DMVPN - record PNDH, IPsec

Hi all

I was wondering if rays PNDH entries must be processed by the hub before the tunnel IPsec may form between the hub and the spokes.

Any ideas will be appreciated.

Thank you

David Lai

David,

PNDH and IPSec go hand in hand.

Infact the first IPSec packets to be exchanged between the spokes and hubs are PNDH records and recording answers.

Once PNDH successful registration, routing neighborships come and you'll have full connectivity between Hub and Spoke.

Avinash.

Tags: Cisco Security

Similar Questions

DMVPN without PNDH

Hi all

The scenario, I am trying to solve is for a product of managed internet access we build where we want the 867VAE to the roll on a mass of small sites scale.

For each of our clients at the present time we have them all a DMVPN complete with talking to talking about a firewall with the exception of internal networks (so we can see our customers from several sites, but customers cannot see each other).

The 867VAE does not yet support the DMVPN, but we still need a simple remote management/access solution.

My thought is:

The head end

1. create love No. PNDH interface, but still activate encryption

2. enable the RIP (only choice on 867VAE)

867VAE CPE:

1. create the TPP WILL interface with encryption and RIP.

Before that I spend hours testing this - can we see a reason why it wouldn't work?

Here, our requirement, is that we want full visibility of the network to the Subscriber (PC / servers) so there need encryption, but we have plenty of voices on this or anything which would need all the DMVPN features.

Thank you

Scott

Scott,

Config and similar to this concept:

https://supportforums.Cisco.com/thread/2089906

And you can run RIP on top.

M.

DMVPN & GRE over IPsec on the same physical interface

Dear all,

I am setting up two routers WAN, each router wan has a physical interface connecting to the branches and regional office by using the same provider.

We will use the GRE over IPsec to connect to Office regional and DMVPN + EIGRP to branches.

I would like to know if it is possible to configure tunnels for GRE over IPsec and DMVPN + EIGRP using the same source physical interface.

Good answer, it's an urgent request and your response is much appreciated.

Kind regards

Hi Savio,

It should work. We can configure dmvpn and gre-over-ipsec on ASA using the same physical interface.

Kind regards

NGO

DMVPN and PNDH

Hi friends,

I would like to ask questions about your opinions.

Looking at a package of PNDH Traffic Indication in the section of the Extension of PNDH authentication-> Unit Extension Data, that I can see, there is a Source address field and as a value, there is always 99.105.115.99.

Please, see the attached screenshot.

Could someone give any idea what is this source address and why there is always the same value and significance of this value.

Thank you!

Best regards

Yavor

Ahh :) Well well good job your problem! Also, thank you for taking the time to come back and post the solution here. (+ 5 from me).

Now, given that your issue is resolved, you must mark the thread as "answered" ;)

DMVPN and IPsec CLIENT?

Hello

I was wondering if it was possible to use CRYPTOGRAPHY even for both: DMVPN and CLIENT IPsec?

To make it work, I have to use 1 crypto for the DMVPN and 1 crypto for IPsec, both systems operate on the same router, my router TALK can connect to my HUB router and my computer can connect to the router "HUB" via an IPsec tunnel.

Is their any way to make it easier, instead of doing configs in a single router for more or less the same work?

My stitching question may be stupid, sorry for that, I'm still learning, and I love it

Here below the full work DMVPN + IPsec:

Best regards

Didier

ROUTER1841 #sh run

Building configuration...

Current configuration: 9037 bytes

!

! Last configuration change to 21:51:39 gmt + 1 Monday February 7, 2011 by admin

! NVRAM config last updated at 21:53:07 gmt + 1 Monday February 7, 2011 by admin

!

version 12.4

horodateurs service debug datetime localtime

Log service timestamps datetime msec

encryption password service

!

hostname ROUTER1841

!

boot-start-marker

boot-end-marker

!

forest-meter operation of syslog messages

logging buffered 4096 notifications

enable password 7 05080F1C2243

!

AAA new-model

!

!

AAA authentication banner ^ C

THIS SYSTEM IS ONLY FOR THE USE OF AUTHORIZED FOR OFFICIAL USERS

^ C

AAA authentication login userauthen local

AAA authorization groupauthor LAN

!

!

AAA - the id of the joint session

clock time zone gmt + 1 1 schedule

clock daylight saving time gmt + 2 recurring last Sun Mar 02:00 last Sun Oct 03:00

dot11 syslog

no ip source route

!

