[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 506
  • Last Modified:

rri question as a follow up on Q_26409434

from http://www.experts-exchange.com/Security/Software_Firewalls/Enterprise_Firewalls/Cisco_PIX_Firewall/Q_26409434.html?cid=1332#a33465386

how does RRI work with dynamic clients like easyvpn with the routing tables on both the local and remote endpoints?

does the hub wait for the connection before adding the route to its table or does only the client wait to populate the routing table?

thanks in advance!

-t
0
decoleur
Asked:
decoleur
  • 3
1 Solution
 
Jimmy Larsson, CISSP, CEHNetwork and Security consultantCommented:
I am actually not sure about if RRI is needed at hub-end when running ezvpn in NEM. When you use client-mode it is exactly the same as a software vpn-client but with NEM there is actually a remote network that should be routable.

But this question is very academic. All implementations of ezvpn that I have ever seen has been over internet. That means that the ASA has a default route pointing towards internet and all internal routers has a default route to the ASA. In these cases you dont have to care about RRI.

But I will try this out within a few days. Please hold this question open and I will get back to you with more information. I will set it up in my lab environment.

/Kvistofta
0
 
Jimmy Larsson, CISSP, CEHNetwork and Security consultantCommented:
Hi again

I had a look at it. When using easyvpn, the different from "static vpn" is that you use a dynamic crypto-map. In there you can set reverse-route just like you do in a static crypto map entry. What happens in a dynamic-map with reverse-route is that the remote endpoint is inserted in the routing-table at the headend upon connection just as you mentioned. If you run client mode each client ip address is added with a /32 netmask (which could quite easily build a big routing table!) and in NEM the remote network is added when connected. For NEM it is the only option since the ip addressing of the remote network is not pre-configured in the hub firewall. It simply doesnt know in advance which remote network will connect in the future. When the session is torn down the route is removed from the routing table.

But again. This is quite rare circumstances. You almost ALWAYS have a default route pointing out to the internet. Only reason I can see is that you have a supernet-route of rfc1918-addresses pointing inwards (like 10.0.0.0/8) and the vpn remote network (or client pool) is a subset of this. Then you need RRI.

Does this answer your questions?

/Kvistofta
0
 
decoleurAuthor Commented:
This is what I thought, thanks for looking at it.
0
 
Jimmy Larsson, CISSP, CEHNetwork and Security consultantCommented:
You are welcome. :-)

/Kvistofta
0

Featured Post

KuppingerCole Reviews AlgoSec in Executive Report

Leading analyst firm, KuppingerCole reviews AlgoSec's Security Policy Management Solution, and the security challenges faced by companies today in their Executive View report.

  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now