VRF for IPsec tunnels

michmoor

Is there an ability on TNSR to give IPsec tunnels their own VRF?

In JUNOS, i am able to place clients into their own routing-instance , where i can do IPsec/BGP with them. Theres been IP overlap conflicts in the past plus having that l3 separation of the routing domain, in my mind, is best security practice.

That said, can TNSR do this?
pfSense doesn't understand VRFs but I'm looking at that as more of a legacy appliance i will roll out if i have no choice but the preference is TNSR for all modern deployments.

fractal_boy

@michmoor Yes you can

create your vrf, in case you don't have one:

bhc-tnsr tnsr(config)# sh run route
route table IPSEC
    description IPSEC VRF
    id 101
exit

Assign your new vrf to the ipsec tun ipip interface. In my case, this is ipip101 interface.

interface ipip101
    enable
    mtu 1380
    vrf IPSEC
    ip address 172.21.254.6/30
exit

Configure static route in your new vrf pointing to the remote ipip interface.

bhc-tnsr tnsr(config)# sh run route
route table IPSEC
    description IPSEC VRF
    id 101
    route 172.27.0.0/16
        next-hop 0 via 172.21.254.5 ipip101
    exit
exit

michmoor

@fractal_boy very nice. Exactly what I’m looking for