!

No dhcp use connected vrf ip

DHCP excluded-address IP 192.168.10.1

DHCP excluded-address IP 192.168.20.1

DHCP excluded-address IP 192.168.30.1

DHCP excluded-address IP 192.168.100.1

IP dhcp excluded-address 192.168.1.250 192.168.1.254

!

IP dhcp pool vlan10

import all

network 192.168.10.0 255.255.255.0

default router 192.168.10.1

lease 5

!

IP dhcp pool vlan20

import all

network 192.168.20.0 255.255.255.0

router by default - 192.168.20.1

lease 5

!

IP dhcp pool vlan30

import all

network 192.168.30.0 255.255.255.0

default router 192.168.30.1

!

IP TEST dhcp pool

the host 192.168.100.20 255.255.255.0

0100.2241.353f.5e client identifier

!

internal IP dhcp pool

network 192.168.100.0 255.255.255.0

Server DNS 192.168.100.1

default router 192.168.100.1

!

IP dhcp pool vlan1

network 192.168.1.0 255.255.255.0

Server DNS 8.8.8.8

default router 192.168.1.1

lease 5

!

dhcp MAC IP pool

the host 192.168.10.50 255.255.255.0

0100.2312.1c0a.39 client identifier

!

IP PRINTER dhcp pool

the host 192.168.10.20 255.255.255.0

0100.242b.4d0c.5a client identifier

!

MLGW dhcp IP pool

the host 192.168.10.10 255.255.255.0

address material 0004.f301.58b3

!

pool of dhcp IP pc-vero

the host 192.168.10.68 255.255.255.0

0100.1d92.5982.24 client identifier

!

IP dhcp pool vlan245

import all

network 192.168.245.0 255.255.255.0

router by default - 192.168.245.1

!

dhcp VPN_ROUTER IP pool

0100.0f23.604d.a0 client identifier

!

dhcp QNAP_NAS IP pool

the host 192.168.10.100 255.255.255.0

0100.089b.ad17.8f client identifier

name of the client QNAP_NAS

!

!

IP cef

no ip bootp Server

IP domain name dri

host IP SW12 192.168.1.252

host IP SW24 192.168.1.251

IP host tftp 192.168.10.50

host IP of Router_A 192.168.10.5

host IP of Router_B 10.0.1.1

IP ddns update DynDNS method

HTTP

Add http://dri66: [email protected] / * *//nic/update?system=dyndns&hostname=mlgw.dyndns.info&myip=[email protected] / * //nic/update?system=dyndns&hostname=mlgw.dyndns.info&myip=

maximum interval 1 0 0 0

minimum interval 1 0 0 0

!

NTP 66.27.60.10 Server

!

Authenticated MultiLink bundle-name Panel

!

!

Flow-Sampler-map mysampler1

Random mode one - out of 100

!

Crypto pki trustpoint TP-self-signed-2996752687

enrollment selfsigned

name of the object cn = IOS - Self - signed - certificate - 2996752687

revocation checking no

rsakeypair TP-self-signed-2996752687

!

!

VTP version 2

username Admin privilege 15 secret 5 $1$ gAFQ$ 2ecAHSYEU9g7b6WYuTY9G.

username cisco password 7 02050D 480809

Archives

The config log

hidekeys

!

!

crypto ISAKMP policy 3

BA 3des

preshared authentication

Group 2

!

crypto ISAKMP policy 10

md5 hash

preshared authentication

ISAKMP crypto cisco123 key address 0.0.0.0 0.0.0.0

!

ISAKMP crypto client configuration group 3000client

key cisco123

DNS 8.8.8.8

dri.eu field

pool VPNpool

ACL 150

!

!

Crypto ipsec transform-set strong esp-3des esp-md5-hmac

Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

!

Profile cisco ipsec crypto

define security-association life seconds 120

transformation-strong game

!

!

Crypto-map dynamic dynmap 10

Set transform-set RIGHT

!

!

map clientmap client to authenticate crypto list userauthen

card crypto clientmap isakmp authorization list groupauthor

client configuration address map clientmap crypto answer

10 ipsec-isakmp crypto map clientmap Dynamics dynmap

!

!

!

property intellectual ssh time 60

property intellectual ssh authentication-2 retries

IP port ssh 8096 Rotary 1

property intellectual ssh version 2

!

