Configuring OSPF / BGP Authentication within NSX and RouterOS

A little tip Andy Kennedy (Twitter) gave in one of his internal presentations was to use authentication when configuring a routing protocol during a Proof of Concept to avoid redistributing routes into a production environment in the event of a misconfiguration.  This is just a quick post to show you how to configure authentication when using OSPF and BGP within NSX and RouterOS.  My lab environment currently looks like this:

I have OSPF configured between my DLR (PA-DLR-01) and my Edge (PA-EDGE-01) and BGP between my Edge (PA-EDGE-01) and my physical router (Mikrotik) which runs RouterOS.  To configure OSPF authentication on the DLR simply fire up the vSphere web client and navigate to Networking & Security -> NSX Edges -> DLR you want to configure -> Routing -> OSPF and then modify the area definition.  Change the authentication type to Password and then enter a password, click OK and then publish the changes:

At this point routes should stop distributing into the Edge as we need to configure the same password on the Edge (PA-EDGE-01).  Once configured on Edge routes should start populating again.  We can also run a show ip ospf interface on the edge and see that authentication is enabled:

To configure authentication for BGP on the edge navigate to Networking & Security -> NSX Edges -> Edge you want to configure -> Routing -> BGP and edit the neighbour you want to configure for authentication.  In the password field enter the required password, click OK and then publish the changes:

Route distribution will stop from the Edge into the physical router and vice-versa until we configure authentication within the physical router.  To do this is RouterOS simply log in and navigate to Routing -> BGP -> Peers and modify the Edge peer.  Within the TCP MD5 Key field enter the same password you used on the Edge and click OK:

Once you do this routes should start redistributing again.  Now if the Edge uplink interface is accidentally connected to the wrong VLAN backed portgroup with a physical router with the same neighbour IP address we will not accidentally redistribute routes into the production environment.

Configuring BGP between RouterOS and an NSX Edge

I use a RouterBOARD RB715G in my homelab as my router and layer 3 switch which has been absolutely rock solid since I purchased it.  I'm probably not even using 10% of it's functionality but it's definitely worth the money.  When testing NSX and creating logical networks I always end up creating static routes into the NSX environment so I can test connectivity from my physical workstation so I decided to configure BGP from the Edge to the MikroTik.  The diagram below shows my current network layout.  I have OSPF configured from the distributed logical router (PA-DLR-01) to the Edge (PA-Edge-01)

Below are the results from the show ip route command on both the Edge and the DLR:

PA-Edge-01:

PA-DLR-01:

Below is the route information from my Mikrotik router:

As you can see OSPF is populating the routes from PA-DLR-01 into PA-Edge-01.  Now it's time to configure BGP between PA-Edge-01 and Mikrotik.  I'm not going to show you how to configure BGP on the Edge as there are numerous blog articles out there that document this process.  To configure BGP on the Mikrotik router log in and navigate to Routing and then BGP and edit the default entry in the Instances tab:

Ensure you have entered a router ID and Redistribute Connected and Redistribute Static options are ticked (Or whatever you want to redistribute via BGP).  Navigate to the Peers tab and add a new entry:

Give the new entry a name and then enter the IP address of the Edge, in my case it's 10.201.1.41. Enter the Remote AS number and then set the Default Originate option to Always and click OK.  If everything is configured correctly all directly connected routes to the PA-WebTier, PA-AppTier and PA-DBTier should appear in the Mikrotik's route list and any new networks directly connected to the PA-DLR-01 should appear as well:

PA-Edge-01

PA-DLR-01

Mikrotik:

Thanks to Geordy Korte (Blog | Twitter) for the assistance in configuring the Mikrotik router.

Replacing Sky's SR102 modem / router

This post is mainly for my own knowledge as with age and NSX my brain doesn't seem to retain information as good as it use to.

** Please note it is against Sky's policies to use any other router / modem apart from the one supplied **

I recently moved house and was no longer in a Virgin Media area and since I was ordering Sky television I also opted for their Sky Fibre unlimited package as well.  I'm a big fan of the MikroTik routers and switches and use a RB751G in my lab as my default router and L3 gateway and obviously wanted to continue using this in my new house.

Sky Fibre unlimited now comes with the combined modem / router called the SR102 which is adequate for home use, but not for my lab:

When researching I found that I simply couldn't replace the SR102 with a standard BT OpenReach modem as Sky use DHCP option 61 as a client authentication as per ITEF:

"
9.14. Client-identifier

This option is used by DHCP clients to specify their unique identifier.  DHCP servers use this value to index their database of address bindings.  This value is expected to be unique for all clients in an administrative domain.

Identifiers SHOULD be treated as opaque objects by DHCP servers.

The client identifier MAY consist of type-value pairs similar to the 'htype'/'chaddr' fields defined in [3]. For instance, it MAY consist of a hardware type and hardware address. In this case the type  field SHOULD be one of the ARP hardware types defined in STD2 [22].  A hardware type of 0 (zero) should be used when the value field contains an identifier other than a hardware address (e.g. a fully qualified domain name).  

