IP Mobility: Mobile IP Configuration Guide, Cisco IOS Release 15M&T
Mobile IP Support for Foreign Agent Reverse Tunneling
Downloads: This chapterpdf (PDF - 111.0KB) The complete bookPDF (PDF - 1.3MB) | Feedback

Mobile IP Support for Foreign Agent Reverse Tunneling

Mobile IP Support for Foreign Agent Reverse Tunneling

Last Updated: December 2, 2012

The Mobile IP--Support for Foreign Agent Reverse Tunneling feature prevents packets sent by a mobile node from being discarded by routers configured with ingress filtering by creating a reverse tunnel between the foreign agent and the home agent.

Feature Specifications for Mobile IP--Support for FA Reverse Tunneling

Feature History

Release

Modification

12.2(13)T

This feature was introduced.

Supported Platforms

For platforms supported in Cisco IOS Release 12.2(13)T, consult Cisco Feature Navigator.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Restrictions for Mobile IP Support for FA Reverse Tunneling

  • Cisco Express Forwarding (CEF) switching is currently not supported on a foreign agent with reverse tunneling enabled. With CEF switching enabled, a foreign agent will not encapsulate the FA-HA tunnel header on traffic received from a mobile node or a mobile router. To disable CEF on the foreign agent, use the no ip cef global configuration command.

Foreign agent reverse tunneling may adversely impact process switching and fast switching performance when Mobile IP is enabled because:

  • All packets arriving at the foreign agent from an interface that has reverse tunneling enabled need to be checked to determine if they need to be reverse tunneled.
  • At the home agent only IP packets that contain a source address from an authenticated mobile user are decapsulated and allowed to enter a corporate network.

Before enabling foreign agent reverse tunneling, you should be aware of the following security considerations:

  • It is possible for any mobile node to insert packets with the source address of a registered user. Enabling reverse tunneling on a foreign agent can increase this existing security consideration because reverse tunneling provides a one-way path into a private network. You can prevent this problem by enforcing link-layer authentication before permitting link-layer access.

See the part "Authentication, Authorization, and Accounting (AAA)" in the Cisco IOS Security Configuration Guide, Release 12.2 for more information, including instructions for configuring authentication.

  • If foreign agent reverse tunneling creates a tunnel that transverses a firewall, any mobile node that knows the addresses of the tunnel endpoints can insert packets into the tunnel from anywhere in the network. It is recommended to configure Internet Key Exchange (IKE) or IP Security (IPSec) to prevent this.

See the part "IP Security and Encryption" in the Cisco IOS Security Configuration Guide, Release 12.2 for more information, including instructions for configuring IKE and IPSec.

How to Enable Reverse Tunneling on a Foreign Agent

Enabling Foreign Agent Reverse Tunneling

The Cisco IOS implementation of foreign agent reverse tunneling is in the direct delivery style. In direct delivery, if the mobile node (a device such as a personal digital assistant that can change its point of attachment from one network to another) is using a foreign agent care-of address, it sends nonencapsulated packets to the foreign agent. The foreign agent detects the packets sent by the mobile node and encapsulates them before forwarding them to the home agent. If the mobile node is using a collocated care-of address, the foreign agent tunnels the unencapsulated packets directly to the home agent.

Perform this task to configure a foreign agent to provide default services, including reverse tunneling.

SUMMARY STEPS

1.    enable

2.    configure {terminal | memory | network}

3.    router mobile

4.    ip mobile foreign-agent care-of interface

5.    ip mobile foreign-agent reverse-tunnel private-address

6.    interface type number

7.    ip address ip-address mask

8.    ip irdp

9.    ip irdp maxadvertinterval seconds

10.    ip irdp minadvertinterval seconds

11.    ip irdp holdtime seconds

12.    ip mobile foreign-service reverse-tunnel [mandatory]


DETAILED STEPS
  Command or Action Purpose
Step 1
enable


Example:

Router> enable

 

Enables higher privilege levels, such as privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2
configure {terminal | memory | network}


Example:

Router# configure terminal

 

Enters global configuration mode.

 
Step 3
router mobile


Example:

Router(config)# router mobile

 

Enables Mobile IP on the router.

 
Step 4
ip mobile foreign-agent care-of interface


Example:

Router(config)# ip mobile foreign-agent care-of serial0

 

Enables foreign agent services when at least one care-of address is configured.

  • This is the foreign network termination point of the tunnel between the foreign agent and home agent. The care-of address is the IP address of the interface. The interface, whether physical or loopback, need not be the same as the visited interface.
 
Step 5
ip mobile foreign-agent reverse-tunnel private-address


Example:

Router(config)# ip mobile foreign-agent reverse-tunnel private-address

 

Forces a mobile node with a private home address to register with reverse tunneling.

 
Step 6
interface type number


Example:

Router(config)# interface serial0

 

Configures an interface and enters interface configuration mode.

 
Step 7
ip address ip-address mask


Example:

Router(config-if)# ip address 10.1.0.1 255.255.255.255

 

Sets a primary IP address of the interface.

