Kurusetra Computer Linux VPN MPLS. Budi Santosa,ST

Transkripsi

1 Kurusetra Computer Linux VPN MPLS Budi Santosa,ST

2 Daftar Isi OpenVPN...3 Konfigurasi Server VPN...4 Konfigurasi Static IP Client...5 Konfigurasi klien VPN Linux...5 OpenVPN GUI MS Windows XP/Vista...6 Konfigurasi Klien MS Windows...6 BGP Routing...9 External BGP...9 Internal BGP...10 MPLS Virtual WAN...11 Virtual Wide Area Networking...11 BGP Inside OpenVPN...12 Topologi Lengkap Virtual WAN...13 Konfigurasi Virtual WAN...14 PC Router Kantor Surabaya...14 PC Router Kantor Madiun

3 OpenVPN

4 Konfigurasi Server VPN Linux VPN MPLS apt get install openvpn openssh server cd /usr/share/doc/openvpn/examples/easy rsa/ cd 1.0/ vim vars export KEY_COUNTRY=ID export KEY_PROVINCE=JT export KEY_CITY=MAGETAN export KEY_ORG="Kurusetra Computer" export source./vars./clean all./build ca./build key server./build key server server./build key client1./build key client2./build key client3./build key client4./build dh cp keys/* /etc/openvpn/ cd /usr/share/doc/openvpn/examples/sample config files/ cp server.conf.gz /etc/openvpn/ cd /etc/openvpn/ gunzip server.conf.gz vim server.conf port 1194 proto udp dev tap ca ca.crt cert server.crt key server.key dh dh1024.pem server ifconfig pool persist ipp.txt client to client keepalive comp lzo persist key persist tun status openvpn status.log verb 3 cd /usr/share/doc/openvpn/examples/easy rsa/2.0/keys/ scp r client1.* root@ipclient1:/etc/openvpn/ scp r dh1024.pem root@ipclient1:/etc/openvpn/ scp r ca.* root@ipclient1:/etc/openvpn/

5 Konfigurasi Static IP Client Linux VPN MPLS vim /etc/openvpn/server.conf client-config-dir /etc/openvpn/ccd mkdir /etc/openvpn/ccd vim /etc/openvpn/ccd/client1 (nama file sesuai sertifikat) ifconfig-push /etc/init.d/openvpn restart Konfigurasi klien VPN Linux apt get install openvpn openssh server cd /usr/share/doc/openvpn/examples/sample config files/ cp client.conf /etc/openvpn/ cd /etc/openvpn vim client.conf client dev tun proto udp remote IP_VPN_SERVER 1194 resolv retry infinite nobind persist key persist tun ca ca.crt cert client1.crt key client1.key comp lzo verb

6 OpenVPN GUI MS Windows XP/Vista Konfigurasi Klien MS Windows 1. Download OpenVPN GUI di 2. Install OpenVPN GUI Sewaktu ada peringatan install driver Pilih Continue Anyway

7 3. Masuk ke Folder OpenVPN Sample Configuration Files dan copy file client.ovpn ke Folder OpenVPN configuration file directory. Bersama file sertifikat dan key nya. 4. Setelah di copy file hasilnya seperti dibawah ini 5. Edit file client.ovpn dan sesuaikan parameter beserta sertifikatnya client dev tap proto udp remote ca ca.crt cert magetan.crt key magetan.key

8 6. Kemudian pada taskbar MS Windows sebelah kanan bawah klik kanan icon OpenVPN dan pilih connect

9 BGP Routing External BGP Router A (IP: ) hostname router_a router bgp router-id network /24 network /24 neigbor remote-as 65002!#Router D neigbor remote-as 65001!#Router C neigbor remote-as 65000!#Router B ibgp Router C ( ) hostname router_c router bgp router-id network /24 neigbor remote-as 65002!#Router D neigbor remote-as 65000!#Router A Router D ( ) hostname router_d router bgp router-id network /24 neigbor remote-as 65001!#Router C neigbor remote-as 65002!#Router E ibgp neigbor remote-as 65000!#Router A

