Google cloud gateway


heres a (final/working) config in case anyone else wants to do this:


crypto ikev2 proposal gcp-ikev2-proposal-1

encryption aes-cbc-128 aes-cbc-192 aes-cbc-256

integrity sha1 sha256 sha384 sha512

group 2 5 14 15 16


crypto ikev2 policy gcp-ikev2-policy-1

match fvrf any

proposal gcp-ikev2-proposal-1


crypto ikev2 profile gcp-ikev2-profile-1

match identity remote address gcp.gcp.gcp.gcp

identity local address

authentication remote pre-share key xxxxxxxxxxxx

authentication local pre-share key xxxxxxxxxxxx

lifetime 10800


crypto ipsec transform-set gcp-tset-1 esp-aes esp-sha-hmac

mode tunnel


crypto ipsec profile gcp-ipsec-profile-1

set transform-set gcp-tset-1

set pfs group14

set ikev2-profile gcp-ikev2-profile-1


interface Tunnel0

ip address

tunnel source

tunnel mode ipsec ipv4

tunnel destination gcp.gcp.gcp.gcp

tunnel protection ipsec profile gcp-ipsec-profile-1



And then configure BGP or maybe static routes as required.

After adding in the Tunnel0 interface config it just started working

straight away. So I guess my config was right all along, its just some

other aspect of IPSEC that wasnt happy with something missing… Yay

misleading debug output. :-/

Hope that helps someone else.


DH group X ; The Logjam Attack



“We further estimate that an academic team can break a 768-bit prime and that a nation-state can break a 1024-bit prime. Breaking the single, most common 1024-bit prime used by web servers would allow passive eavesdropping on connections to 18% of the Top 1 Million HTTPS domains. A second prime would allow passive decryption of connections to 66% of VPN servers and 26% of SSH servers. A close reading of published NSA leaks shows that the agency’s attacks on VPNs are consistent with having achieved such a break”.



Dit zijn de encryptie sterkte van de DH groepen:

  • DH Group 1: 768-bit group
  • DH Group 2: 1024-bit group
  • DH Group 5: 1536-bit group
  • DH Group 14: 2048-bit group
  • DH Group 15: 3072-bit group
  • DH Group 19: 256-bit elliptic curve group
  • DH Group 20: 384-bit elliptic curve group

IANA AS Numbers registry update

The IANA AS Numbers registry has been updated to reflect the allocation of the following block to ARIN in April 2015:


64198-64296 Assigned by ARIN 2015-04-29

394240-395164 Assigned by ARIN 2015-04-29


You can find the IANA AS Numbers registry at:


The allocation was made in accordance with the Policy for Allocation of ASN Blocks to Regional Internet Registries:


LNS question asr 1002

Take a look on this page (Cisco didn’t update it with new models for a long time )

The 1002 is limited to 12K
We didnt test the 1002-x but on a 1004 with ESP-20 and RP2 we cross the 32K L2TP sessions without a problem (48K and even 64K for short time )  but it is not recommended to cross the limits

> BTW, any ideas  on the first question? 🙂 that is, realistic numbers
> of active broadband users on a 1002 with a 24K license?
> > You may actually want to look at summarizing this. The best practice
> would
> > be to have a per-LNS pool (either locally managed or from RADIUS)
> > and advertise the summary from the LNS up to the network.
> > You may need to redistribute also connected routes for “fixed IP”
> services
> > where a user may have a custom IP from the RADIUS.
> >
> > Not summarizing means that every connection (and disconnection) is a
> > BGP update driving your CPU utilization across the BGP domain…

> >> Secondly, how does one handle running two LNS servers? How does the
> >> border router know which edge (LNS) to forward too for a particular
> >> IP?
> >
> >      I do it with iBGP where my router is advertising individual /32’s.
> > Yes it makes the route tables longer but it works well in my environment.
> > YMMV.

ME3600 config help, Q in Q

Under each Ethernet service instance you can define the following.

1) What frames arriving from the trunk port are to be associated with the particular service instance.
-that is accomplished with the “encapsulation” command.
-in your case “encapsulation dot1q 1048” dictates that service instance 10 will accept only frames with top VLAN tag 1048 followed by any subsequent VLAN tag(s) or data(IP packet).

2) Ingres VLAN tag manipulation removing, adding or translating 1 or 2 topmost tags.
-that is accomplished with the “rewrite” command.
-in your case pop-ing the first/single topmost VLAN tag.

3) Bridging operation aka what to do next with the frame (complete frame i.e. data and possibly adjacent/remaining VLAN tags).
-that is accomplished with the “bridge-domain” command.
– in your case the frame ends within bridge-domain 10.

IP interface for bridge-domain 10 is interface vlan 10.
But as Pshem already mentioned IP operation can be done only on untagged frames.

Though I don’t understand, how the service is supposed to operate, from your other email.
Because if the provider is creating a platform for the hub and spoke setup than they are responsible for pop-ing the top tag 1048.

> I am trying to configure an interface on a ME3600 to accept Q in Q
> from a provider. The p-vlan the provider is using is 1048 and they are
> carrying customer vlans (c-vlan) 1058-1098, one from each site. I’m
> new to the 3600 and have not done Q in Q on it yet. I’ve worked up
> this much of the config but it does not seem right. Can anyone give me
> some pointers or links to help me along ? I’ve only got one customer site configed, there will be 14.
> !
> vlan 1048
> !
> vlan 1058
> !
> interface GigabitEthernet0/6
>  description Windstream VLS IP.LVXX.xxxxxx..WCI.001  port-type nni
> switchport trunk allowed vlan none  switchport mode trunk  service
> instance
> 10 ethernet
>   encapsulation dot1q 1048
>   rewrite ingress tag pop 1 symmetric
>   bridge-domain 10
>  !
> !
> interface Vlan1048
>  description Windstream VLS
>  no ip address
> !
> interface Vlan1058
>  description WINDSTREAM-HOBBS
>  ip address xxx.xx.xx.1
> Thanks,
> James

1 2