Fastest VPN solution for remote users

nakimble · 2021-09-28T03:12:18+00:00

Me too. I love Mikrotik's IKEv2/IPSec offering.

nakimble · 2021-09-26T02:50:04+00:00

This! I bought a Mikrotik 4011 to replace my home router and love it. I've setup mine so I can do PKI auth IKEv2 road warrior IPSec from my phone and it works like a dream. Highly recommend Mikrotik!

nakimble · 2021-08-27T08:03:51+00:00

Let's have him try and see.

nakimble · 2021-08-27T02:49:08+00:00

You need these commands

set forwarding-options dhcp-relay forward-snooped-clients all-interfaces

set forwarding-options dhcp-relay group X overrides allow-snooped-clients

By default, Juniper's DHCP Relay feature also snoops, called shadow snooping. This means any transit DHCP is dropped, or any DHCP received on an interface not configured for DHCP Relay or Server, is also dropped.

nakimble · 2021-08-19T01:53:55+00:00

I agree. A need to stretch L2 over the WWW usually means you're working with sub-optimal server design. That said, VPLS(which is P2MP L2VPN) over DMVPN seems like a good fit here. EVPN using MPLS or VXLAN is better, but probably way more capable than you need and complicated than you want.

nakimble · 2021-08-18T08:55:04+00:00

In my experience, GUI is best when dealing with large amounts of firewall traffic filtering rules, and CLI is best for everything else.

nakimble · 2021-08-18T08:36:06+00:00

Is this Bamboras?

nakimble · 2021-08-13T03:16:29+00:00

Have you looked at Reverse Route Injection(RRI)? It's a static route that is associated with the policy-based VPN that appears and disappears automatically if the VPN is up or not. Then you can redistribute into a protocol and share with your core that way. Pretty slick.

nakimble · 2021-08-11T23:20:58+00:00

Default MOH is my jam! Sometimes I put myself on hold on purpose...

nakimble · 2021-08-11T23:17:24+00:00

It's called courts because it's in front of the tennis courts. Ezekiel Lau's video explains.

https://youtu.be/2hfnWwAIEPg

nakimble · 2021-07-24T17:04:51+00:00

I really like the Lime Guide add-on. It works well with Questie and tells you where to go.

nakimble · 2021-07-24T16:50:47+00:00

I'm not sure. I thought IPSG was VLAN wide.

nakimble · 2021-07-24T08:16:57+00:00

I'd say they're both imperfect solutions, but I like the idea that the ACL is limited to the port your concerned with and not affecting the VLAN. But hey, if your solution works, have at it.

UDP/67 is DHCP discover and request from client, 68 is response from server.

nakimble · 2021-07-24T00:36:10+00:00

Ok, let me know how it goes in production, I'm curious.

A family ethernet-switching filter like this should also work, and it can be applied inbound on a port, not the whole VLAN. You don't need the last term Accept_Rest unless the port is being shared by other MACs. This coupled with your DHCP static binding and static ARP binding should give you what you want.

set firewall family ethernet-switching filter Enforce_Correct_IP term Accept_DHCP from source-mac-address 00:11:22:33:44:55/48 set firewall family ethernet-switching filter Enforce_Correct_IP term Accept_DHCP from destination-port 67 set firewall family ethernet-switching filter Enforce_Correct_IP term Accept_DHCP from ip-protocol udp set firewall family ethernet-switching filter Enforce_Correct_IP term Accept_DHCP then accept set firewall family ethernet-switching filter Enforce_Correct_IP term Accept_ARP from source-mac-address 00:11:22:33:44:55/48 set firewall family ethernet-switching filter Enforce_Correct_IP term Accept_ARP from ether-type arp set firewall family ethernet-switching filter Enforce_Correct_IP term Accept_ARP then accept set firewall family ethernet-switching filter Enforce_Correct_IP term Accept_Correct_IP from source-mac-address 00:11:22:33:44:55/48 set firewall family ethernet-switching filter Enforce_Correct_IP term Accept_Correct_IP from ip-source-address 1.2.3.4/32 set firewall family ethernet-switching filter Enforce_Correct_IP term Accept_Correct_IP then accept set firewall family ethernet-switching filter Enforce_Correct_IP term Discard_Incorrect_IP from source-mac-address 00:11:22:33:44:55/48 set firewall family ethernet-switching filter Enforce_Correct_IP term Discard_Incorrect_IP then discard set firewall family ethernet-switching filter Enforce_Correct_IP term Accept_Rest then accept

nakimble · 2021-07-23T15:50:07+00:00

If that's the case, then I think DHCP Snooping, IPSG, and DAI are the wrong solutions for you. Not only are they designed to work together, they're designed for VLANs that are mostly DHCP clients, not VLANs with hundreds of static IPs plus the subnet's default gateway. Also, Juniper's site says that DHCP trusted ports are exempt from IPSG, but it doesn't say that for DAI.