!

!

interface Loopback0

IP 192.66.66.66 255.255.255.0

!

interface Tunnel0

172.16.0.1 IP address 255.255.255.0

no ip redirection

IP mtu 1440

no ip next-hop-self eigrp 90

property intellectual PNDH authentication cisco123

dynamic multicast of IP PNDH map

PNDH network IP-1 id

No eigrp split horizon ip 90

source of tunnel FastEthernet0/0

multipoint gre tunnel mode

0 button on tunnel

Cisco ipsec protection tunnel profile

!

interface FastEthernet0/0

DMZ description

IP ddns update hostname mlgw.dyndns.info

IP ddns update DynDNS

DHCP IP address

no ip unreachable

no ip proxy-arp

NAT outside IP

IP virtual-reassembly

automatic duplex

automatic speed

clientmap card crypto

!

interface FastEthernet0/0,241

Description VLAN 241

encapsulation dot1Q 241

DHCP IP address

IP access-group dri-acl-in in

NAT outside IP

IP virtual-reassembly

No cdp enable

!

interface FastEthernet0/0.245

encapsulation dot1Q 245

DHCP IP address

IP access-group dri-acl-in in

NAT outside IP

IP virtual-reassembly

No cdp enable

!

interface FastEthernet0/1

Description INTERNAL ETH - LAN$

IP 192.168.100.1 address 255.255.255.0

no ip proxy-arp

IP nat inside

IP virtual-reassembly

Shutdown

automatic duplex

automatic speed

!

interface FastEthernet0/0/0

switchport access vlan 10

spanning tree portfast

!

interface FastEthernet0/0/1

switchport access vlan 245

spanning tree portfast

!

interface FastEthernet0/0/2

switchport access vlan 30

spanning tree portfast

!

interface FastEthernet0/0/3

switchport mode trunk

!

interface Vlan1

IP address 192.168.1.250 255.255.255.0

IP nat inside

IP virtual-reassembly

!

interface Vlan10

IP 192.168.10.1 255.255.255.0

IP nat inside

IP virtual-reassembly

!

interface Vlan20

address 192.168.20.1 255.255.255.0

IP nat inside

IP virtual-reassembly

!

Vlan30 interface

192.168.30.1 IP address 255.255.255.0

IP nat inside

IP virtual-reassembly

!

interface Vlan245

IP 192.168.245.1 255.255.255.0

IP nat inside

IP virtual-reassembly

!

Router eigrp 90

network 172.16.0.0

network 192.168.10.0

No Auto-resume

!

IP pool local VPNpool 172.16.1.1 172.16.1.100

IP forward-Protocol ND

no ip address of the http server

local IP http authentication

IP http secure server

!

IP flow-cache timeout idle 130

IP flow-cache timeout active 20

cache IP flow-aggregation prefix

cache timeout idle 400

active cache expiration time 25

!

!

overload of IP nat inside source list 170 interface FastEthernet0/0

overload of IP nat inside source list interface FastEthernet0/0.245 NAT1

IP nat inside source static tcp 192.168.10.10 80 interface FastEthernet0/0 8095

!

access-list 150 permit ip 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255

access-list 170 refuse ip 192.168.10.0 0.0.0.255 172.16.0.0 0.0.0.255

access-list 170 refuse ip 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255

access-list 170 permit ip 192.168.10.0 0.0.0.255 any

access-list 180 deny ip 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255

access-list 180 permit ip 192.168.10.0 0.0.0.255 any

not run cdp

!

!

!

route NAT allowed 10 map

corresponds to the IP 180

!

!

!

control plan

!

exec banner ^ C

WELCOME YOU ARE NOW LOGED IN

^ C

connection of the banner ^ C

WARNING!

IF YOU ARE NOT:

Didier Ribbens

Please leave NOW!

YOUR IP and MAC address will be LOGGED.

^ C

!

Line con 0

Speed 115200

line to 0

line vty 0 4

access-class 5

privilege level 15

Rotary 1

transport input telnet ssh

line vty 5 15

access-class 5

Rotary 1

!

Scheduler allocate 20000 1000

end

Didier,

Some time ago, I wrote a bit on VT, you should be able to find information about the server ezvpn DVTI it.

https://supportforums.Cisco.com/community/NetPro/security/VPN/blog/2010/12/08/advantages-of-VTI-configuration-for-IPSec-tunnels

The configuartion you have right now is the way to strives for ezvpn, with the new way DMVPN (protection of tunnel).

