Page History

This page intend to list bunch of scenarios for our SD-EWAN case, including the decomposed scenarios and the overall integrated scenario.

Table of Contents

Decomposed scenarios

Decomposed Scenario A: Site-to-Site tunnel with static public IP address

In this scenario, both sites have static public IP address and setup a tunnel between sites. After the tunnel is established, the clients within the site should be able to ping the clients on the other side through the tunnel. The tunnel is authenticated through pre-shared key.

...

Scenario Description:

Code Block

language	yml
title	Sample CR for gatewayA
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IPSecSite
metadata:
  name: siteA
spec:
  node: node1
  gateway: 192.168.1.11
  pre_shared_key: test123
  auth_method: psk
  local_identifier: @moon.strongswan.org
  remote_identifier: @sun.strongswan.org
  crypto_proposal: proposal1
  force_crypto_proposal: true
  connection:
  - name: connA
    type: tunnel
    mode: start
    local_subnet: 10.1.0.1/24
    local_sourceip: 192.168.1.10
    local_firewall: yes
    remote_subnet: 10.2.0.1/24
    remote_firewall: yes
    keyexchange: ikev2
    crypto_proposal: proposal1
  proposals:
    - name: proposal1
      encryption_algorithm: aes128
      hash_algorithm: sha256
      dh_group: modp3072

IPSec CR for gateway B:

Tunnel between site A and site B
Suppose there are two sites A and B. A comes with the subnet 10.1.0.1/24, B comes with the subnet 10.2.0.1/24
Gateway for A is 192.168.1.10
Gateway for B is 192.168.1.11
A and B would like to establish a tunnel
10.1.0.1/24 == 10.2.0.1/24

CRs for the scenario

Code Block

language	yml
title	Proposal CR
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecProposal
metadata:
  name: test_proposal_1
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  encryption_algorithm: aes128
  hash_algorithm: sha256
  dh_group: modp3072
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Code Block

language	yml
title	Sample CR for gateway A
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecSite
metadata:
  name: siteA
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: 192.168.1.11
  authentication_method: psk
  pre_shared_key: test123
  crypto_proposal: 
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
      mode: start
      local_subnet: 10.1.0.1/24
      remote_subnet: 10.2.0.1/24
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Code Block

language	yml
title	Sample CR for gateway B
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecSite
metadata:
  name: siteB
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote

Code Block

language	yml
title	Sample CR for gatewayB
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IPSecSite
metadata:
  name: siteB
spec:
  node: node2
  gateway: 192.168.1.10
  pre_shared_key: test123
  auth_method: psk
  local_identifier: @moon.strongswan.org
  remote_identifier: @sun.strongswan.org
  crypto_proposal: proposal1
  force_crypto_proposal: true
  connection:
  - name: connA
    type: tunnel
    mode: start
    local_subnet: 10.2.0.1/24
    local_sourceip: 192.168.1.1110
    local_firewallauthentication_method: yespsk
    remote_subnet: 10.1.0.1/24pre_shared_key: test123
    remotecrypto_firewallproposal: yes
    keyexchange: ikev2
    crypto_proposal: proposal1- test_proposal_1
  proposalconnections:
    - connection_name: proposal1connection_B
      encryption_algorithmtype: aes128tunnel
      hash_algorithmmode: sha256start
      dhlocal_group: modp3072

NAT CR:

...

Rest calls:

Sites settings

GET /cgi-bin/luci/sdewan/ipsec/v1/sites

subnet: 10.2.0.1/24
      remote_subnet: 10.1.0.1/24
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Rest calls

Sites settings

GET /cgi-bin/luci/sdewan/ipsec/v1/sites

{
"sites": [

{

{
"sites": [

{

"name": “siteA",

"gateway":"192.168.1.11",

"crypto_proposal": "proposal1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"local_identifiername": “siteA"@moon.strongswan.org",

"remote_identifier":"@sun192.168.strongswan1.org11",

"connectionscrypto_proposal": ["test_proposal_1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"connections": [

{ "name": "connection_A { "name": "connA",

"type": "tunnel",

"mode": "start",

"local_subnet": "10.1.0.1/24",

"remote_subnet": "10.2.0.1/24",

"crypto_proposal": "proposal1test_proposal_1"

