Community discussions

MUM Europe 2020
 
gargola
newbie
Topic Author
Posts: 35
Joined: Tue Nov 20, 2012 12:05 am

Google Cloud Platform GCP - VPN - BGP

Sat Dec 01, 2018 1:50 am

Hi guys.

I'm trying to establish a vpn to GCP network but I have a doubt still can't resolve. I can establish the ipsec tunnel, but I don't have any interface o idea to where to configure the ip to create the bgp sessión. Is the same if I configure the VPN on GCP for static routing, the ipsec works, but I don't where to configure the static routing on my mikrotik to route to the ips on google cloud.

Best regards and thanks in advance.
Last edited by gargola on Wed Dec 05, 2018 2:21 am, edited 1 time in total.
 
User avatar
sri2007
Member Candidate
Member Candidate
Posts: 191
Joined: Wed May 20, 2015 10:14 pm
Location: Quito

Re: Google Cloud Platform GCP - VPN - BGP help

Sat Dec 01, 2018 5:37 pm

hello! If you have already an IPSec Site-to-Site between Google and your Mikrotik then I think that you'll need to create some special routes using policies and rules to reach the remote server, theoretically I think that it is possible, however can you please post the configs at both sites?
MikroTik Soporte y Consultoría - Español / English +593 98 709 3502
https://www.safenet.ec/consultoria.html/ soporte@safenet.ec
 
gargola
newbie
Topic Author
Posts: 35
Joined: Tue Nov 20, 2012 12:05 am

Re: Google Cloud Platform GCP - VPN - BGP help

Sun Dec 02, 2018 12:04 pm

Hi sri2007.

Thank you for your response, here is the configuration:
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha1 disabled=no enc-algorithms=aes-128-cbc,3des lifetime=30m name=default pfs-group=modp1024

/ip ipsec peer
add address=XX.XX.17.122/32 auth-method=pre-shared-key dh-group=modp1024 disabled=no dpd-interval=30s enc-algorithm=aes-128,3des exchange-mode=ike2 \
    generate-policy=no hash-algorithm=sha1 policy-template-group=default secret=test send-initial-contact=yes
    
/ip ipsec policy
add action=encrypt disabled=no dst-address=10.168.0.0/20 dst-port=any ipsec-protocols=esp level=unique priority=0 proposal=default protocol=all \
    sa-dst-address=XX.XX.17.122 sa-src-address=XX.XX.53.118 src-address=10.0.5.0/29 src-port=any tunnel=yes
    
/ip address
add address=10.0.5.1/29 interface=V2-1 network=10.0.5.0
Actually it seems that I have a one way issue, because my compute engine instance is able to ping my local segment 10.0.5.0/29, but from my Mikrotik I can't ping the cloud instance. I've checked firewall and everything related to it.

Here is the evidence from the cloud instance to my LAN segment. I think is the same issue, my Mikrotik doesn't know how to route to that destination, even so the policy is indicating that any traffic to 10.168.0.0/20 should go through the ipsec tunnel.
xxx@instance-1:~$ ifconfig
ens4: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1460
        inet 10.168.0.2  netmask 255.255.255.255  broadcast 0.0.0.0
        inet6 fe80::4001:aff:fea8:2  prefixlen 64  scopeid 0x20<link>
        ether 42:01:0a:a8:00:02  txqueuelen 1000  (Ethernet)
        RX packets 1809  bytes 1041959 (1.0 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1829  bytes 214386 (214.3 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 160  bytes 13111 (13.1 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 160  bytes 13111 (13.1 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

xxx@instance-1:~$ ping 10.0.5.1
PING 10.0.5.1 (10.0.5.1) 56(84) bytes of data.
64 bytes from 10.0.5.1: icmp_seq=1 ttl=63 time=78.6 ms
64 bytes from 10.0.5.1: icmp_seq=2 ttl=63 time=76.9 ms
64 bytes from 10.0.5.1: icmp_seq=3 ttl=63 time=84.9 ms
^C
--- 10.0.5.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 5ms
rtt min/avg/max/mdev = 76.920/80.126/84.871/3.423 ms

xxx@instance-1:~$ ping 10.168.0.2
PING 10.168.0.2 (10.168.0.2) 56(84) bytes of data.
64 bytes from 10.168.0.2: icmp_seq=1 ttl=64 time=0.015 ms
64 bytes from 10.168.0.2: icmp_seq=2 ttl=64 time=0.043 ms
^C
--- 10.168.0.2 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 29ms
rtt min/avg/max/mdev = 0.015/0.029/0.043/0.014 ms

xxx@instance-1:~$ sudo ufw status
Status: inactive
xxx@instance-1:~$ 
Best regards.
 
gargola
newbie
Topic Author
Posts: 35
Joined: Tue Nov 20, 2012 12:05 am

Re: Google Cloud Platform GCP - VPN - BGP help

Sun Dec 02, 2018 7:56 pm

Well, some sleep hours helped, I could figured it out after search a little, I had to add the NAT exception from the src/dst networks. Now I'm able to ping both ways. So the IPSEC tunnel is working.