10 Internal BGP Linux VPN MPLS Router B ( ) hostname router_d router bgp router-id network /24 network /24 neigbor remote-as 65000!#Router A Router E ( ) hostname router_d router bgp router-id network /24 network /24 neigbor remote-as 65002!#Router D Router F ( ) hostname router_d router bgp router-id network /24 network /24 neigbor remote-as 65002!#Router D

11 MPLS Virtual WAN Virtual Wide Area Networking Wide Area Networking adalah suatu area luas (kota / wilayah) yang berbeda geografis yang saling terhubung satu dengan lain dalam suatu topologi jaringan komputer. Pada artikel ini kita akan membahas mengenai Virtual WAN (Virtual Wide Area Networking), yang bertujuan menghubungkan beberapa subnet wilayah, kota ataupun kantor perusahaan menjadi satu topologi. Subnet yang akan kita hubungkan menggunakan alamat IP Private 192.xxx.xxx.xxx yang tidak dikenal oleh internet. Jadi Virtual WAN lebih ditujukan untuk pemakaian pribadi (personal atau corporate). Hubungan antar subnet mirip dengan internet atau WAN, pengguna dapat langsung melakukan sharing data antar komputer beda subnet, printer dan pemanfaatan aplikasi. Gambar dibawah ini merupakan contoh topologi subnet kantor surabaya, madiun dan ponorogo, kita akan menggabungkan menjadi satu topologi Virtual WAN menggunakan kombinasi OpenVPN dan BGP Routing Protocol

12 BGP Inside OpenVPN Linux VPN MPLS Diagram dibawah ini menunjukkan pemanfaatan teknologi Tunneling VPN (garis biru) untuk membawa BGP routing protocol yang menghubungkan jaringan antar subnet. Setiap AS Number (ASN) dihubungkan oleh jalur tunnel VPN, paket data routing BGP yang melintas selalu dibungkus (encapsulation) dan di enkripsi (encryption), sehingga meningkatkan keamanan komunikasi data antar subnet. Madiun = ASN 1003 Ponorogo = ASN 1002 Surabaya = ASN

13 Topologi Lengkap Virtual WAN Linux VPN MPLS Gambar dibawah ini menunjukkan penggabungan topologi antar subnet dengan diagram BGP routing inside OpenVPN. Setiap perangkat PC Router Linux terpasang aplikasi OpenVPN dan Quagga Routing Daemon, hanya saja pada kantor surabaya router kita fungsikan sebagai OpenVPN Server dan harus memakai IP Publik Statis. Koneksi kantor madiun maupun ponorogo bisa memakai koneksi IP dinamis dan kita fungsikan sebagai VPN Client. Berikut ini data koneksi setiap PC Router. Kantor Surabaya Koneksi Internet : Dedicated Leased Line 512kbps 1Mbps IP Publik : Subnet LAN : /24 IP VPN : ASN : 1001 Kantor Madiun Koneksi Internet : Telkom Speedy Unlimited IP Telkom Speedy : (IP dinamis) Subnet LAN : /24 IP VPN : ASN : 1003 Kantor Ponorogo Koneksi Internet : FastNet First Media IP FastNet : (IP dinamis) Subnet LAN : /24 IP VPN : ASN :

14 Konfigurasi Virtual WAN PC Router Kantor Surabaya vim /etc/openvpn/server.conf (OpenVPN Server) dev tap ca ca.crt cert server.crt key server.key # This file should be kept secret dh dh1024.pem server ifconfig pool persist ipp.txt client to client duplicate cn keepalive persist key persist tun status openvpn status.log verb 3 vim /etc/quagga/daemons zebra = yes bgpd = yes ospfd = no ospf6d = no ripd = no ripngd = no isisd = no