}

]

},

{ "name": "siteB",

"gateway":"192.168.1.10",

"crypto_proposal": "proposal1test_proposal_1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"remote_identifier": "@moon.strongswan.org",

"local_identifier": "@sun.strongswan.org",

"connections": [

{ "name": "connAconnection_B",

"type": "tunnel",

"mode": "start",

"local_subnet": "10.2.0.1/24",

"remote_subnet": "10.1.0.1/24",

"crypto_proposal": "proposal1test_proposal_1"

}

]

}

]
}

...

{ "proposals": [ { "name": "proposal1", "crypto_algorithm": "aes128", "hash_algorithm": "sha256", "dh_group": "modp3072" } ] }

Decomposed Scenario B: Host-to-Site

...

tunnel when the initiator requests an overlay IP

In this scenario, the initiator sends out a request to the responderthe responder(either a site gateway/remote host) which has a static public ip address(or dynamic pubic IP with static domain name) in order to setup a tunnel between. However, this time, the roadwarrior is also going to ask for a virtual IP that assigned by the responder. After the tunnel is established, the roadwarrior should be able to get an overlay IP and ping the clients on the other side through the tunnel. The tunnel is authenticated through pre-shared key.

Image Removed

IPSec CR for Gateway A:

Code Block

language	yml
title	Sample CR for gatewayA
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IPSecSite
metadata:
  name: siteA
spec:
  node: node1
  gateway: 192.168.1.15
  pre_shared_key: test123
  auth_method: psk
  local_identifier: @sun.strongswan.org
  remote_identifier: @roadwarrior.strongswan.org
  crypto_proposal: proposal1
  force_crypto_proposal: true
  connection:
  - name: connA
    type: tunnel
    mode: start
    local_subnet: 10.1.0.1/24
    local_sourceip: 192.168.1.10
    remote_sourceip: 192.168.1.15
    crypto_proposal: proposal1
  proposal:
    - name: proposal1
      encryption_algorithm: aes128
      hash_algorithm: sha256
      dh_group: modp3072

IPSec CR for roadwarrior(initiator):

Image Added

Scenario Description:

Tunnel between site A and host B(Responder and Initiator)
Suppose there is one site A and one host B. A comes with the subnet 10.1.0.1/24.
Gateway for A is 192.168.1.10 which is a public ip address
Host B has no public address and want to request one from the peer(suppose the vip assigned is 10.3.0.12)
A and B would like to establish a tunnel
10.1.0.1/24 == 10.3.0.12/32

CRs for the scenario

Code Block

language	yml
title	Proposal CR
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecProposal
metadata:
  name: test_proposal_1
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  encryption_algorithm: aes128
  hash_algorithm: sha256
  dh_group: modp3072
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Code Block

language	yml
title	sample Sample CR for roadwarriorgateway A
collapse	true

apiVersion: sdewan sdewan.akraino.org/v1alpha1
kind: IPSecSite IpsecSite
metadata:
  name: siteA
  namenamespace: roadwarriordefault
spec  labels:
  node  sdewanPurpose: roadwarriorcnf-1
spec:
  gatewayremote: 192.168.1.10%any
  preauthentication_shared_keymethod: test123psk
  authpre_shared_methodkey: psktest
  localcrypto_identifierproposal: @roadwarrior.strongswan.org
  remote_identifier: @sun.strongswan.org
 - cryptotest_proposal: "proposal1"_1
  force_crypto_proposal: trueconnections:
  connection:
  - connection_name: connAconnection_A
      type: tunnel
      mode: start
      local_sourceipsubnet: 19210.1681.10.151/24
      remote_subnetsourceip: 10.13.0.1/24
    remote_sourceip: 192.168.1.10
    crypto_proposal:
 proposal1
   proposal:
    - name: proposal1test_proposal_1
status:
      encryption_algorithmappliedVersion: aes128"1"
      hash_algorithm: sha256
      dh_group: modp3072

NAT CR:

...

