2.7 GET VPN [Co-op KS]

- This is a method of configuring redundant Key Servers
- We can configure up to 8 key servers for a particular group, such that if primary key server fails another from the group takes over as primary
- Key Servers use 'announcement messages' to communicate between key servers
- The announcement messages use GDOI protocol
- Co-op provides load sharing for registration (UDP 848)
- Re-key messages will only be sent by primary key server
- The key server with the highest priority assigned will be the primary key server
- If priority matches, then the highest configured ip address will be used

Priority value ranges from 1 to 255
Announcement Messages:

- Updated every 30 seconds
- A triggered update will be sent for every new registration
- If the key server misses 3 consecutive announcement messages, then the election process starts again

Changes in Configuration from regular GET VPN
At KS:

- Make the RSA exportable
- Information about other KS members

At GM:

- Introduce the KS in order
- - Server add ipv4 10.1.1.1
  - Server add ipv4 10.1.1.2

Task: Configure GET VPN using PKI and COOP as shown below:

1. First Configure the IP address of all the devices as shown
2. Create static routes to reach every interface
3. Create static routes in the Central Router to reach the loopbacks
4. Setup KS1 as the NTP server (Please look at the NTP Note for configuration guidelines) and all other devics the NTP clients

Let us configure KS1 as the CA_Server:

- KS1(config)# ip domain-name cisco.com
- KS1(config)# ip http server
- KS1(config)# crypto pki server IOS_KS_CA
- - KS1(cs-server)# database archive pem password 0 cisco123
  - KS1(cs-server)# issuer-name CN=KS1, C=IN
  - KS1(cs-server)# grant auto
  - KS1(cs-server)# lifetime certificate 3
  - KS1(cs-server)# lifetime ca-certificate 3
  - KS1(cs-server)# database url pem flash:

The exchange of sync/election/coop-ks messages are to be protected. And hence we will use the CA server to generate certificates for itself.

- KS1(config)# crypto pki trustpoint IOS_KS_Client
- - KS1(ca-trustpoint)# enrollment url http://40.1.104.100:80
  - KS1(ca-trustpoint)# revocation-check none
- KS1(config)# crypto ca authenticate IOS_KS_Client
- - // Say Yes to the prompt to authenticate the Certificate
- KS1(config)# crypto ca enroll IOS_KS_Client
- - // Follow the prompts, add a password when requested and say YES to receive certificates

At this point you should have the Certificate that will be used by the Key Server to communicate to the secondary KSs.
Now we will generate the Key Exchange Key - used to protect the communication between KS and GM. Since we are using the COOP mode, we need to export this key to the secondary KS, so that they both have the same key!

- KS1(config)# crypto key generate rsa modulous 1024 label GET_KEY exportable // This is the key with label GET_KEY and is the Key Exchange Key
- KS1(config)#crypto key export rsa GET_KEY pem terminal 3des cisco123

% Key name: GET_KEY
Usage: General Purpose Key
Key data:
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzTWgJvfRlsOjMB5kHFucmOy90
EuWspXL5QRD0mYX7uwNTq+x7xUEBXrIEAebXPz+/VZS7m9muKXF+G27Y9NWNFX0d
/oGhnMiP6tCavRrIrWJovKcdOGltDe6tHOiFMbVuswHKlsupm6xnBw5LWrWSVS1r
GderUj+mggfssmoOwQIDAQAB
-----END PUBLIC KEY-----
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,6D2738F162C06C1F
y7+kqSfKM7mjfRM1gCiMTGUiU5XpiPr0yxX3CZ3ThbrIWSQp6I1hAiH3pdkELwNu
bAblfKlhdVEURSJXD7jY85K2bG5UFaMtwilDRZsONFBNwbASjomzfWQH+JQXnRts
FVxlh6r0Kiby3AGijUdZ9QH+tAf4Uc0WBjYOnomUnJuEfX0tH7ORQMCmfDjgyQlb
TTiACjK5fSvuOckrtCkHpAZFlcKRB99EUx3h4UBPPdqz43o6vtQT/xVX/DAqzidO
6ToBNFGICnoi6hD9N4NLNpP9n715k4ATk+4o2n8Ubm1IBGYoIR5aSFWIyuNS0t8C
3ngefKtJ5KYZ6Lx6Qj7wPvEVegmSf8MsBDP9JLEuCqFG1eeesHxdSxKXo4DBOAUU
XHvGi+7RuklXQbn4mw50hGKPhXhiDw0uZlQxr1DmlbuWcDg6FvyYkP1V9isRBrkt
6hSDRisni23+qtQZvSOmxhVRuhdYkkmvUPPhkXm12lXplAkxlT8Ovb+D8a4ETpzk
PklzIuwGu8LwThvOMmvwfNRXMXDg3jzS40oMzTFUPvikUxurm4u4gSwO3N5EY0St
ouEsuM5GZFZ/aZLO0lvAEy+rU+Dfq+DC8ASQTIRxu7vOrg2x7N3rzhCORH17LTe7
ufz+Di4O6JIToVOU4R+vHMuHjsFe7o9oq9lMADAZk30NgoDpW4vhnGexNf3WA9kb
p8wcex3ATUpU8/twDGz/Ruy1OFUBLtwLLCF4JOUmk8RsIZmfPyGd4X/Q1tOqOcAF
/5xkD7SYYdmPsZwl6adQ70qjhNN260hs7IUuM+Mie0dPSrraRKcx5Q==
-----END RSA PRIVATE KEY-----
// Use the Public and Private key listed above while importing this certificate to KS2
Now lets configure the KS2:

- KS2(config)#crypto key import rsa GET_KEY pem exportable terminal cisco123 // Copy paste the public key and private key as marked in bold from KS1

% Enter PEM-formatted public General Purpose key or certificate.
% End with a blank line or "quit" on a line by itself.
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQQWNDb+4h+z0xbxI9m46+7cp2
G8/NkLg3wRqkMACV72gFukgSDjy+dCM5aTbCMhWRFhwx6PST9HZo3RyDVdGLzkxG
WqIxq5GrMTUYFN3zsZ5RSzJa92WHAN5TATx4X9iyIo1rUNQhRFkwRaR/VzUvLcMQ
wl8fDxJowKq9qygozwIDAQAB
-----END PUBLIC KEY-----
% Enter PEM-formatted encrypted private General Purpose key.
% End with "quit" on a line by itself.
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,7C773C37A8D5A428
9igAe3hEvTS2wPP9UiZSD1JOz0qKxcTQnVbZ6IgkXlXJdAPIP1vxRZYmOc+A9OpA
FeFXec4kBLsqCLDsZoQm79wHOtomBKdqtppuWLXVhL3dmp+Svn+KsWRMRrYqiODT
5416lY1H3kamPTZKEk3fUd7MSNrOa1SrVrDP8cVgj/FMzNwcySXwi42LWmg/4IIU
iZAbCIpNw6OtW1Ml6RD+le7yYHtaX1BO0sHHLkbmLoL+gQbhlguNHM9D+uNOn0su
CHxOETQPuGFBtmfA63PHd2Cv9Avp2D4+csOwXC84eMMozKgfRQI9EEtKUHyelMeI
iezKdOs0L9/D2GmzfrSPt6gX6s9ubdGhJv8gUWyTpwbRzHaT1wtcqomAOWeLxrUD
H9JONuKVQuL5pUZXXVl14PxNDsy23GloQ+XDT0PkrYmdST4sEZD009qXyXw0cDzN
hxcTelyeQWVxq4qA9LNEhgesbxyI+QaQJnCawdDm9/q5zEjdqCa9FzaQDpyZYNDL
5AYtxOfmY3q8+LnPqHdhzZd7GHGrdqeegtl8tQFa9b/7GlKTH2UEwAJP8tVjCJ7T
NWiTjqx28A+ISJ9HBnW3IncLb+az7KWCHy7NGgoPuRSE7EFZ9rprauhxPI3ZQX9L
Mw27fmCiDTvt3Y4zfovaKgGWolWloPX7gBqUenIUx8Gs5HRz4X2XZaS8lTpkYUnq
gufxEfGMNHsXGvjnIYxtx0KOAAai9KOXDg/LfWu6mQv8VwQOv0wywyTyAtbdQJ+4
khWuyTYzJpHrsJmJFINY8Y+mLViYfXwjsacOx4dgehAv7++TgQmx+A==
-----END RSA PRIVATE KEY-----

- quit // This word required in a new line to end the import process

% Key pair import succeeded.
At this point we have the KEK, used to communicate between KS and GM! Now let us configure a trustpoint to enroll to the CA Server. This certificate will be used for sync communication between redundant KSes and also for initial registration with the GMs!

- KS2(config)# crypto pki trustpoint IOS_KS_Client
- - KS2(ca-trustpoint)# enrollment url http://40.1.104.100:80
  - KS2(ca-trustpoint)# revocation-check none
- KS2(config)# crypto ca authenticate IOS_KS_Client
- - // Say Yes to the prompt to authenticate the Certificate
- KS2(config)# crypto ca enroll IOS_KS_Client
- - // Follow the prompts, add a password when requested and say YES to receive certificates

At this point we have all the certificates!
GDOI and ISAKMP configurations on KS1 and KS2:
Please Note: 'KSx' mean it applies to both KS1 and KS2
Now let us start configuration for Phase 1 - ISAKMP Policy

- KSx (config)# crypto isakmp policy 10
- - KSx (isakmp-policy)# authentication rsa-sig

Now let us configure the Phase 2 - IPSec Transformset and Profile

- KSx (config)# crypto ipsec transform-set TSET esp-3des esp-sha-hmac
- KSx (config)# crypto ipsec profile GET_PRO
- - KSx (ipsec-profile)# set transform-set TSET

