Cisco IOS XE Security Configuration Guide: Secure Connectivity, Release 2

Reverse Route Injection

Reverse route injection (RRI) is the ability for static routes to be automatically inserted into the routing process for those networks and hosts protected by a remote tunnel endpoint. These protected hosts and networks are known as remote proxy identities.

Each route is created on the basis of the remote proxy network and mask, with the next hop to this network being the remote tunnel endpoint. By using the remote Virtual Private Network (VPN) router as the next hop, the traffic is forced through the crypto process to be encrypted.

Finding Feature Information

For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Reverse Route Injection" section.

Use Cisco Feature Navigator to find information about platform support and Cisco IOS XE software image support. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp. An account on Cisco.com is not required.

Contents

•Prerequisites for Reverse Route Injection

•Restrictions for Reverse Route Injection

•Information About Reverse Route Injection

•How to Configure Reverse Route Injection

•Configuration Examples for Reverse Route Injection

•Additional References

•Feature Information for Reverse Route Injection, page 26

Prerequisites for Reverse Route Injection

IP routing should be enabled and static routes should be redistributed if dynamic routing protocols are to be used to propagate RRI-generated static routes.

Restrictions for Reverse Route Injection

For static crypto maps, routes are always present if RRI is configured on an applied crypto map. The default behavior—of routes always being present for a static map—will not apply unless the static keyword is added to the reverse-route command.

Information About Reverse Route Injection

•Reverse Route Injection

Reverse Route Injection

RRI is the ability for static routes to be automatically inserted into the routing process for those networks and hosts that are protected by a remote tunnel endpoint. These protected hosts and networks are known as remote proxy identities.

Each route is created on the basis of the remote proxy network and mask, with the next hop to this network being the remote tunnel endpoint. By using the remote VPN router as the next hop, the traffic is forced through the crypto process to be encrypted.

After the static route is created on the VPN router, this information is propagated to upstream devices, allowing them to determine the appropriate VPN router to which to send returning traffic in order to maintain IPsec state flows. Being able to determine the appropriate VPN router is particularly useful if multiple VPN routers are used at a site to provide load balancing or failover or if the remote VPN devices are not accessible via a default route. Routes are created in either the global routing table or the appropriate virtual route forwarding (VRF) table.

RRI is applied on a per-crypto map basis, whether this is via a static crypto map or a dynamic crypto map template. The default behavior for the two map types is as follows:

•In the case of a dynamic crypto map, routes are created upon the successful establishment of IPsec security associations (SAs) for those remote proxies. The next hop back to those remote proxies is via the remote VPN router whose address is learned and applied during the creation of the dynamic crypto map template. The routes are deleted after the SAs are deleted. Routes created on the basis of IPsec source proxies on static crypto maps is the default behavior on static maps and overrides the creation of routes on the basis of crypto ACLs (see the next bullet).

•For static crypto maps, routes are created on the basis of the destination information defined in the crypto access list. The next hop is taken from the first set peer statement that is attached to the crypto map. If at any time, RRI, the peer, or the access list is removed from the crypto map, routes will be deleted. This behavior changes with the addition of the RRI enhancements, as explained in the sections below.

How to Configure Reverse Route Injection

•Configuring RRI Under a Static Crypto Map

•Configuring RRI Under a Dynamic Map Template

Configuring RRI Under a Static Crypto Map

SUMMARY STEPS

1. enable

2. configure terminal

3. crypto map {map-name} {seq-name} ipsec-isakmp

4. reverse-route [static | tag tag-id [static] | remote-peer [static] | remote-peer ip-address [static]]

DETAILED STEPS

Configuring RRI Under a Dynamic Map Template

SUMMARY STEPS

1. enable

2. configure terminal

3. crypto dynamic-map dynamic-map-name dynamic-seq-name

4. reverse-route [static | tag tag-id [static] | remote-peer [static] | remote-peer ip-address [static]]

DETAILED STEPS

Configuration Examples for Reverse Route Injection

•Configuring RRI When Crypto ACLs Exist: Example

•Configuring RRI When Two Routes Are Created, One for the Remote Endpoint and One for Route Recursion: Example

Configuring RRI When Crypto ACLs Exist: Example

The following example shows that all remote VPN gateways connect to the router via 192.168.0.3. RRI is added on the static crypto map, which creates routes on the basis of the source network and source netmask that are defined in the crypto access control list (ACL):

crypto map mymap 1 ipsec-isakmp

 set peer 10.1.1.1

 reverse-route

 set transform-set esp-3des-sha

 match address 102

Interface FastEthernet 0/0/1

 ip address 192.168.0.2 255.255.255.0

 standby name group1

 standby ip 192.168.0.3

 crypto map mymap redundancy group1

access-list 102 permit ip 192.168.1.0 0.0.0.255 10.0.0.0 0.0.255.255

Configuring RRI When Two Routes Are Created, One for the Remote Endpoint and One for Route Recursion: Example

In the following example, two routes are created, one for the remote endpoint and one for route recursion to the remote endpoint via the interface on which the crypto map is configured:

reverse-route remote-peer

Additional References

The following sections provide references related to Reverse Route Injection enhancements.

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Feature Information for Reverse Route Injection

Table 1 lists the features in this module and provides links to specific configuration information.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS XE software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp. An account on Cisco.com is not required.

Note Table 1 lists only the Cisco IOS XE software release that introduced support for a given feature in a given Cisco IOS XE software release train. Unless noted otherwise, subsequent releases of that Cisco IOS XE software release train also support that feature.

Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at http://www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2008, 2011 Cisco Systems, Inc. All rights reserved.