Rest calls:

Sites settings

GET /cgi-bin/luci/sdewan/ipsec/v1/sites

appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Code Block

language	yml
title	Sample CR for host B
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecHost
metadata:
  name: hostB
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: 192.168.1.10
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal: 
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
      mode: start
      local_sourceip: %config
      remote_subnet: 0.0.0.0/0
      crypto_proposal:
        - test_proposal_1 
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Rest calls

Sites settings

GET /cgi-bin/luci/sdewan/ipsec/v1/sites

{
"sites": [

{ "name": "siteA",

"gateway":"192.168.1.11",

"crypto_proposal": "proposal1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"local_identifier": "@moon.strongswan.org",

"remote_identifier": "@sun.strongswan.org",

"connections": [

{ "name": "connA",

"type": "tunnel",

"mode": "start",

"local_subnet": "10.1.0.1/24",

"remote_sourceip": "192.168.1.15",

"local_sourceip": "192.168.1.10",

"crypto_proposal": "proposal1"

}

]

},

{ "name": "roadwarriorsiteA",

"gatewayremote":"192.168.1.10%any",

"crypto_proposal": "proposal1test_proposal_1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"remotelocal_identifier": "@moon.strongswan.org",

"localremote_identifier": "@sun.strongswan.org",

"connections": [

{ "name": "connA",

"type": "tunnel",

"mode": "start",

"local_sourceipsubnet": "19210.168.1.15", "remote_sourceip": "192.168.1.100.1/24",

"remote_subnetsourceip": "10.13.0.1/24",

"crypto_proposal": "proposal1test_proposal_1"

}

]

},

} ]
}

Proposal settings

GET /cgi-bin/luci/sdewan/ipsec/v1/proposals

{ "name": "hostB",

"remote":"192.168.1.10",

"crypto_proposal": "test_proposal_1",

{ "proposals": [

{

"

name

pre_shared_key": "

proposal1

test123",

"

crypto

authentication_

algorithm

method": "

aes128

psk",

"

hash

remote_

algorithm

identifier": "

sha256

@moon.strongswan.org",

"

dh_group

local_identifier": "@sun.strongswan.org",

"connections": [

{ "name": "connA",

"type": "

modp3072

tunnel",

}

]

}

Decomposed Scenario C: Host-to-Site tunnel when the initiator requests an overlay IP

In this scenario, the initiator sends out a request to the responder(either a site gateway/remote host) which has a static public ip address(or dynamic pubic IP with static domain name) in order to setup a tunnel between. However, this time, the roadwarrior is also going to ask for a virtual IP that assigned by the responder. After the tunnel is established, the roadwarrior should be able to get an overlay IP and ping the clients on the other side through the tunnel. The tunnel is authenticated through pre-shared key.

Image Removed

IPSec CR for Gateway A:

Code Block

language	yml
title	Sample CR for gatewayA
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IPSecSite
metadata:
  name: siteA
spec:
  node: node1
  gateway: any
  pre_shared_key: test123
  auth_method: psk
  local_identifier: @moon.strongswan.org
  remote_identifier: @roadwarrior.strongswan.org
  crypto_proposal: proposal1
  force_crypto_proposal: true
  connection:
  - name: connA
    type: tunnel
    mode: start
    local_subnet: 10.1.0.1/24
    local_sourceip: 192.168.1.10
    local_firewall: yes
    remote_sourceip: 10.3.0.1/24
    remote_firewall: yes
    crypto_proposal: "proposal1"
  proposal:
    - name: proposal1
      encryption_algorithm: aes128
      hash_algorithm: sha256
      dh_group: modp3072

IPSec CR for roadwarrior(initiator):

"mode": "start",

"local_sourceip": "%config",

"remote_subnet": "10.1.0.1/24",

"crypto_proposal": "test_proposal_1"

}

]

}

]
}

Proposal settings

GET /cgi-bin/luci/sdewan/ipsec/v1/proposals

{ "proposals": [ { "crypto_algorithm": "aes128", "hash_algorithm": "sha256", "dh_group": "modp3072" } ] }

Decomposed Scenario C: Host to host tunnel

Setup a tunnel between the host who got assigned the virtual IP and another host with PIP.