Now it is time to configure the GDOI Group

- KSx (config)# crypto gdoi group GET_VPN
- - KSx (config-gdoi-group)# identity number 123
  - KSx (config-gdoi-group)# server local // At this point the GDOI will get enabled
  - - KSx (gdoi-local-server)# rekey authentication mypubkey rsa GET_KEY // Key Encryption Key
    - KSx (gdoi-local-server)# rekey retransmit 10 number 2
    - KSx (gdoi-local-server)# rekey transport unicast
    - KSx (gdoi-local-server)# authorization address ipv4 GM-LIST // A standard ACL with a list of Group Member's IP Address
    - ! Just put one of the following depending on the Key Server
    - KS1 (gdoi-local-server)# address ipv4 40.1.104.100 // KS1 IP Address
    - - OR
    - KS2 (gdoi-local-server)# address ipv4 50.1.105.100 // KS2 IP Address
    - ! Just put one of the above depending on the Key Server
    - KSx (gdoi-local-server)# sa ipsec 1
    - - KSx (gdoi-sa-ipsec)# profile GET_PRO
      - KSx (gdoi-sa-ipsec)# match address ipv4 LAN_LIST // The extended ACL controlling traffic (to be encrypted or not)
      - KSx (gdoi-sa-ipsec)# replay counter window-size 64
- KSx (config)# ip access-list standard GM_LIST
- - KSx (config-std-nacl)# permit 10.1.101.1
  - KSx (config-std-nacl)# permit 20.1.102.2
  - KSx (config-std-nacl)# permit 30.1.103.3
- KSx (config)# ip access-list extended LAN_LIST
- - KSx (config-ext-nacl)# deny udp any eq 848 any eq 848 // Telling the GM's not to encrypt traffic between GM and KS
  - KSx (config-ext-nacl)# permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255 // The interesting traffic between loopbacks of GMs

Now let us configure the Redundancy feature for COOP KS

- KSx (config)# crypto gdoi group GET_VPN
- - KSx (config-gdoi-group)# server local
  - - KSx (gdoi-local-server)# redundancy
    - - ! Just put one of the following depending on the Key Server
      - KS1(gdoi-coop-ks-config)# local priority 100 // Higher priority
      - KS1(gdoi-coop-ks-config)# peer address ipv4 50.1.105.100
      - - OR
      - KS2(gdoi-coop-ks-config)# local priority 50 // Lower priority
      - KS2(gdoi-coop-ks-config)# peer address ipv4 40.1.104.100
      - ! Just put one of the above depending on the Key Server

PLEASE NOTE: As soon as you configure the redundancy on the first KS, it will give you an error message:

- %GDOI-4-COOP_KS_UNAUTH: Contact from unauthorized KS 40.1.104.4 in group GET_VPN at local address 50.1.105.5 (Possible MISCONFIG of peer/local adddress)

This is because the COOP configuration for KS2 has not been done. As soon as you finish the COOP config on KS2, the error message will go away! If everything goes right, you should see a message like this:

- %GDOI-5-COOP_KS_TRANS_TO_PRI: KS 40.1.104.100 in group GET_COOP_VPN transitioned to Primary (Previous Primary = none)

Now let us configure the Group Member
Please Note: The beauty of GET VPN is that the configuration on all the GMs are identical! In the following commands 'GMx' denotes GM1, GM2 and GM3.

- GMx(config)# crypto pki trustpoint IOS_GM_Client
- - GMx (ca-trustpoint)# enrollment url http://40.1.104.100:80
  - GMx (ca-trustpoint)# revocation-check none
- GMx (config)# crypto ca authenticate IOS_KS_Client
- - // Say Yes to the prompt to authenticate the Certificate
- GMx (config)# crypto ca enroll IOS_KS_Client
- - // Follow the prompts, add a password when requested and say YES to receive certificates

- GMx(config)# crypto isakmp policy 10
- - GMx (isakmp-policy)# authentication rsa-sig
- GMx (config)# crypto gdoi group GET_VPN
- - GMx (config-gdoi-group)# identity number 123
  - GMx (config-gdoi-group)# server address ipv4 40.1.104.4 // Put the primary KS address first
  - GMx (config-gdoi-group)# server address ipv4 50.1.105.5
- GMx (config)# crypto map CMAP 10 gdoi
- - GMx (config-crypto-map)# set group GET_VPN
- GMx (config)# interface f0/0
- - GMx (config-if)# crypto map CMAP // As soon as you apply the map to the interface, GDOI negotiation will happen with the KS as shown in syslog as shown below

> Mar 1 01:46:56.732: %CRYPTO-5-GM_REGSTER: Start registration to KS 40.1.104.100 for group GET_COOP_VPN using address 10.1.101.1
> GM1(config-if)#
> Mar 1 01:46:56.768: %CRYPTO-6-GDOI_ON_OFF: GDOI is ON
> GM1(config-if)#
> Mar 1 01:46:58.040: %GDOI-5-GM_REKEY_TRANS_2_UNI: Group GET_COOP_VPN transitioned to Unicast Rekey.
> Mar 1 01:46:58.628: %GDOI-5-GM_REGS_COMPL: Registration to KS 40.1.104.100 complete for group GET_COOP_VPN using address 10.1.101.1