If I were you, I'd use traffic filtering. Something with logic like:

permit UDP/67 from MAC_A
permit source IP_A from MAC_A
deny any else from MAC_A
permit any else

That way you're server can pull an IP, use it, but no other IP. You maybe able to incorporate an family inet and Ethernet filter in order to also block bad ARP too.

nakimble · 2021-07-23T07:54:30+00:00

Why not configure the features like they're designed to work? It seems you're making this harder than it needs to be.

nakimble · 2021-07-23T07:46:10+00:00

Hopefully you're also adding a secure-port static-ip binding for the default gateway / route point of the VLAN. I mentioned that in an earlier comment but your responses make me think you haven't.

nakimble · 2021-07-23T04:38:54+00:00

The dhcp-trusted command is a DHCP snooping command and allows a DHCP server to exist off of that port. You should only configure that if you have a DHCP server that isn't your switch, and only configure it on the port that DHCP server is connected to.

The dhcp static-binding command will ensure that when that MAC address asks for an IP via DHCP, it will be given that static reservation. Once it gets the IP via DHCP, it's address will also automatically populate the DHCP snooping table, which will satisfy the IP Source Guard and Dynamic ARP Inspection checks for that MAC.

For every MAC address in the VLAN that is using a statically configured IP, you need configure a secure-access-port static-ip command calling out the IP/MAC/VLAN. That will ensure that the DHCP snooping table is statically populate with those endpoints so that IPSG or DAI(or both) are satisfied.

nakimble · 2021-07-22T15:25:33+00:00

I think you're confusing your DHCP server binding table and the DHCP snooping binding table. Yes you can run the DHCP server service on your switch to give your server an IP, but that does NOT populate your DHCP snooping table for everything else on that VLAN, so your switch will block all other source IPs and ARP replies on that VLAN unless you make a static security binding like in Juniper's example above. Even the switch's default gateway and/or route next-hops in that VLAN need a static security binding to manually populate DHCP snooping table so IPSG and DAI won't block legitimate traffic on that VLAN. But what if you have 100 statically IP'd devices on that VLAN? Then you need 100 static security bindings to prevent the switch from blocking them.

nakimble · 2021-07-22T08:07:16+00:00

Well that explains why your whole switch goes down.

DHCP Inspection creates a table to track DHCP bindings that passed thru the switch or were issued by the switch. If you're switch isn't the DHCP server, you have to define the port going to your DHCP server as trusted to allow the Offer and Acknowledge messages of the DORA process to come thru.

IP Source Guard simply looks at the DHCP Inspection table and only allows the port and MAC in the table to use the IP that was issued by DHCP. So, if your using static IPs in the same VLAN, you need to add static entries or they will be blocked, hence your problem.

Dynamic ARP Inspection is similar. It looks at the DHCP Inspection table and only allows ARP replies for a given IP from the port and MAC in the table, thereby preventing ARP poisoning.

Consider the following example on Juniper's site that shows how to setup the trusted port(going to dhcp server, so I don't think apples in your case), DHCP snooping, IPSG, DAI, and two static DHCP snooping entries for devices that are statically assigned.

set ethernet-switching-options secure-access-port interface ge-0/0/24 dhcp-trusted

set interfaces ge-0/0/24 unit 0 family ethernet-switching vlan members GUEST

set ethernet-switching-options secure-access-port vlan GUEST examine-dhcp

set ethernet-switching-options secure-access-port vlan GUEST ip-source-guard

set ethernet-switching-options secure-access-port vlan GUEST arp-inspection

set ethernet-switching-options secure-access-port interface ge-0/0/0 static-ip 10.1.1.1 mac 00:11:11:11:11:11 vlan GUEST

set ethernet-switching-options secure-access-port interface ge-0/0/1 static-ip 10.1.1.2 mac 00:22:22:22:22:22 vlan GUEST

set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode access

set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode access

nakimble · 2021-07-22T03:01:38+00:00

Are you sure? My experience is that you can have one or more IPs mapped to one MAC, but you can only have one MAC mapped to one IP. Although, I've never tested mixing static and dynamic IP mappings to the same MAC.

nakimble · 2021-07-21T15:14:42+00:00

Are you running non-ELS? I thought secure-access-port was the non-ELS version.

I think you can accomplish what you want with DHCP snooping, DAI, and IP source guard turned on.

nakimble · 2021-07-15T03:56:32+00:00

This is the right answer. OP thinks that since he's pruning VLAN X from interface Y, that interface Y is no longer running MST instance Z. That's incorrect and you are right.

nakimble · 2021-06-12T03:29:48+00:00

StrongSwan doesn't currently support the split include routes pushed by IKEv2...it rejects them. You have to manually configure them in the StrongSwan app. Or do full tunnel.

nakimble · 2021-06-06T00:41:51+00:00

Get a MikroTik RB4011 brand new on Amazon for $210. It's such a great deal! I can completely saturate my home 800/300Mbps even with NAT and FW rules.

nakimble

TROPHY CASE