Advanced LSVPN Configuration with iBGP
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
-
- Cloud Management of NGFWs
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
- PAN-OS 9.1 (EoL)
-
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
-
-
-
- Cloud Management and AIOps for NGFW
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1
- PAN-OS 11.2
- PAN-OS 8.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 9.1 (EoL)
Advanced LSVPN Configuration with iBGP
This use case illustrates how GlobalProtect
LSVPN securely connects distributed office locations with primary
and disaster recovery data centers that house critical applications
for users and how internal border gateway protocol (iBGP) eases
deployment and upkeep. Using this method, you can extend up to 500
satellite offices connecting to a single gateway.
BGP is a
highly scalable, dynamic routing protocol that is ideal for hub-and-spoke
deployments such as LSVPN. As a dynamic routing protocol, it eliminates
much of the overhead associated with access routes (static routes)
by making it relatively easy to deploy additional satellite firewalls.
Due to its route filtering capabilities and features such as multiple
tunable timers, route dampening, and route refresh, BGP scales to
a much higher number of routing prefixes with greater stability
than other routing protocols like RIP and OSPF. In the case of iBGP,
a peer group, which includes all the satellites and gateways in
the LSVPN deployment, establishes adjacencies over the tunnel endpoints.
The protocol then implicitly takes control of route advertisements,
updates, and convergence.
In this example configuration, an
active/passive HA pair of PA-5200 firewalls is deployed in the primary
(active) data center and acts as the portal and primary gateway.
The disaster recovery data center also has two PA-5200s in an active/passive
HA pair acting as the backup LSVPN gateway. The portal and gateways
serve 500 PA-220s deployed as LSVPN satellites in branch offices.
Both
data center sites advertise routes but with different metrics. As
a result, the satellites prefer and install the active data center’s
routes. However, the backup routes also exist in the local routing
information base (RIB). If the active data center fails, the routes
advertised by that data center are removed and replaced with routes
from the disaster recovery data center’s routes. The failover time
depends on selection of iBGP times and routing convergence associated
with iBGP.
![](/content/dam/techdocs/en_US/dita/_graphics/10-2/vpn/lsvpn-ibgp.png)
The
following workflow shows the steps for configuring this deployment:
- Portal and Primary gateway:
- Zone: LSVPN-Untrust-Primary
- Interface: ethernet1/21
- IPv4: 172.16.22.1/24
- Zone: L3-Trust
- Interface: ethernet1/23
- IPv4: 200.99.0.1/16
Backup gateway:- Zone: LSVPN-Untrust-Primary
- Interface: ethernet1/5
- IPv4: 172.16.22.25/24
- Zone: L3-Trust
- Interface: ethernet1/6
- IPv4: 200.99.0.1/16
Satellite:- Zone: LSVPN-Sat-Untrust
- Interface: ethernet1/1
- IPv4: 172.16.13.1/22
- Zone: L3-Trust
- Interface: ethernet1/2.1
- IPv4: 200.101.1.1/24
Configure the zones, interfaces, and IP addresses on each satellite. The interface and local IP address will be different for each satellite. This interface is used for the VPN connection to the portal and gateway. - Primary gateway:
- Interface: tunnel.5
- IPv4: 10.11.15.254/22
- Zone: LSVPN-Tunnel-Primary
Backup gateway:- Interface: tunnel.1
- IPv4: 10.11.15.245/22
- Zone: LSVPN-Tunnel-Backup
- The gateway uses the self-signed root certificate authority (CA) to issue certificates for the satellites in a GlobalProtect LSVPN. Because one firewall houses the portal and primary gateway, a single certificate is used for authenticating to the satellites. The same CA is used to generate a certificate for the backup gateway. The CA generates certificates that pushed to the satellites from the portal and then used by the satellites to authenticate to the gateways.You must also generate a certificate from the same CA for the backup gateway, allowing it to authenticate with the satellites.
- On the firewall hosting the GlobalProtect portal, create the root CA certificate for signing the certificates of the GlobalProtect components. In this example, the root CA certificate is called CA-cert.
- Create SSL/TLS service profiles for the GlobalProtect portal and gateways. Because the GlobalProtect portal and primary gateway are the same firewall interface, you can use the same server certificate for both components.
- Root CA Certificate: CA-Cert
- Certificate Name: LSVPN-Scale
- Repeat steps 2 through 5 on the backup gateway with the following settings:
- Root CA Certificate: CA-cert
- Certificate Name: LSVPN-back-GW-cert
- Selectand clickNetworkGlobalProtectGatewaysAdd.
- On theGeneraltab, name the primary gatewayLSVPN-Scale.
