How to advertise routes to IPSec tunnels in OSPF using Cisco IOS

Question

I have Cisco 1800 series router (running C181X-ADVIPSERVICESK9-M) with lots of IPSec tunnels. I want to add this router to OSPF and configure it to advertise routes to remote subnets accessible via IPSec tunnels (e.g. if I have tunnel VPN1 with access list that allows all traffic from my network to 10.20.30.0/24 go through that tunnel, I want router to advertise route to 10.20.30.0/24 in OSPF). Can this be achieved on Cisco IOS without explicitly adding routes to those remote subnets?

Answer 1

If I have understood correctly I believe a combination of Reverse Route Injection and OSPF redistribution with do what you are after.

Reverse Route Injection dynamically creates static routes for you VPN tunnels.

Redistribution will advertise the static routes via OSPF (or other routing protocols)

I am currently doing this way

Answer 2

The cleanest way to use a routing protocol over VPN is to use IPSec over GRE tunnels, you set up a simple point-to-point GRE tunnel with IPSec enabled and only allow GRE traffic in the IPSec tunnel. Then advertise OSPF inside GRE.

This Cisco article has got a few good examples:

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800a43f6.shtml

Answer 3

Normal OSPF mode for a Cisco device is broadcast mode - this won't work over the tunnel.

What you need is point-to-point peering - it gets rid of the automatic smoothness of broadcast mode, but still does the job.

On the interface used for the traffic:

ip ospf network point-to-multipoint non-broadcast

And, in the ospf router config, manually specify the remote OSPF neighbor:

neighbor 10.x.x.1