But at this time is configured with static segments (only 10.0.5.0/29 to 10.168.0.02/0) I have to make it work through BGP to avoid manual configurations. I'm going to test to add a bridge interface with the bgp ip to see if I'm able to establish the session.
 
gargola
newbie
Topic Author
Posts: 35
Joined: Tue Nov 20, 2012 12:05 am

Re: Google Cloud Platform GCP - VPN - BGP help  [SOLVED]

Wed Dec 05, 2018 2:10 am

Finally made it.

To be able to route to the VPN I created a bridge to use it as the interface that has the ip for the BGP session and it turned in to my gateway to the cloud. If you're going to use static routes or policy based VPN is enough with the IPSEC Policies.

Any doubt feel free to contact me.
 
User avatar
eset
Frequent Visitor
Frequent Visitor
Posts: 63
Joined: Tue Dec 15, 2015 5:15 pm
Contact:

Re: Google Cloud Platform GCP - VPN - BGP

Wed Jan 16, 2019 11:46 am

Are you using dedicated instance from GCP side to connect with mikrotik or do you use dedicated VPN service from Google?
Two could you share the config ?
 
gargola
newbie
Topic Author
Posts: 35
Joined: Tue Nov 20, 2012 12:05 am

Re: Google Cloud Platform GCP - VPN - BGP

Fri Jul 05, 2019 7:27 pm

Hi Eset.

Sorry for the late response, I didn't received a notification email. I'm using the VPN service from GCP. What config do you need? router side or GCP platform?
 
errrata
just joined
Posts: 1
Joined: Fri Sep 06, 2019 2:25 am

Re: Google Cloud Platform GCP - VPN - BGP

Fri Sep 06, 2019 2:34 am

Hi gargola,

If you don't mind, would be great if you can post here the config from both sides in case someone would like to use a similar scenario.
I am also trying to create a similar Site-To-Site VPN between a mikrotik and a GCP project (using the VPN service), but without any luck, I didn't manage yet to make the two sides communicate
 
PeterFreeman
just joined
Posts: 15
Joined: Tue Aug 02, 2011 10:26 pm
Location: United Kingdom
Contact:

Re: Google Cloud Platform GCP - VPN - BGP

Wed Sep 18, 2019 1:06 pm

Hi gargola,

We're having similar issues with MikroTik and GCP VPN with BGP. Although our configuration appears to be correct, we're suffering from packet loss through the tunnel, it's not stable.
If you coudl publish your configuration from both ends we'd like to compare.

Thank you
 
gargola
newbie
Topic Author
Posts: 35
Joined: Tue Nov 20, 2012 12:05 am

Re: Google Cloud Platform GCP - VPN - BGP

Thu Sep 19, 2019 7:37 pm

Hi all.

Just give me the opportunity to have some time from my job and i'll publish the configuration.
 
PeterFreeman
just joined
Posts: 15
Joined: Tue Aug 02, 2011 10:26 pm
Location: United Kingdom
Contact:

Re: Google Cloud Platform GCP - VPN - BGP

Fri Sep 20, 2019 11:42 am

Hi gargola,

We used some of your setting for 'dpd' and timeouts and it appears to have solved the problem.
How did you arrive at those settings?
Maybe when we see the full config for both sides all will become clear...
Thank you for your effort and we all look forward to seeing the script when you have time to post.

Many thanks

Pete
 
gargola
newbie
Topic Author
Posts: 35
Joined: Tue Nov 20, 2012 12:05 am

Re: Google Cloud Platform GCP - VPN - BGP

Sat Sep 21, 2019 11:41 pm

Hi Pete

Here is the configuration on the router:
/interface bridge
add name="BGP GCP VPN" protocol-mode=none

/ip address
add address=169.254.0.1/30 comment="BGP GCP" interface="BGP GCP VPN" network=169.254.0.0

/ip ipsec profile
add dh-group=modp1024 enc-algorithm=aes-128 lifetime=10h10m name=profile_1 nat-traversal=no proposal-check=exact
/ip ipsec peer
add address=XX.XXX.XX.221/32 exchange-mode=ike2 name=peer2 profile=profile_1
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc lifetime=3h
/ip ipsec identity
add peer=peer2 secret=same-password-here-than-in-gcp
/ip ipsec policy
add dst-address=169.254.0.2/32 level=unique peer=peer2 sa-dst-address=XX.XXX.XX.221 sa-src-address=0.0.0.0 src-address=169.254.0.1/32 tunnel=yes
add dst-address=10.XX.XX.0/29 level=unique peer=peer2 sa-dst-address=XX.XXX.XX.221 sa-src-address=0.0.0.0 src-address=0.0.0.0/0 tunnel=yes