Image Added

Scenario Description:

Tunnel between host A and host B
Suppose there are two hosts A and B.
A has a public ip which is 192.168.3.1
B is a host which already get a vip 10.3.0.12
A and B would like to establish a tunnel
192.168.3.1/32 == 10.3.0.12/32

CRs for the scenario

Code Block

language	yml
title	Proposal CR
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecProposal
metadata:
  name: test_proposal_1
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  encryption_algorithm: aes128
  hash_algorithm: sha256
  dh_group: modp3072
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Code Block

language	yml
title	Sample CR for host A
collapse	true

apiVersion: sdewan

Code Block

language	yml
title	Sample CR for roadwarrior
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IPSecSite IpsecHost
metadata:
  name: hostA
  namenamespace: roadwarriordefault
spec  labels:
  node: roadwarrior
  gatewaysdewanPurpose: 192.168.1.10cnf-1
spec:
  pre_shared_keyremote: test123%any
  authauthentication_method: psk
  localpre_shared_identifierkey: @roadwarrior.strongswan.orgtest
  remotecrypto_identifierproposal: @moon.strongswan.org
  crypto  - test_proposal: proposal1_1
  force_crypto_proposal: trueconnections:
  connection:
  - connection_name: connAconnection_A
      type: tunnel
      mode: start
    local_sourceip: %config
    local_firewall: yes
    remote_subnetsourceip: 10.13.0.1/2412
     remote crypto_sourceip: 192.168.1.10proposal:
    remote_firewall: yes
   - cryptotest_proposal: "proposal1"_1 
status:
  proposalappliedVersion: "1"
    - name: proposal1appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Code Block

language	yml
title	Sample CR for host B
collapse	true

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecHost
metadata:
  name: hostB
  encryption_algorithmnamespace: aes128default
  labels:
    hash_algorithm: sha256
      dh_group: modp3072

NAT CR:

...

Rest calls:

Sites settings

GET /cgi-bin/luci/sdewan/ipsec/v1/sites

sdewanPurpose: cnf-1
spec:
  remote: 192.168.3.1
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal: 
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
      mode: start
      local_sourceip: 10.3.0.13
      crypto_proposal:
        - test_proposal_1 
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Rest calls

Sites settings

GET /cgi-bin/luci/sdewan/ipsec/v1/sites

{
"sites": [

{ "name": "siteA",

"gateway":"192.168.1.11",

"crypto_proposal": "proposal1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"local_identifier": "@moon.strongswan.org",

"remote_identifier": "@sun.strongswan.org",

"connections": [

{ "name": "connA",

"type": "tunnel",

"mode": "start",

"local_subnet": "10.1.0.1/24",

"remote_sourceip": "10.3.0.1/24",

{
"sites": [

{ "name": "hostA",

"remote":"%any",

"crypto_proposal": "test_proposal_1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"local_identifier": "@moon.strongswan.org",

"

local

remote_

sourceip

identifier": "

192

@sun.

168.1.10

strongswan.org",

"connections": [

{ "name": "connA",

"type": "tunnel",

"mode": "start",

"remote_sourceip": "10.3.0.12",

"crypto_proposal": "

proposal1

test_proposal_1"

}

]

},

{ "name": "

roadwarrior

hostB",

"

gateway

remote":"192.168.3.1

.10

",

"crypto_proposal": "

proposal1"

test_proposal_1",

"pre_shared_key": "test123",

"authentication_method": "psk",

"remote_identifier": "@moon.strongswan.org",

"local_identifier": "@sun.strongswan.org",

"connections": [

{ "name": "connA",

"type": "tunnel",

"mode": "start",

"local

_sourceip": "%config", "remote

_sourceip": "

192.168.1.

10

", "remote_subnet": "10.1

.3.0.

1/24

12",

"crypto_proposal": "

proposal1

test_proposal_1"

}

]

}

]
}

Proposal settings

GET /cgi-bin/luci/sdewan/ipsec/v1/proposals

{ "proposals": [ {

"name": "proposal1",

"crypto_algorithm": "aes128", "hash_algorithm": "sha256", "dh_group": "modp3072" } ] }

Targeted Scenarios

...

