Network Virtualization using Extreme Fabric Connect

Network Virtualization Using Extreme Fabric Connect
© 2019 Extreme Networks, Inc. All rights reserved. 109
Tip
The Extreme Networks Fabric Connect VPN software (e.g. running on XA1400 platforms)
supports the following IPsec parameters:
• IPSec Mode: Tunnel mode
• Key Exchange Protocol: IKEv2
• Authentication methods: Pre shared key
• IPSec Security Protocol: ESP
• ESP Encryption: aes128gcm16 sha256
With the Fabric Connect VPN software the XA1400 designated WAN port is hardened and can be directly
connected to the Internet without having to go through any firewall. Nevertheless, in many deployments
the Fabric Extend terminating XA1400 nodes will typically be connected behind the enterprise firewall and
in this case two possible deployment models exist. Either the Fabric Connect VPN software is configured
with a public Internet IP address (and no NAT is performed by the Firewall) or the Fabric Connect VPN
software is configured with private IP addressing and the Firewall perfoms NAT. In this latter case the
Fabric Connect VPN will need to be enabled for NAT Traversal (NAT-T) which will add an additional UDP
header to the IPsec ESP encapsulation as shown in Figure 53.
Figure 56 Fabric Extend over the Public Internet with IPSec
Caution
Extreme Networks Fabric Connect VPN software does not support NAT Traversal (NAT-T)
in the first release.
IP interfaces used by Fabric Extend to build the IP tunnels must be isolated from any other IP interface used
to carry VSN services above the Fabric. The correct design approach is to allocate a VRF for Fabric Extend