VTI の中身
Upcoming SlideShare
Loading in...5
×
 

Like this? Share it with your network

Share

VTI の中身

on

  • 3,753 views

VYATTA USERS MEETING Spring 2013 の資料です。

VYATTA USERS MEETING Spring 2013 の資料です。

Statistics

Views

Total Views
3,753
Views on SlideShare
3,679
Embed Views
74

Actions

Likes
3
Downloads
16
Comments
0

1 Embed 74

https://twitter.com 74

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

VTI の中身 Presentation Transcript

  • 1. VTI の中身浅間 正和 @ 有限会社 銀座堂
  • 2. VTI とは?• Virtual Tunnel Interface の略で Vyatta ( Network OS | Core ) 6.5R1 から実装された中身が暗号化 される IP-IP tunnel のようなモノ
  • 3. Benefits• They are capable of having traffic routed to them • They are capable of passing routing protocols over  them • They do not require local or remote subnets to be  specified • They operate as if the peer interfaces are directly  connected (Vyatta VPN Reference Guide 6.5R1 v01 より引用)
  • 4. Vyatta configuration の違い interfaces { vti vti0 { } }vpn { protocols { ipsec { static site-to-site { interface-route 192.168.2.0/24 { peer 172.16.1.2 { next-hop-interface vti0 { default-esp-group ESP-G } ike-group IKE-G } local-address 172.16.1.1 } tunnel 1 { } local { vpn { prefix 192.168.1.0/24 ipsec { } site-to-site { remote { peer 172.16.1.2 { prefix 192.168.2.0/24 ike-group IKE-G } local-address 172.16.1.1 } vti { } bind vti0 } esp-group ESP-G } }} } } } } 従来 VTI
  • 5. /etc/ipsec.conf の違い conn peer-172.16.1.2-tunnel-vticonn peer-172.16.1.2-tunnel-1 left=172.16.1.1 left=172.16.1.1 right=172.16.1.2 right=172.16.1.2 leftsubnet=0.0.0.0/0 leftsubnet=192.168.1.0/24 rightsubnet=0.0.0.0/0 rightsubnet=192.168.2.0/24 ike=aes256-sha1! leftsourceip=192.168.1.1 ikelifetime=28800s ike=aes256-sha1! esp=aes256-sha1! ikelifetime=28800s keylife=3600s esp=aes256-sha1! rekeymargin=540s keylife=3600s type=tunnel rekeymargin=540s pfs=yes type=tunnel compress=no pfs=yes authby=secret compress=no mark=2415919105 authby=secret leftupdown="/usr/lib/ipsec/vti- auto=start up-down.sh vti0" keyingtries=%forever auto=start keyingtries=%forever 従来 VTI
  • 6. ip xfrm policy list 実行結果の違い src 0.0.0.0/0 dst 0.0.0.0/0 dir out priority 2051src 192.168.1.0/24 dst 192.168.2.0/24 mark -1879048191/0xffffffff dir out priority 1859 tmpl src 172.16.1.1 dst 172.16.1.2 tmpl src 172.16.1.1 dst 172.16.1.2 proto esp reqid 16384 mode tunnel proto esp reqid 16384 mode tunnel src 0.0.0.0/0 dst 0.0.0.0/0src 192.168.2.0/24 dst 192.168.1.0/24 dir fwd priority 2051 dir fwd priority 1859 mark -1879048191/0xffffffff tmpl src 172.16.1.2 dst 172.16.1.1 tmpl src 172.16.1.2 dst 172.16.1.1 proto esp reqid 16384 mode tunnel proto esp reqid 16384 mode tunnelsrc 192.168.2.0/24 dst 192.168.1.0/24 src 0.0.0.0/0 dst 0.0.0.0/0 dir in priority 1859 dir in priority 2051 tmpl src 172.16.1.2 dst 172.16.1.1 mark -1879048191/0xffffffff proto esp reqid 16384 mode tunnel tmpl src 172.16.1.2 dst 172.16.1.1 proto esp reqid 16384 mode tunnel 従来 VTI
  • 7. 設定時の流れ• /opt/vyatta/sbin/vpn-config.pl が実行される • /etc/ipsec.conf の生成と ipsec start の実行• /opt/vyatta/sbin/vyatta-vti-config.pl が実行される • sudo /opt/vyatta/sbin/cfgvti add name $tunName   key $mark remote $remote local $local の実行 • sudo iptables -t mangle -D PREROUTING -s   $remote -d $local ( -p esp | -p udp --dport 4500 )  -j MARK --set-mark $mark の実行
  • 8. /opt/vyatta/sbin/cfgvti• git repo の build-iso/pkgs/vyatta-cfg-vpn/src/cfgvti.c • … C で書かれたプログラム…なぜ…?• なななんと実は VTI は net/ipv4/ipip.ko ではなく net/ipv4/ip_vti.ko だった…。 commit 1181412c1a671ed4e8fb1736f17e6ec617c68059 Author: Saurabh <saurabh.mohan@vyatta.com> Date: Tue Jul 17 09:44:54 2012 +0000 net/ipv4: VTI support new module for ip_vti. New VTI tunnel kernel module, Kconfig and Makefile changes. Signed-off-by: Saurabh Mohan <saurabh.mohan@vyatta.com> Reviewed-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: David S. Miller <davem@davemloft.net>
  • 9. net/ipv4/ip_vti.ko• Linux kernel の main line には v3.6 から merge• (Vyatta 6.5R1 は v3.3 なので backport?)• net/ipv4/ipip.ko を元にしているが xfrm の esp が処理してくれる encap/decap は省かれている• 一番重要な違いは xmit 時に mark を付けるこ とで xfrm policy に引っ掛けるようにしている こと
  • 10. 送受信時の流れ• 送信時の流れ • net/ipv4/ip_vti.ko の vti_tunnel_xmit が呼ば れる • VTI を一意に表す mark を付け xfrm に流す • xfrm が encap し暗号化• 受信時の流れ • Netfilter が mask を付ける • mark から xfrm policy が判明し復号化と decap 処理
  • 11. まとめ• Dynamic routing や QoS と組み合わせて使え るのはかなり便利?• もとは Cisco さんが最初にやった方式? Vyatta VPN Reference にも compatible with 3rd party VTI/route-based VPN connections と書か れているので相互接続性もバッチリ?• ちなみに … and is sometimes required for connectivity with pubic cloud offerings だそう です…