Scenario A: Edge to traffic hub tunnel where inter micro-service communication across edges that attached to same traffic hub.

Image Added

Section

border	true

Column

width	40%

Code Block

language	yml
title	Sample CR for edgeA
collapse	true

CR for sdewan cnf on edgeA:

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecHost
metadata:
  name: edgeA
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: 10.239.160.22
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal:
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
      mode: start
      local_sourceip: %config
      remote_subnet: 0.0.0.0/0, 10.239.160.22/32
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Column

width	20%

The CRs defined will then be interpreted into some IPSec configuration that could be recognized by Openwrt and then translate to Strongswan configs

Column

width	40%

Code Block

language	yml
title	Strongswan configs for edgeA
collapse	true

Strongswan configs for sdewan cnf on edgeA:

conn siteA-connA
  left=%any
  right=10.239.160.22
  leftsourceip=%config
  rightsubnet=0.0.0.0/0,10.239.160.22/32
  leftauth=psk
  rightauth=psk
  auto=start
  keyexchange=ikev2
  esp=aes192-sha1-modp3072
  ike=aes192-sha1-modp3072
  type=tunnel

Section

border	true

Column

width	40%

Code Block

language	yml
title	Sample CR for edgeB
collapse	true

CR on sdewan cnf on edgeB:

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecHost
metadata:
  name: edgeB
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: 10.239.160.22
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal:
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
      mode: start
      local_sourceip: %config
      remote_subnet: 0.0.0.0/0, 10.239.160.22/32
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Column

width	20%

The CRs defined will then be interpreted into some IPSec configuration that could be recognized by Openwrt and then translate to Strongswan configs

Column

width	40%

Code Block

language	yml
title	Strongswan configs for edgeB
collapse	true

Strongswan configs for sdewan cnf on edgeB:

conn edgeB-connA
  left=%any
  right=10.239.160.22
  leftsourceip=%config
  rightsubnet=0.0.0.0/0,10.239.160.22/32
  leftauth=psk
  rightauth=psk
  auto=start
  keyexchange=ikev2
  esp=aes192-sha1-modp3072
  ike=aes192-sha1-modp3072
  type=tunnel

Section

border	true

Column

width	40%

Code Block

language	yml
title	Sample CR for Hub
collapse	true

CR on sdewan on hub:

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecSite
metadata:
  name: Hub
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: %any
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal:
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
      mode: start
      local_subnet: 172.12.0.1/24,10.239.160.22/32
      remote_sourceip: 172.12.0.1/24
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Column

width	20%

The CRs defined will then be interpreted into some IPSec configuration that could be recognized by Openwrt and then translate to Strongswan configs

Column

width	40%

Code Block

language	yml
title	Strongswan configs for hub
collapse	true

Strongswan configs for sdewan cnf on hub:

conn tunnel
  left=10.239.160.22
  leftsubnet=172.12.0.1/24,10.239.160.22/32
  rightsourceip=172.12.0.30-172.12.0.45
  leftauth=psk
  rightauth=psk
  auto=start
  keyexchange=ikev2
  ike=aes192-sha1-modp3072
  esp=aes192-sha1-modp3072
  type=tunnel

Scenario B: Edge to Edge tunnels when micro-service communication happens across edges without involving hubs

Image Added

Section

border	true

Column

width	40%

Code Block

language	yml
title	Sample CR for EdgeA
collapse	true

CR on sdewan cnf on edgeA:

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecHost
metadata:
  name: edgeA
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: 10.239.40.42
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal:
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
      mode: start
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Column

width	20%

The CRs defined will then be interpreted into some IPSec configuration that could be recognized by Openwrt and then translate to Strongswan configs

Column

width	40%

Code Block

language	yml
title	Strongswan configs for edgeA
collapse	true

Strongswan configs for sdewan cnf on edgeA:

conn edgeA-connection_A
  left=%any
  right=10.239.40.42
  leftauth=psk
  rightauth=psk
  auto=start
  keyexchange=ikev2
  ike=aes192-sha1-modp3072
  esp=aes192-sha1-modp3072
  type=tunnel

