How to Configure BGP Routing over a TINA VPN Tunnel

To dynamically learn BGP propagated routes from a remote location connected via TINA VPN tunnel, VPN next hop interfaces are used to create an intermediary network. The BGP service is configured to use the remote IP address in the intermediary network as a BGP neighbor.

You must complete this configuration on both the local and the remote Barracuda CloudGen Firewall using the respective values below:

Before You Begin

• A free /24 subnet (e.g., 192.168.21.0/24) for the intermediary network is needed.
• You must have or assign private Autonomous system numbers (ASNs) for the remote and local networks. The ASNs can be private if you are not propagating these networks to other public networks.

Step 1. Add a VPN Next Hop Interface

Add a VPN next hop interface using a /24 subnet (e.g., 192.168.21.0/24).

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN-Service > VPN Settings.
2. Click Lock.
3. In the left menu, select Routed VPN.
4. Next to the Next Hop Interface Configuration table, click Add.
5. In the VPN Interface Properties window, configure the following settings and then click OK.
   
   • In the VPN Interface Index field, enter a number between 0 and 999. E.g., 11
   • In the IP Addresses field, enter the VPN interface IP address including the subnet. E.g., 192.168.21.16/24 for the local or 192.168.21.17/24 for the remote firewall.
     
   • Click OK. The interface is now listed in the Next Hop Interface Configuration table.
   
6. Click Send Changes and Activate.

Step 2. Add the VPN Interface IP to the Shared IP Addresses

Introduce the IP address of the VPN next hop interface on the firewall.

1. Go to CONFIGURATION > Configuration Tree > Box > Network.
2. In the left menu, select IP Configuration.
3. Click Lock.
4. In the Shared Networks and IPs section, click +. The Shared Network and IPs window opens.
   1. Select the virtual Interface.
   2. In the Network Address field, enter the network the virtual interface resides in.
   3. In the Shared IPs in this Network table, click + and add the intermediary VPN IP address of the VPN interface. E.g., 192.168.21.16 for the local firewall or 192.168.21.17 for the remote firewall. 
   4. Click OK.
5. Click Send Changes and Activate.

Step 3. Configure the TINA Site-to-Site VPN Tunnel

Configure a TINA VPN tunnel using the local next hop interface IP address and the VPN next hop interface.

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN-Service > Site to Site. 
2. Click Lock.
3. Right-click In the TINA Tunnels tab and select New TINA tunnel. The TINA tunnel window opens.
4. Enter a Name.

5. Configure the Transport, Encryption and Authentication settings as well as the Local and Remote public IP addresses. For more information, see How to Create a TINA VPN Tunnel between CloudGen Firewalls.

6. Leave the Local and Remote Network empty.

7. In the Remote Networks tab, enter the VPN Interface Index number that you created in the VPN Interface Configuration in step 1. E.g. 11

   

8. Click OK.
9. Click Send Changes and Activate.

Step 4. Configure the BGP Service

Enable and configure the BGP service. Configure the remote VPN interface IP address as a BGP neighbor to dynamically learn the routes of the neighboring network.

Step 4.1 Configure which Routes to Propagate into BGP

You can either enter the networks you want to propagate manually, or set the Advertise Route parameter to yes for routes you want propagated.

1. Go to CONFIGURATION > Configuration Tree > Box > Network.
2. In the left menu, expand the Configuration Mode section, and click Switch to Advanced View.
3. Click Lock.
4. To propagate the management network, set Advertise Route to yes in the Management IP and Network section.
   
5. In the left menu, click on Routing.
6. Double-click on the directly attached routes and gateway routes you want to propagate. The Routes window opens.
7. Set Advertise Route to yes and click OK.
   
   
8. Click Send Changes and Activate.

Step 4.2 Configure the BGP Router

Enable BGP, and use the VPN next hop interface IP address as the Router ID.

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > OSPF-RIP-BGP-Service > OSPF/RIP/BGP Settings. 
2. Click Lock.
3. Set Run BGP Router to Yes.
4. (optional) To learn routes from the remote ASN, set Operation Mode to advertise-learn.
5. Enter the Router ID. Typically the VPN next hop interface IP address is used. E.g., 192.168.21.16 for the local or 192.168.21.17 for the remote firewall.
   
6. In the left menu, click BGP Router Setup.
7. Enter the AS Number. E.g., 64577 for the local firewall or 64578 for the remote firewall.


8. Enter the Terminal Password. Use this password if you must directly connect to the dynamic routing daemon via command line for debugging purposes.

   The password can consist of small and capital characters, numbers, and non-alpha-numeric symbols, except the hash sign (#).

   

9. To propagate the directly attached routes and gateway routes configured in Step 1, set Connected Routes to yes.
   
10. (alternative) To manually enter the networks you want to propagate, click + in the Networks table and enter the network. E.g., 172.16.0.0/24
    
    
11. Click Send Changes and Activate.

Step 4.3. Add a BGP Neighbor

To dynamically learn the routing of the neighboring network, set up a BGP neighbor for the VPN next hop interface.

1. In the left menu of the OSPF/RIP/BGP Settings page, click Neighbor Setup IPv4.

2. Click Lock.

3. Next to the Neighbors table, click the plus sign (+) to add a new neighbor.

4. Enter a Name for the neighbor and click OK. The Neighbors window opens.

5. Configure the following settings in the Usage and IP section:

   • Neighbor IPv4: Enter the remote address for the VPN next hop interface. E.g., 192.168.21.17 for the local firewall or 192.168.21.16 for the remote firewall.
   • OSPF Routing Protocol Usage – Select no.
   • RIP Routing Protocol Usage – Select no.
   • BGP Routing Protocol Usage – Select yes.

6. In the BGP Parameters section, configure the following settings:

   • AS Number – Enter the ASN for the remote network. E.g., 64578 for the local firewall or 64577 for the remote firewall.

   • Update Source – Select Interface.

   • Update Source Interface – Enter the VPN next hop interface in the format: vpnr<interface number>. E.g., vpnr11
     

7. Click OK. 
8. Click Send Changes and Activate.

Step 4.4. (optional) Adjust Keep Alive and Hold Timer

Speed up BGP updates by adjusting the keep alive and hold timer.

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > OSPF-RIP-BGP-Service > OSPF/RIP/BGP Settings.
2. Click Lock. 
3. In the left menu, click on BGP Router Setup.
4. In the left menu, expand the Configuration Mode section and click on Switch to Advanced View.
5. Click the Edit button for the Advanced Settings. The Advanced Settings window opens.
6. Adjust the following parameters to influence how fast BGP reacts to connections which are down:
   
   • Keep Alive Timer – Default: 60 Recommended: 10
   • Hold Timer – Set to three times the Keep Alive Timer. Default: 180 Recommended: 30
7. Click OK.
8. Click Send Changes and Activate.

Step 5. Verify the BGP Service Configuration

On the CONTROL > Network page, verify that BGP routes are learned. Click the BGP tab and expand the relevant AS tree. It can take up to three minutes for new routes to be learned. The Origin column lists incomplete for direct attached or gateway routes or IGP routes learned via BGP including manually entered networks.

Local Firewall CONTROL > Network > BGP page:

Remote Firewall CONTROL > Network > BGP page:

Step 6. Create Access Rules for VPN Traffic

Create access rules on both local and remote firewalls to allow traffic from the learned networks through the VPN tunnel.