or the other VTI interface for load balancing. If one of
the links goes down, the interface goes down and it all goes over the
remaining interace. Libreswan and strongswan support this. For
libreswan, use:

conn one
 	[basic config]
 	mark=8/0xffffffff
 	vti-interface=ispA
 	vti-routing=no
 	vti-shared=no
conn two
 	[basic config]
 	mark=7/0xffffffff
 	vti-interface=ispB
 	vti-routing=no
 	vti-shared=no

Then handle the routing/traffic control yourself.

Another solution for this is using MOBIKE, but then you are only using
one of the two in a failover type of scenario, and it is not doing any
kind of load balancing. Again libreswan and strongswan support this.

Paul