Section

border	true

Column

width	40%

Code Block

language	yml
title	Sample CR for EdgeB
collapse	true

CR on sdewan cnf on edgeB:

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecHost
metadata:
  name: edgeB
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: 10.239.160.22
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal:
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
      mode: start
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Column

width	20%

The CRs defined will then be interpreted into some IPSec configuration that could be recognized by Openwrt and then translate to Strongswan configs

Column

width	40%

Code Block

language	yml
title	Strongswan configs for edgeB
collapse	true

Strongswan configs for sdewan cnf on edgeB:

conn edgeB-connection_A
  left=%any
  right=10.239.160.22
  leftauth=psk
  rightauth=psk
  auto=start
  keyexchange=ikev2
  ike=aes192-sha1-modp3072
  esp=aes192-sha1-modp3072
  type=tunnel

Scenario C: Hub to hub tunnel when inter micro-service communication across edges that attached to different traffic hubs

Image Added

Section

border	true

Column

width	40%

Code Block

language	yml
title	Sample CR for edgeA
collapse	true

CR for sdewan cnf on edgeA:

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecHost
metadata:
  name: edgeA
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: 10.239.160.22
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal:
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
      mode: start
      local_sourceip: %config
      remote_subnet: 0.0.0.0/0, 10.239.160.22/32
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Column

width	20%

The CRs defined will then be interpreted into some IPSec configuration that could be recognized by Openwrt and then translate to Strongswan configs

Column

width	40%

Code Block

language	yml
title	Strongswan configs for edgeA
collapse	true

Strongswan configs for sdewan cnf on edgeA:

conn edgeB-connection_A
  left=%any
  right=10.239.160.22
  localsourceip=%config
  rightsubnet=0.0.0.0/0,10.239.160.22/32
  leftauth=psk
  rightauth=psk
  auto=start
  keyexchange=ikev2
  ike=aes192-sha1-modp3072
  esp=aes192-sha1-modp3072
  type=tunnel

Section

border	true

Column

width	40%

Code Block

language	yml
title	Sample CR for edgeB
collapse	true

CR for sdewan cnf on edgeB:

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecHost
metadata:
  name: edgeB
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: 10.239.40.42
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal:
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
      mode: start
      local_sourceip: %config
      remote_subnet: 0.0.0.0/0, 10.239.40.42/32
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Column

width	20%

The CRs defined will then be interpreted into some IPSec configuration that could be recognized by Openwrt and then translate to Strongswan configs

Column

width	40%

Code Block

language	yml
title	Strongswan configs for edgeB
collapse	true

Strongswan configs for sdewan cnf on edgeB:

conn edgeB-connection_A
  left=%any
  right=10.239.40.42
  localsourceip=%config
  rightsubnet=0.0.0.0/0,10.239.40.42/32
  leftauth=psk
  rightauth=psk
  auto=start
  keyexchange=ikev2
  ike=aes192-sha1-modp3072
  esp=aes192-sha1-modp3072
  type=tunnel

Section

border	true

Column

width	40%

Code Block

language	yml
title	Sample CR for HubA
collapse	true

CR on sdewan on hubA:

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecSite
metadata:
  name: HubA
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: %any
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal:
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
      mode: start
      local_subnet: 172.12.0.1/24,10.239.160.22/32
      remote_sourceip: 172.12.0.30-172.12.0.45
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

---

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecSite
metadata:
  name: HubA
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: 10.239.40.42
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal:
    - test_proposal_1
  connections:
    - connection_name: connection_B
      type: tunnel
      mode: start
      local_subnet: 172.12.0.1/24,10.239.160.22/32
      remote_subnet: 172.12.1.1/24,10.239.40.42/32
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Column

width	20%

The CRs defined will then be interpreted into some IPSec configuration that could be recognized by Openwrt and then translate to Strongswan configs