/routing bgp instance
set default as=64512 client-to-client-reflection=no redistribute-connected=yes redistribute-ospf=yes redistribute-static=yes router-id=XXX.XX.1.1
/routing bgp network
add network=169.254.0.0/30 synchronize=no
/routing bgp peer
add hold-time=infinity in-filter=gcp-in name=peer1 out-filter=gcp-out remote-address=169.254.0.2 remote-as=64513 ttl=default

/routing filter
add action=discard chain=gcp-out prefix=XXX.XXX.XX.64 prefix-length=26
add action=discard chain=gcp-out prefix=169.254.0.0 prefix-length=30
In GCP you have to configure a VPN on the Hybrid connectivity section, refer to attached images.
VPN Tunnel
VPN Gateway
Cloud router and BGP sessión

The information is as follows:
169.254.0.0/30 ips to create the bgp sessión .1 is my router .2 is GCP
10.XX.XX.0/29 is the ip segment I have for my servers in GCP named cloud-servers
XX.XXX.XX.221 GCP public ip address
XXX.XXX.XX.64 is my public ip segment my public ip address is XXX.XXX.XX.118
I have an IPSEC policy to reach 10.XX.XX.0/29 from every segment of my network 0.0.0.0/0
The IPSEC lifetimes are the ones specified in GCP documentation
I'm redistributing the OSPF, static and connected routes to GCP via the BGP
64512 is my ASN and 64513 is GCP ASN

Any doubts just let me know, hope it helps on your configuration.
You do not have the required permissions to view the files attached to this post.
 
User avatar
eset
Frequent Visitor
Frequent Visitor
Posts: 63
Joined: Tue Dec 15, 2015 5:15 pm
Contact:

Re: Google Cloud Platform GCP - VPN - BGP

Mon Dec 02, 2019 12:07 pm

@gargola I have few question.

Do you have any connectivity problems? I wrote to MikroTik support because my tunnel sometimes disconnects and when reconnecting which seems all fine some part of networks defined in policy don't work (Ping doesn't goes through). After disable/enable that policy it starts working again
 
riizzz
just joined
Posts: 2
Joined: Tue May 11, 2010 8:51 am

Re: Google Cloud Platform GCP - VPN - BGP

Tue Dec 03, 2019 10:57 am

@gargola
i tried your configuration. Our vpn tunnel is up but Bgp session status not. Do you have another config in firewall filter, mange of nat as well?
also how we test vpn connection? i tried pinging 169.254.0.1 from mikrotik (169.254.0.2) no luck. I also tried creating gce instance using same network not working as well.
 
gargola
newbie
Topic Author
Posts: 35
Joined: Tue Nov 20, 2012 12:05 am

Re: Google Cloud Platform GCP - VPN - BGP

Tue Dec 03, 2019 7:36 pm

Try adding these exceptions to your NAT:

/ip firewall nat
add action=accept chain=srcnat comment="IPSEC NAT Exception" dst-address=169.254.0.6 src-address=169.254.0.5
add action=accept chain=srcnat comment="IPSEC NAT Exception" dst-address=10.0.X.X/29
@gargola
i tried your configuration. Our vpn tunnel is up but Bgp session status not. Do you have another config in firewall filter, mange of nat as well?
also how we test vpn connection? i tried pinging 169.254.0.1 from mikrotik (169.254.0.2) no luck. I also tried creating gce instance using same network not working as well.
Last edited by gargola on Tue Dec 03, 2019 7:41 pm, edited 3 times in total.
 
gargola
newbie
Topic Author
Posts: 35
Joined: Tue Nov 20, 2012 12:05 am

Re: Google Cloud Platform GCP - VPN - BGP

Tue Dec 03, 2019 7:39 pm

@eset yes, sometimes and randomly the ipsec tunnel is connected but no traffic passing through, so the bgp goes down. I have to reset everything manually and it comes back, I got almost fixed it setting the timers a google request them on their manual, but still having some random issues. The easiest way I've found that fix the tunnel is killing the active peer.
@gargola I have few question.

Do you have any connectivity problems? I wrote to MikroTik support because my tunnel sometimes disconnects and when reconnecting which seems all fine some part of networks defined in policy don't work (Ping doesn't goes through). After disable/enable that policy it starts working again

Who is online

Users browsing this forum: No registered users and 20 guests