SHARIFUL's TECH BLOG

Today we will have a look at how to run dynamic routing protocol over Wireguard. Due to some design choices how Wireguard works, there is no good mechanism of running directly dynamic protocols like OSPF over Wireguard tunnels when more than two (2) sites are involved in the routing domain. Readers are welcome to have  a look at this to know more about about it and the warning -  Warning: The protocol design of WireGuard requires that 'allowed-ips' must not overlap on a single interface. To add another OSPF link to the server, you will need to create wg02 on a different port. Instead we will use our good old friend - GRE to the rescue. We will use the concept of passenger/carrier protocol. Routing or data traffic will be encapsulated in GRE (passenger), then it will be encrypted and carried by Wireguard to the final destination. When we are doing two levels of encapsulation, it was always better to know about the protocol overheads involved, so that we can avoid ...

In previous blog post , we have configured DMVPN phase 1 and eliminated any configuration change required at the Hub site when a new Spoke is added to the network. But there is a limitation. That is even though we have achieved configuration flexibility, our underlying topology is still hub-and-spoke. All spoke-to-spoke communication goes through the hub first. With DMVPN phase 3, we can remove that limitation. We can achieve a fully meshed network by using phase 3 of DMVPN. Before explaining how DMVPN phase 3 works, have a look at our physical and routing topology from phase 1 -  DMVPN Physical Topology DMVPN Routing Topology For example, when Spoke2 tries to communicate with Spoke3 - as usual traffic goes to the Hub1. Hub1 knows the whole network topology. But with phase 3, when Hub1 sees that two spokes are trying to communicate with each other, it will intervene. The Hub1 will signal Spoke2 that there is a better path and that is - Spoke2 can communicat...

We will look at how to configure Cisco DMVPN phase 1. Further more we will run OSPF routing and everything will be encrypted with IPSec. What is DMVPN DMVPN is a combination of protocols (GRE, NHRP, IPSec etc.) which facilitates  to create a HUB-And-Spoke overlay network with minimum configuration effort. Or we can archive a fully meshed network (phase 3) with minimum effort. For theory and get an idea of how everything works, I recommend reading  In-depth look at Fortigate's ADVPN - Part I and  In-depth look at Fortigate's ADVPN - Part II , where the theory behind underlay network is almost same. The difference is Fortinet uses proprietary extension of IPSec protocol and Cisco uses proprietary implementation of GRE and NHRP. One can also do a Google search to get an idea about how DMVPN works. In this blog post, we will configure DMVPN Phase 1 which means that from routing perspective, our network will work as hub-and-spoke topology. All the communication...