Column

width	40%

Code Block

language	yml
title	Strongswan configs for HubA
collapse	true

Strongswan configs for sdewan cnf on hub:

conn HubA-connection_A
  left=%any
  leftsubnet=172.12.0.1/24,10.239.160.22/32
  rightsourceip=172.12.0.30-172.12.0.45
  leftauth=psk
  rightauth=psk
  auto=start
  keyexchange=ikev2
  ike=aes192-sha1-modp3072
  esp=aes192-sha1-modp3072
  type=tunnel
conn HubA-connection_B
  left=%any
  leftsubnet=172.12.0.1/24,10.239.160.22/32
  rightsubnet=172.12.1.1/24,10.239.40.42/32
  leftauth=psk
  rightauth=psk
  auto=start
  keyexchange=ikev2
  ike=aes192-sha1-modp3072
  esp=aes192-sha1-modp3072
  type=tunnel

Section

border	true

Column

width	40%

Code Block

language	yml
title	Sample CR for HubB
collapse	true

CR on sdewan on hubB:

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecSite
metadata:
  name: HubB
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: %any
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal:
    - test_proposal_1
  connections:
    - connection_name: connection_A
      type: tunnel
      mode: start
      local_subnet: 172.12.1.1/24,10.239.40.42/32
      remote_sourceip: 172.12.1.31-172.12.1.35
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

---

apiVersion: sdewan.akraino.org/v1alpha1
kind: IpsecSite
metadata:
  name: HubB
  namespace: default
  labels:
    sdewanPurpose: cnf-1
spec:
  remote: 10.239.160.22
  authentication_method: psk
  pre_shared_key: test
  crypto_proposal:
    - test_proposal_1
  connections:
    - connection_name: connection_B
      type: tunnel
      mode: start
      remote_subnet: 172.12.0.1/24,10.239.160.22/32
      local_subnet: 172.12.1.1/24,10.239.40.42/32
      crypto_proposal:
        - test_proposal_1
status:
  appliedVersion: "1"
  appliedTime: "2020-04-12T09:28:38Z"
  inSync: True

Column

width	20%

The CRs defined will then be interpreted into some IPSec configuration that could be recognized by Openwrt and then translate to Strongswan configs

Column

width	40%

Code Block

language	yml
title	Strongswan configs for HubB
collapse	true

Strongswan configs for sdewan cnf on hub:

conn HubB-connection_A
  left=%any
  leftsubnet=172.12.1.1/24,10.239.40.42/32
  rightsourceip=172.12.1.31-172.12.1.35
  leftauth=psk
  rightauth=psk
  auto=start
  keyexchange=ikev2
  ike=aes192-sha1-modp3072
  esp=aes192-sha1-modp3072
  type=tunnel
conn HubA-connection_B
  left=%any
  leftsubnet=172.12.1.1/24,10.239.40.42/32
  rightsubnet=172.12.0.1/24,10.239.160.42/32
  leftauth=psk
  rightauth=psk
  auto=start
  keyexchange=ikev2
  ike=aes192-sha1-modp3072
  esp=aes192-sha1-modp3072
  type=tunnel

Overall scenarios

Here shows the overall scenario we want to achieve in the ICN SDEWAN case.

...

Space shortcuts

Page tree

Versions Compared

Old Version 7

New Version Current

Key

Decomposed scenarios

Decomposed Scenario A: Site-to-Site tunnel with static public IP address

IPSec CR for gateway B:

CRs for the scenario

NAT CR:

Rest calls:

Rest calls

Decomposed Scenario B: Host-to-Site

tunnel when the initiator requests an overlay IP

IPSec CR for Gateway A:

IPSec CR for roadwarrior(initiator):

CRs for the scenario

NAT CR:

Rest calls:

Rest calls

Decomposed Scenario C: Host-to-Site tunnel when the initiator requests an overlay IP

IPSec CR for Gateway A:

IPSec CR for roadwarrior(initiator):

Decomposed Scenario C: Host to host tunnel

CRs for the scenario

NAT CR:

Rest calls:

Rest calls

Targeted Scenarios

Scenario A: Edge to traffic hub tunnel where inter micro-service communication across edges that attached to same traffic hub.

Scenario B: Edge to Edge tunnels when micro-service communication happens across edges without involving hubs

Scenario C: Hub to hub tunnel when inter micro-service communication across edges that attached to different traffic hubs

Image Added

Overall scenarios