For correct identification of clients, each client's client-identifier MUST be unique among the client-identifiers used on the subnet to which the client is attached.  Vendors and system administrators are responsible for choosing client-identifiers that meet this requirement for uniqueness.

The code for this option is 61, and its minimum length is 2.

Code   Len   Type  Client-Identifier
+-----+-----+-----+-----+-----+---
|  61 |  n  |  t1 |  i1 |  i2 | ...
+-----+-----+-----+-----+-----+---
"

So, in order to replace the SR102 with an OpenReach modem and MikroTik router you first need to obtain the username and password used to authenticate with Sky's servers.  This can be achieved by using wireshark and sniffing the DHCP discover packets when powering on the SR102.  This video shows you how to extract the username and password:

Once you have it extracted in the form of MACADDRESS@skydsl|PASSWORD i.e. (00:00:00:00:00:00@skydsl|a34sdre6) you need to convert it from ASCII to HEX using an online converter (This worked for me - http://www.asciitohex.com/)

Once you have the client identifier in HEX format you need to configure option 61 on the DHCP client of your MikroTik router.  Log into WinBox and browse to IP and then DHCP Client and in the Option 61 option enter the value as 0xHEXVALUE (You need to put 0x at the front of the value)

Once finished ensure your MikroTik is set to DHCP and not PPPoE or static and you should recieve and IP address from Sky's DHCP servers:

I also configured the WAN port of my MikroTik with the same MAC address as my SR102 as I've read a few articles that say it can potentially take a few hours for the MAC address to time out which means if you need to swap back to the SR102 you potentially have wait before connectivity will be restored.

Configuring DHCP Relays within RouterOS

   In a lab environment you may want to mimic a live environment as much as possible.  This also includes separating your clients from your servers with the use of VLANs.  I currently have my clients on VLAN 9 and servers on VLAN 8.  My Domain Controller (Also my DHCP Server) currently resides on VLAN 9 so in order for my clients to obtain an IP address from my DHCP server I need to relay the request from VLAN 9 to VLAN 8 as DHCP uses broadcast traffic to obtain it’s IP address which cannot span VLANs.  So, create the required DHCP scopes on your chosen DHCP server:

   Log into your MicroTik router via Winbox and then select IP and then DHCP Relay.  Enter a name for the Relay and then the Interface you want it to listen on and then finally the IP address of the DHCP server you want to forward the request to:

   To test simply connect a client to that VLAN and request an IP address.  If you click on the Status tab you can see how many requests and responses the DHCP Relay has dealt with:

Configure VLANs and Layer 3 Routing within RouterOS

   In my current setup I have a MikroTik RB751G-2HnD running software version 6.0rc12.  This is connected to the Linksys SRW2016 16 port Layer 2 Gigabit switch.  On the Linksys I’ve configured the required VLANs and trunked the port that connects the switch to the router:

   I’ve also trunked the ports that connect to my ESXi hosts so all VLANs can pass through.  Now, to configure the VLANs within the MicroTik router simple connect up via Winbox and select Interfaces and then the VLAN tab.  Create all the VLANs you require and click Apply:

   To add layer 3 functionality so you can route between VLANs select IP and then Addresses and simply add IP addresses to each VLAN:

   If all has been successful you should be able to ping the default gateway for each VLAN from any other VLAN.

RouterBOARD – Logging

The logging functionality within RouterBOARD is pretty impressive.  The log can be viewed from the main menu:

In order to configure new logging you need to go into System –> Logging.  By default the following errors are logged:

Logs can be sent to the following Actions (Locations):

Disk

When the disk option is selected then logs are stored on the local hard disk.  The local hard disk is around 61MB in size with around 31MB free (This can be viewed by going to System –> Resources).  You can amend the log to local hard disk options by clicking it and changing the required parameters:

Echo

Not too sure what Echo is but I’m assuming it echo’s the log to the CLI.  Anyways, the following options can be changed for echo:

Memory

Memory refers to the flash memory of the device.  This is roughly around 60MB with 45MB spare (This can be viewed by going to System –> Resources).  You can also change how many log lines are stored in memory to store more data:

Remote

The final option is remote.  This refers to a remote syslog server where you can configure the IP address and port number:

You can log a variety topics which include firewall, account, info, email, dhcp etc etc.  I wanted to log all firewall traffic that was being blocked.  To do this simply go back to the logging option and click the Red Plus sign under the Rules tab:

In the Topic section add Firewall and then select where you want to log the data to.  In my case I’m just logging to memory.  You can also prefix some text to all firewall entries so you can easily identify it if you want.  Once finished simply click Apply:

Your new rule to log firewall traffic should be visible:

In order for the firewall to start logging traffic you need to add a firewall rule to tell it to log traffic.  To add the rule simply click IP –> Firewall and set focus to the Filter Rules tab.  By default there are 4 rules in place.  The first rule allows ICMP (Ping) traffic on all interfaces.  The second and third rules allow established and related traffic and the final rule blocks everything else:

To add a log rule simply click on the red plus to add a new rule.  Click on the General tab and set the Chain to be forward and the In. Interface to be your external gateway (Where the internet is connected to):

Click on the Action tab and set the Action to be Log and then also set a log prefix if you want and then click Apply

The new rule should appear in the list of rules.  Simply drag the rule to where you want it to take affect.  If you want to see all traffic including allowed traffic then drag the rule to the top of the list.  If you only want to see dropped traffic then drag it just above the drop rule:

To see if in action click on the Log button and you should dropped traffic starting to appear.

RouterBOARD – Connecting an external antenna

The external antenna can be connected to the RouterBOARD RB751G-2Hnd via the MMCX connector at the front:

 

The part that you need can be found here.  You can either connect the antenna to the MMCX connector and leave it dangling or you can actually fit it into the casing, which is extremely easy to do.  To fit it into the casing take the RouterBOARD casing apart with a flat head screwdriver from the bottom.  Once apart you will notice the cover which can be peeled off revealing four slots:

Simply choose a hole to connect the antenna to and push out the slot.  Carefully put the sticky cover back on and cut out the hole with a knife or screwdriver:

It doesn't need to be neat as the antenna will slide over the edges.  Once you have cut the hole in the cover simply feed the antenna cable through hole and back out the antenna slot hole and connect to the MMCX connector.  Replace the bottom of casing and ensure the antenna is fitted securely into the slot:

To enable the antenna log into your RouterBOARD and go to Wireless and then the Interfaces tab.  Double click your wireless interface and select the HT tab and set the Antenna Mode to be Antenna B:

RouterBOARD – Backup / Restore Config

To backup your RouterBOARD configuration log on via the Winbox and select the Files menu item:

Click the Backup button and then simply drag the file from the GUI onto your desktop.  To restore your configuration simply highlight it and click the restore button.  You will be asked to confirm and then reboot your device:

If the file you want to restore is not one the device then simply drag it into the files list and it will be copied up to the device.

RouterBOARD – Time Configuration

With all firewall devices you want to ensure the time on the device is correct to ensure accurate logging.  RouterBOARD comes with two methods to configure the time, Manual and SNTP Client:
Manual Time Setup
Log into your RouterBOARD and select System and then Clock:

Configure the correct date / time and time zone.
SNTP Client
Log into your RouterBOARD and select System and then SNTP Client:

Enable the service and then select Unicast as the mode.  This will allow you to enter a primary and secondary NTP server.  Within my settings I have configured it to pick up it’s time from 93.184.71.155 and 213.209.109.45 which are part of the pool.ntp.org servers.

RouterBOARD - Factory Reset

In order set reset the RouterBOARD back to factory default you need to grab a paper clip and push down the reset button at the rear of the device (highlighted in red):

Wait 10 seconds and then remove the power to the device whilst keeping the reset button pushed down, after 10 seconds power the device back on and keep the button down for a further 10 seconds (30 seconds in total).  The time might actually be a lot loss but 10 seconds worked for me.  The device should then boot up within 30 seconds.  Connect your laptop to any port apart from 1 (This is used as the WAN port and is set to be a DHCP client by default).  Once connected you should pick up an IP address in the 192.168.88.0 / 24 range.  Point your browse to 192.168.88.1 and you should now have access to the RouterBOARD web interface:

From here select your method of connecting to the device and configure away.

MikroTik RouterBOARD RB751G-2Hnd

After seeing a recent post by Eric Sloof regarding the Mikrotik RouterBOARD RB751G-2Hnd firewall / router / AP it came just in time.  I was actually looking for something to trunk my layer2 linksys switch to support VLANs for my home ESXi5 lab and to replace my VirginMedia SuperHub after the reported wireless issues with the latest firmware.  After researching I took the plunge and purchase the following from LinITX:

MikroTik RouterBOARD 751G-2HnD (RouterOS L4) with UK Power Supply
2.4-5.8GHz Omnidirectional Swivel Antenna with cable and MMCX connector

I have to give LinITX credit, the order process was nice and simple and the items arrived the very next day.  Anyways, I’ve just changed the VirginMedia SuperHub into gateway mode and hooked up my RouterBOARD.  So far I’m very impressed with it.  There are multitude of options to configure and it’s going to take me a while to get my head around it but so far so good.  I’ve only performed a few basic operations to get me started such as setting up wireless, configure NAT for my external services (remote access and VPN) and configured firewall logging but I’m definitely going to get more involved with it when I get time.  I’ll be blogging about certain features and setting up the device purely for my knowledge as it’s quite a complex bit of kit.