15 vim /etc/quagga/debian.conf vtysh_enable=yes zebra_options=" daemon" bgpd_options=" daemon" ospfd_options=" daemon" ospf6d_options=" daemon A ::1" ripd_options=" daemon" ripngd_options=" daemon A ::1" isisd_options=" daemon A " vim /etc/quagga/bgpd.conf hostname bgpd password zebra enable password ardelindo log stdout router bgp 1001 bgp router id network /24 network /24 neighbor remote as 1003 neighbor remote as 1002 line vty ############################# ##TEST KONFIGURASI ##KANTOR SURABAYA ############################# Router> show ip route Codes: K kernel route, C connected, S static, R RIP, O OSPF, I ISIS, B BGP, > selected route, * FIB route K>* /0 via , eth1 C>* /24 is directly connected, tap0 C>* /25 is directly connected, eth1 C>* /8 is directly connected, lo C>* /24 is directly connected, eth3 K>* /32 via , tap0 B>* /24 [20/0] via , tap0, 03:29:27 B>* /24 [20/0] via , tap0, 15:03:25 bgpd> show ip bgp neighbors BGP neighbor is , remote AS 1003, local AS 1001, external link BGP version 4, remote router ID BGP state = Established, up for 15:05:21 Last read 00:00:21, hold time is 180, keepalive interval is 60 seconds Neighbor capabilities: Route refresh: advertised and received(old & new) Address family IPv4 Unicast: advertised and received Message statistics: Inq depth is 0 Outq depth is 0 Sent Rcvd Opens: 10 2 Notifications: 3 5 Updates: 15 5 Keepalives: Route Refresh: 0 0 Capability: 0 0 Total: Minimum time between advertisement runs is 30 seconds

16 For address family: IPv4 Unicast Community attribute sent to this neighbor(both) 1 accepted prefixes Connections established 5; dropped 3 Last reset 1d00h58m, due to BGP Notification send Local host: , Local port: 179 Foreign host: , Foreign port: Nexthop: Nexthop global: fe80::2ff:79ff:fe7c:31a

17 ############################# ##TEST KONFIGURASI ##KANTOR MADIUN ############################# Router> show ip route Codes: K kernel route, C connected, S static, R RIP, O OSPF, I ISIS, B BGP, > selected route, * FIB route K>* /0 via , eth1 O /24 [110/10] is directly connected, tap0, 1d00h34m C>* /24 is directly connected, tap0 B>* /24 [20/0] via , tap0, 14:29:07 C>* /8 is directly connected, lo B>* /24 [20/0] via , tap0, 14:29:07 B /24 [20/0] via , tap0, 02:54:53 C>* /24 is directly connected, eth1 O /24 [110/10] is directly connected, eth2, 1d00h34m C>* /24 is directly connected, eth2 bgpd> show ip bgp summary BGP router identifier , local AS number 1003 RIB entries 7, using 448 bytes of memory Peers 1, using 2512 bytes of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd :32:29 3 Total number of neighbors 1 bgpd> show ip bgp neighbors BGP neighbor is , remote AS 1001, local AS 1003, external link BGP version 4, remote router ID BGP state = Established, up for 14:33:09 Last read 00:00:56, hold time is 180, keepalive interval is 60 seconds Neighbor capabilities: Route refresh: advertised and received(old & new) Address family IPv4 Unicast: advertised and received Message statistics: Inq depth is 0 Outq depth is 0 Sent Rcvd Opens: 7 3 Notifications: 7 0 Updates: 4 12 Keepalives: Route Refresh: 0 0 Capability: 0 0 Total: Minimum time between advertisement runs is 30 seconds For address family: IPv4 Unicast Community attribute sent to this neighbor(both) 3 accepted prefixes Connections established 4; dropped 0 Last reset never Local host: , Local port: Foreign host: , Foreign port: 179 Nexthop: Nexthop global: fe80::2ff:9dff:fecd:a17b Nexthop local: :: BGP connection: non shared network Read thread: on Write thread: off

18 bgpd> show ip bgp summary BGP router identifier , local AS number 1003 RIB entries 7, using 448 bytes of memory Peers 1, using 2512 bytes of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd :07:23 3 Total number of neighbors