 
Step 8
ip irdp


Example:

Router(config-if)# ip irdp

 

Enables ICMP Router Discovery Protocol (IRDP) processing on an interface.

 
Step 9
ip irdp maxadvertinterval seconds


Example:

Router(config-if)# ip irdp maxadvertinterval 10

 

(Optional) Specifies the maximum interval in seconds between advertisements.

 
Step 10
ip irdp minadvertinterval seconds


Example:

Router(config-if)# ip irdp minadvertinterval 7

 

(Optional) Specifies the minimum interval in seconds between advertisements.

 
Step 11
ip irdp holdtime seconds


Example:

Router(config-if)# ip irdp holdtime 30

 

(Optional) Length of time in seconds that advertisements are held valid.

  • Default is three times the maxadvertintervalperiod.
 
Step 12
ip mobile foreign-service reverse-tunnel [mandatory]


Example:

Router(config-if)# ip mobile foreign-service reverse-tunnel mandatory

 

Enables foreign agent service on an interface.

  • Enables foreign agent reverse tunneling on the interface. This command also appends Mobile IP information such as care-of address, lifetime, and service flags to the advertisement.
 

Enabling Foreign Agent Reverse Tunneling on the Mobile Router

SUMMARY STEPS

1.    enable

2.    configure {terminal | memory | network}

3.    router mobile

4.    ip mobile router

5.    address address mask

6.    home-agent ip-address

7.    reverse-tunnel


DETAILED STEPS
  Command or Action Purpose
Step 1
enable


Example:

Router> enable

 

Enables higher privilege levels, such as privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2
configure {terminal | memory | network}


Example:

Router# configure terminal

 

Enters global configuration mode.

 
Step 3
router mobile


Example:

Router(config)# router mobile

 

Enables Mobile IP on the router.

 
Step 4
ip mobile router


Example:

Router(config)# ip mobile router

 

Enables the Mobile Router and enters mobile router configuration mode.

 
Step 5
address address mask


Example:

Router(mobile-router)# address 10.1.0.1 255.255.255.255

 

Sets the home IP address and network mask of the mobile router.

 
Step 6
home-agent ip-address


Example:

Router(mobile-router)# home-agent 10.1.1.1

 

Specifies the home agent that the mobile router uses during registration.

 
Step 7
reverse-tunnel


Example:

Router(mobile-router)# reverse-tunnel

 

Enables the reverse tunnel function.

 

Verifying Foreign Agent Service Configuration

Perform this task to optionally verify that the interface has been configured to provide foreign agent services, including foreign agent reverse tunneling.

SUMMARY STEPS

1.    enable

2.    show ip mobile globals

3.    show ip mobile interface

4.    show ip mobile traffic


DETAILED STEPS
  Command or Action Purpose
Step 1
enable


Example:

Router> enable

 

Enables higher privilege levels, such as privileged EXEC mode.

Enter your password if prompted.

 
Step 2
show ip mobile globals


Example:

Router# show ip mobile globals

 

(Optional) Displays global information for mobile agents.

 
Step 3
show ip mobile interface


Example:

Router# show ip mobile interface

 

(Optional) Displays advertisement information for interfaces that are providing foreign agent service or are home links for mobile nodes.

 
Step 4
show ip mobile traffic


Example:

Router# show ip mobile traffic

 

(Optional) Displays protocol counters.

 

Additional References

The following sections provide additional references related to the Mobile IP--Support for FA Reverse Tunneling feature:

Standards

Standards

Title

No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

--

MIBs

MIBs1

MIBs Link

  • RFC2006-MIB
  • CISCO-MOBILE-IP-MIB

To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

1 Not all supported MIBs are listed.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://tools.cisco.com/ITDIT/MIBS/servlet/index

If Cisco MIB Locator does not support the MIB information that you need, you can also obtain a list of supported MIBs and download MIBs from the Cisco MIBs page at the following URL:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

To access Cisco MIB Locator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:

http://www.cisco.com/register

RFCs

RFCs2

Title

RFC 2002

IP Mobility Support

RFC 2003

IP Encapsulation within IP

RFC 2005

Applicability Statement for IP Mobility Support

RFC 2006

The Definitions of Managed Objects for IP Mobility Support

RFC 3024

Reverse Tunneling for Mobile IP, revised

2 Not all supported RFCs are listed.

Technical Assistance

Description

Link

Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, tools, and lots more. Registered Cisco.com users can log in from this page to access even more content.

http://www.cisco.com/public/support/tac/home.shtml

Command Reference

The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the Cisco IOS IP Mobility Command Reference at http://www.cisco.com/en/US/docs/ios/ipmobility/command/reference/imo_book.html. For information about all Cisco IOS commands, go to the Command Lookup Tool at http://tools.cisco.com/Support/CLILookup or to the Cisco IOS Master Commands List .

  • debug ip mobile
  • ip mobile foreign-agent
  • ip mobile foreign-service
  • show ip mobile traffic

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2012 Cisco Systems, Inc. All rights reserved.