How to - Site to site connection - Static site(Vyos) - Dynamic Site (cisco router)

biedron · May 30, 2014, 7:46am

Hi,

When implement vyatta/vyos (and replace all main cisco router ) we met witch problem to connect some part of remote office witch dynamicly ip address. We using dyndns and all office have own domain name, after ip change, dyndns update and propagate new ip. In cisco main router, we have specialy scheduler, who rebuild tunnel and change ip in configuration.

In vyatta/vyos it is not possible. So we write a script, which rebuild configuration and put correct ip addres.

Starter script: - check, if another instance of script runnig. When we tested, somtimes, main script is blocked, and another instance of script, completly ruing configuration.

Main script: Ok, main script, change configuration in router. He have some security :). First, he check is ip addres has change, then prepare to configure, after he check correct form of ip adress. When remote office dosen’t resposne, some times instead push ip addres from office, script put 8.8.8.8.

Script file :
#!/bin/bash
CONFIG_FILE=“/config/config.boot”
BRANCHES_IP=“/scheduler/script/branches_list”
BRANCHES_IP_TMP=“/scheduler/script/branches_list_tmp”
LOG=“/scheduler/script/log”
ACTIVE_CONF=“/opt/vyatta/config/active/vpn/ipsec/site-to-site/peer”
WRAPPER=“/opt/vyatta/sbin/vyatta-cfg-cmd-wrapper”
PASS=“xxxxxxxx”

sudo echo date > $LOG
date
echo creating file branches_list.
rm /scheduler/script/dns_branches_list
rm /scheduler/script/branches_list
cat /config/config.boot | grep NEO_ | awk ‘{ print $2 }’ | sort -u > /scheduler/script/dns_branches_list

for IP in cat /scheduler/script/dns_branches_list; do

DNS=echo $IP | cut -c 5-

DNS_IP=sudo nslookup $DNS | grep Address | tail -1 | awk '{ print $3 }'
    DNS_IP=`grep -B 7 $IP /config/config.boot | grep peer | awk '{ print $2 }'`
    echo $DNS_IP >> /scheduler/script/branches_list
done

for BRANCH_ROUTER_IP in cat $BRANCHES_IP; do
echo “”
echo “”
echo Pullname of tunnel vti $BRANCH_ROUTER_IP:
VTI_NAME=cat $CONFIG_FILE | grep $BRANCH_ROUTER_IP -A 11 | grep bind | awk '{ print $2 }'
echo $VTI_NAME
echo Pull dns $BRANCH_ROUTER_IP:
DDNS_NAME_tmp=cat $CONFIG_FILE | grep $BRANCH_ROUTER_IP -A 11 | grep description | awk '{ print $2 }'
DDNS_NAME=echo $DDNS_NAME_tmp | cut -c 5-
echo $DDNS_NAME
echo pull ip for domain $DDNS_NAME:
GET_NSLOOKUP=sudo nslookup $DDNS_NAME | grep Address | tail -1 | awk '{ print $3 }'
echo $GET_NSLOOKUP
echo check is $DDNS_NAME not 8.8.8.8
if [ “$GET_NSLOOKUP” = “8.8.8.8” ]; then
echo Problay ISP not work
exit
fi
echo commparr ip $BRANCH_ROUTER_IP and $GET_NSLOOKUP
if [ “$BRANCH_ROUTER_IP” != “$GET_NSLOOKUP” ]; then
sudo echo “bad – $DDNS_NAME” >> $LOG
echo ip is not correct, check
SPR_BRANCH_ROUTER_IP=echo $BRANCH_ROUTER_IP | grep -E '^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]{0,1}[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]{0,1}[0-9])$'
SPR_GET_NSLOOKUP=echo $GET_NSLOOKUP | grep -E '^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]{0,1}[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]{0,1}[0-9])$'

echo ip $SPR_BRANCH_ROUTER_IP ip $SPR_GET_NSLOOKUP
            if [ -z $SPR_BRANCH_ROUTER_IP ] || [ -z $SPR_GET_NSLOOKUP ]; then
            echo Ip addres is not correct form. Config router is stop
            else
            echo ip is ok 
            echo change config rouer
            #/scheduler/script/ddns_renew $BRANCH_ROUTER_IP $GET_NSLOOKUP $VTI_NAME $DDNS_NAME
            #sudo mv $ACTIVE_CONF/$BRANCH_ROUTER_IP $ACTIVE_CONF/$GET_NSLOOKUP
            source /etc/default/vyatta
            $WRAPPER begin
            $WRAPPER delete vpn ipsec site-to-site peer $BRANCH_ROUTER_IP
            $WRAPPER set vpn ipsec site-to-site peer $GET_NSLOOKUP
            $WRAPPER set vpn ipsec site-to-site peer $GET_NSLOOKUP description $DDNS_NAME_tmp
$WRAPPER set vpn ipsec site-to-site peer $GET_NSLOOKUP
$WRAPPER set vpn ipsec site-to-site peer $GET_NSLOOKUP authentication pre-shared-secret $PASS
$WRAPPER set vpn ipsec site-to-site peer $GET_NSLOOKUP ike-group IKE
$WRAPPER set vpn ipsec site-to-site peer $GET_NSLOOKUP local-address vyatta_local_ip
$WRAPPER set vpn ipsec site-to-site peer $GET_NSLOOKUP vti bind $VTI_NAME
$WRAPPER set vpn ipsec site-to-site peer $GET_NSLOOKUP vti esp-group ESP
$WRAPPER commit
$WRAPPER end

sudo echo $GET_NSLOOKUP >> $BRANCHES_IP_TMP
            fi
    else
        sudo echo "not bad -- $DDNS_NAME" >> $LOG
sudo echo $BRANCH_ROUTER_IP >> $BRANCHES_IP_TMP
    fi
done

#rm $BRANCHES_IP
#mv $BRANCHES_IP_TMP $BRANCHES_IP
sudo echo “” > $BRANCHES_IP_TMP

BAD_BRANCH=cat $LOG | grep BAD | wc -l
if [ “$BAD_BRANCH” -ne 0 ]; then
source /etc/default/vyatta
$WRAPPER begin
$WRAPPER save
$WRAPPER end
else
sudo echo “OK” >> $LOG
fi

Cisco configuration in remote office

Script started from crontab (10min timestap).

So, is two importand things:

vti tunnel and remote offisce in description, must have corect dyndnsname,
when crontab is running, we don’t change anything ( specialy push commit command )

P.s maybe future realase of vyos including our solution