Skip to main content

FlexVPN

Basic Information

Internet Key Exchange Version 2 (IKEv2), a next-generation key management protocol based on RFC 4306, is an enhancement of the IKE Protocol. IKEv2 is used for performing mutual authentication and establishing and maintaining security associations (SAs).

FlexVPN is Cisco's implementation of the IKEv2 standard featuring a unified paradigm and CLI that combines site to site, remote access, hub and spoke topologies and partial meshes (spoke to spoke direct). FlexVPN offers a simple but modular framework that extensively uses the tunnel interface paradigm while remaining compatible with legacy VPN implementations using crypto maps.

Large customers deploying IPSec VPN over IP networks face high complexity and cost when deploying multiple types of VPN to meet various connectivity requirements. Customers often must learn different VPN types to manage and operate their networks. Once a technology is selected, migrating or adding functionality is frequently avoided. FlexVPN was created to simplify VPN deployment, address the complexity of multiple solutions, and provide a unified ecosystem covering all types of VPNā€”remote access, teleworker, site to site, mobility, managed security services, and others. See the figure below.

Typical Cisco IOS FlexVPN Deployment
Typical Cisco IOS FlexVPN Deployment

As customer networks span private, public, and cloud systems, unifying VPN technology becomes essential. Cisco IOSĀ® FlexVPN enables organizations to dramatically increase network reach without significantly expanding infrastructure complexity. It is a robust, standards-based encryption technology that securely connects branch offices and remote users while providing significant cost savings compared to supporting multiple separate VPN solutions such as GRE, Crypto, and VTI-based implementations. FlexVPN relies on open-standards-based IKEv2 and adds many CiscoĀ®-specific enhancements for high security, added value, and competitive differentiation.

Configuration Example

For example, two Advantech routers were used as spokes (Router A and Router B) and one Cisco ISR4331 router as the headquarter hub.

Configuration example scheme
Configuration example scheme

Necessary Requirements

  • Cisco headquarter hub router and connection to the Internet from the hub and all spokes. Only a Cisco router can be used as the headquarter hub router.
  • FRR router app in every spoke router.

See the example configuration below for more details.

Caution

The described router app FRR is not included in the standard router firmware. See the Configuration Manual for the description of uploading the router apps to the router.

Headquarter Hub Router Configuration

In this example configuration, the Cisco ISR4331 router was used as the headquarter hub router. The necessary configuration is provided below. (Log in to the Cisco router console and type the config terminal command. Refer to the appropriate Cisco manual for instructions on configuring the router.) More about IPsec Tunnel and certificate generation can be found in IPsec Tunnel Application Note.

IPsec Configuration

Open the web interface of the first spoke (Router A) and press the IPsec item in the Configuration section, then select 1st Tunnel. Fill in the configuration form as indicated in the figure and table below.

IPsec Router A configuration Part 1
IPsec Router A configuration Part 1
IPsec Router A configuration Part 2
IPsec Router A configuration Part 2
IPsec Router A configuration Part 3
IPsec Router A configuration Part 3

Save the changes using the Apply button. Use the same procedure for all spokes ā€” for Router B the configuration looks like this:

IPsec Router B configuration Part 1
IPsec Router B configuration Part 1
IPsec Router B configuration Part 2
IPsec Router B configuration Part 2
IPsec Router B configuration Part 3
IPsec Router B configuration Part 3

The IPsec status of the first router looks like this:

IPsec status of router 1 part 1
IPsec status of router 1 part 1
IPsec status of router 1 part 2
IPsec status of router 1 part 2

For the second router:

IPsec status of router 2 part 1
IPsec status of router 2 part 1
IPsec status of router 2 part 2
IPsec status of router 2 part 2

Zebra Configuration ā€” FRR Router App

Zebra configuration can be done via the FRR router app.

Caution

The router app FRR is not part of the standard router firmware. See the Configuration Manual of your router for the description of uploading the router app to the router.

Go to the Router Apps page and then find the FRR item in the Configuration section to configure the ZEBRA protocol of this router. In the ZEBRA section, tick the Enable ZEBRA box and insert the configuration commands in the field.

Zebra configuration Router A
Zebra configuration Router A

For Router B, the ZEBRA configuration is:

Zebra configuration Router B
Zebra configuration Router B

Static Configuration ā€” FRR Router App

As in the Zebra section above, the Static configuration can be done via the FRR router app.

Go to the Router Apps page and then find the FRR item in the Configuration section to configure the STATIC protocol of this router. In the STATIC section, tick the Enable STATIC box and insert the configuration commands in the field.

Static configuration Router A
Static configuration Router A

For Router B, the Static configuration is:

Static configuration Router B
Static configuration Router B

BGP Configuration ā€” FRR Router App

As with the Static and Zebra sections above, the BGP configuration can be done via the FRR router app.

Go to the Router Apps page and then find the FRR item in the Configuration section to configure the BGP protocol of this router. In the BGP section, tick the Enable BGP box and insert the configuration commands in the field.

Configuration for Router A should look like this:

BGP configuration Router A
BGP configuration Router A

For Router B, the BGP configuration looks like this:

BGP configuration Router B
BGP configuration Router B

Check the Function of FlexVPN

If configured correctly, you can see changes in the Route Tables of the routers. Here is the Route Table of Router B ā€” on the Network page in the Status section of the router.

Router B ā€” Route Table
Router B ā€” Route Table

If you log in to the Cisco headquarter hub router and run the show crypto ikev2 sa detailed command, you can see the IKEv2 security associations with proper tunnel addresses and other information:

The FRR status of the first router looks like this:

FRR status of router 1 part 1
FRR status of router 1 part 1
FRR status of router 1 part 2
FRR status of router 1 part 2

For the second router:

FRR status of router 2 part 1
FRR status of router 2 part 1
FRR status of router 2 part 2
FRR status of router 2 part 2