- UnderNetwork Settings, selectethernet1/21as the primary gateway interface and enter172.16.22.1/24as the IP address.
- On theAuthenticationtab, select the LSVPN-Scale certificate created in 3.
- Selectand selectSatelliteTunnel SettingsTunnel Configuration. Set theTunnel Interfaceto tunnel.5. All satellites in this use case connect to a single gateway, so a single satellite configuration is needed. Satellites are matched based on their serial numbers, so no satellites will need to authenticate as a user.
- On, define the pool of IP address to assign to the tunnel interface on the satellite once the VPN connection is established. Because this use case uses dynamic routing, the Access Routes setting remains blank.SatelliteNetwork Settings
- Repeat steps 1 through 5 on the backup gateway with the following settings:
- Name: LSVPN-backup
- Gateway interface: ethernet1/5
- Gateway IP: 172.16.22.25/24
- Server cert: LSVPN-backup-GW-cert
- Tunnel interface: tunnel.1
- Configure iBGP on the primary and backup gateways and add a redistribution profile to allow the satellites to inject local routes back to the gateways.Each satellite office manages its own network and firewall, so the redistribution profile called ToAllSat is configured to redistribute local routes back to the GlobalProtect gateway.
- SelectandNetworkVirtual RoutersAdda virtual router.
- OnRouter Settings, add theNameandInterfacefor the virtual router.
- OnRedistribution Profileand selectAdd.
- Name the redistribution profileToAllSatand set thePriorityto 1.
- Set Redistribute toRedist.
- Addethernet1/23from the Interface drop-down.
- ClickOK.
- SelectBGPon the Virtual Router to configure BGP.
- On, selectBGPGeneralEnable.
- Enter the gateway IP address as theRouter ID(172.16.22.1) and1000as theAS Number.
- In the Options section, selectInstall Route.
- On, clickBGPPeer GroupAdda peer group with all the satellites that will connect to the gateway.
- On,BGPRedist RulesAddtheToAllSatredistribution profile you created previously.
- ClickOK.
- Repeat steps 1 through 5 on the backup gateway usingethernet1/6for the redistribution profile.
- The configuration shown is a sample of a single satellite.Repeat this configuration each time you add a new satellite to the LSVPN deployment.
- Configure a tunnel interface as the tunnel endpoint for the VPN connection to the gateways.
- Set the IPSec tunnel type to GlobalProtect Satellite and enter the IP address of the GlobalProtect Portal.
- SelectandNetworkVirtual RoutersAdda virtual router.
- OnRouter Settings, add theNameandInterfacefor the virtual router.
- SelectandVirtual RouterRedistribution ProfileAdda profile with the following settings.
- Name the redistribution profileToLSVPNGWand set thePriorityto 1.
- AddanInterfaceethernet1/2.1.
- ClickOK.
- Select,BGPGeneralEnableBGP and configure the protocol as follows:
- Enter the gateway IP address as theRouter ID(172.16.22.1) and1000as theAS Number.
- In the Options section, selectInstall Route.
- On,BGPPeer GroupAdda peer group containing all the satellites that will connect to the gateway.
- On,BGPRedist RulesAddtheToLSVPNGWredistribution profile you created previously.
- ClickOK.
- Both data centers advertise their routes but with different routing priorities to ensure that the active data center is the preferred gateway.
- Selectand clickNetworkGlobalProtectPortalsAdd.
- OnGeneral, enterLSVPN-Portalas the portal name.
- OnNetwork Settings, selectethernet1/21as theInterfaceand select172.16.22.1/24as theIP Address.
- On theAuthenticationtab, select the previously created primary gateway SSL/TLS ProfileLSVPN-Scalefrom theSSL/TLS Service Profiledrop-down menu.
- On theSatellitetab,Adda satellite andNameitsat-config-1.
- Set theConfiguration Refresh Intervalto12.
- On, add the serial number and hostname of each satellite device in the LSVPN.GlobalProtect SatelliteDevices
- On, add the name and IP address of each gateway. Set the routing priority of the primary gateway to 1 and the backup gateway to 10 to ensure that the active data center is the preferred gateway.GlobalProtect SatelliteGateways
- (Optional) Add a new site to the LSVPN deployment.
- Selectto add the serial number of the new satellite to the GlobalProtect portal.NetworkGlobalProtectPortalsGlobalProtect PortalSatellite ConfigurationGlobalProtect SatelliteDevices
- Configure the IPSec tunnel on the satellite with the GlobalProtect Portal IP address.
- Selectto add the satellite to the BGP Peer Group configuration on each gateway.NetworkVirtual RouterBGPPeer Group
- Selectto add the gateways to the BGP Peer Group configuration on the new satellite.NetworkVirtual RouterBGPPeer Group