If it is true for the most part, it is best to go on the learning curve Moose and go everythign new configuration.

With EZVPN you can always assign IP from the pool by group ezvpn or external authorization ;-)

Anyway let me know if you face any problems.

Marcin

DMVPN, PNDH: What certification cisco?

Hi all

I want to know that DMVPN and PNDH reports to which cisco certification?

Eve.

Hello

It is the CCIE Security.

https://learningnetwork.Cisco.com/docs/doc-5273

There will be a link which gives the review program.

I hope this helps.

Kind regards

Anisha.

P.S.: Please mark this thread as answered if you feel that your query is resolved. Note the useful messages.

DMVPN spoke of issues after migration double ISR2 3925 hub to ASR-1001 X

Hello world

After our hub solution migration DMVPN double ISR2 3925 to ASR - 1001 X (running asr1001x - universalk9.03.12.03.S.154 - 2.S3 - std.SPA.bin) we started to have some problems with tunnels rays beat (which goes up and down) and sometimes never came.

Running 'show dmvpn' speak it is stuck in State PNDH to our hub. To solve the problem, we run 'stop' and then 'non-stop' on the tunnel interface to actually speak that DMVPN Monte. Also runs "clear encryption session " on the shelf often solves the problem. So, it seems that the question has something to do with IPSEC.

When the problem occurred, and then debug crypto ipsec, crypto, crypto isakmp and crypto engine socket the following can be seen on the hub:

 Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):Sending NOTIFY DPD/R_U_THERE protocol 1 spi 140130067548488, message ID = 629121681 Jun 25 10:01:41 SUMMERT: ISAKMP:(46580): seq. no 0x64B2238C Jun 25 10:01:41 SUMMERT: ISAKMP:(46580): sending packet to  my_port 500 peer_port 500 (I) QM_IDLE Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):Sending an IKE IPv4 Packet. Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):purging node 629121681 Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_IM_ALIVE Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE Jun 25 10:01:41 SUMMERT: ISAKMP (46580): received packet from  dport 500 sport 500 ISP1-DMVPN (I) QM_IDLE Jun 25 10:01:41 SUMMERT: ISAKMP: set new node 3442686097 to QM_IDLE Jun 25 10:01:41 SUMMERT: ISAKMP:(46580): processing HASH payload. message ID = 3442686097 Jun 25 10:01:41 SUMMERT: ISAKMP:(46580): processing NOTIFY DPD/R_U_THERE_ACK protocol 1 spi 0, message ID = 3442686097, sa = 0x7F72986867D0 Jun 25 10:01:41 SUMMERT: ISAKMP:(46580): DPD/R_U_THERE_ACK received from peer , sequence 0x64B2238C Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):deleting node 3442686097 error FALSE reason "Informational (in) state 1" Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY Jun 25 10:01:41 SUMMERT: ISAKMP:(46580):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE Jun 25 10:01:42 SUMMERT: IPSEC: delete incomplete sa: 0x7F729923A438 Jun 25 10:01:42 SUMMERT: IPSEC(send_delete_notify_kmi): not sending KEY_ENGINE_DELETE_SAS Jun 25 10:01:42 SUMMERT: ISAKMP:(46580):purging node 1111296046 Jun 25 10:01:44 SUMMERT: ISAKMP (46580): received packet from  dport 500 sport 500 ISP1-DMVPN (I) QM_IDLE Jun 25 10:01:44 SUMMERT: ISAKMP: set new node 928225319 to QM_IDLE Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing HASH payload. message ID = 928225319 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing SA payload. message ID = 928225319 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Checking IPSec proposal 1 Jun 25 10:01:44 SUMMERT: ISAKMP: transform 1, ESP_AES Jun 25 10:01:44 SUMMERT: ISAKMP: attributes in transform: Jun 25 10:01:44 SUMMERT: ISAKMP: encaps is 2 (Transport) Jun 25 10:01:44 SUMMERT: ISAKMP: SA life type in seconds Jun 25 10:01:44 SUMMERT: ISAKMP: SA life duration (basic) of 3600 Jun 25 10:01:44 SUMMERT: ISAKMP: SA life type in kilobytes Jun 25 10:01:44 SUMMERT: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0 Jun 25 10:01:44 SUMMERT: ISAKMP: authenticator is HMAC-SHA Jun 25 10:01:44 SUMMERT: ISAKMP: key length is 256 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):atts are acceptable. Jun 25 10:01:44 SUMMERT: CRYPTO_SS(TUNNEL SEC): Active open, socket info: local  /255.255.255.255/0, remote  /255.255.255.255/0, prot 47, ifc Tu3300 Jun 25 10:01:44 SUMMERT: IPSEC(recalculate_mtu): reset sadb_root 7F7292E64990 mtu to 1500 Jun 25 10:01:44 SUMMERT: CRYPTO_SS(TUNNEL SEC): Sending Socket Ready message Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing NONCE payload. message ID = 928225319 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing ID payload. message ID = 928225319 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing ID payload. message ID = 928225319 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):QM Responder gets spi Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Node 928225319, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Old State = IKE_QM_READY New State = IKE_QM_SPI_STARVE Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Node 928225319, Input = IKE_MESG_INTERNAL, IKE_GOT_SPI Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Old State = IKE_QM_SPI_STARVE New State = IKE_QM_IPSEC_INSTALL_AWAIT Jun 25 10:01:44 SUMMERT: IPSEC(crypto_ipsec_sa_find_ident_head): reconnecting with the same proxies and peer  Jun 25 10:01:44 SUMMERT: IPSEC(crypto_ipsec_update_ident_tunnel_decap_oce): updating profile-shared Tunnel3300 ident 7F7298B2BF80 with lookup_oce 7F7296BF5440 Jun 25 10:01:44 SUMMERT: IPSEC(create_sa): sa created, (sa) sa_dest= , sa_proto= 50, sa_spi= 0x14F40C56(351538262), sa_trans= esp-aes 256 esp-sha-hmac , sa_conn_id= 27873 sa_lifetime(k/sec)= (4608000/3600), (identity) local= :0, remote= :0, local_proxy= /255.255.255.255/47/0, remote_proxy= /255.255.255.255/47/0 Jun 25 10:01:44 SUMMERT: IPSEC(create_sa): sa created, (sa) sa_dest= , sa_proto= 50, sa_spi= 0x3B4731D7(994521559), sa_trans= esp-aes 256 esp-sha-hmac , sa_conn_id= 27874 sa_lifetime(k/sec)= (4608000/3600), (identity) local= :0, remote= :0, local_proxy= /255.255.255.255/47/0, remote_proxy= /255.255.255.255/47/0 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Received IPSec Install callback... proceeding with the negotiation Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Successfully installed IPSEC SA (SPI:0x14F40C56) on Tunnel3300 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): sending packet to  my_port 500 peer_port 500 (I) QM_IDLE Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Sending an IKE IPv4 Packet. Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Node 928225319, Input = IKE_MESG_FROM_IPSEC, IPSEC_INSTALL_DONE Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Old State = IKE_QM_IPSEC_INSTALL_AWAIT New State = IKE_QM_R_QM2 Jun 25 10:01:44 SUMMERT: ISAKMP (46580): received packet from  dport 500 sport 500 ISP1-DMVPN (I) QM_IDLE Jun 25 10:01:44 SUMMERT: ISAKMP: set new node 1979798297 to QM_IDLE Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing HASH payload. message ID = 1979798297 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): processing NOTIFY PROPOSAL_NOT_CHOSEN protocol 3 spi 351538262, message ID = 1979798297, sa = 0x7F72986867D0 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580): deleting spi 351538262 message ID = 928225319 Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):deleting node 928225319 error TRUE reason "Delete Larval" Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):peer does not do paranoid keepalives. Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Enqueued KEY_MGR_DELETE_SAS for IPSEC SA (SPI:0x3B4731D7) Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):deleting node 1979798297 error FALSE reason "Informational (in) state 1" Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY Jun 25 10:01:44 SUMMERT: ISAKMP:(46580):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE Jun 25 10:01:44 SUMMERT: IPSEC: delete incomplete sa: 0x7F729923A340 Jun 25 10:01:44 SUMMERT: IPSEC(key_engine_delete_sas): delete SA with spi 0x3B4731D7 proto 50 for  Jun 25 10:01:44 SUMMERT: IPSEC(update_current_outbound_sa): updated peer  current outbound sa to SPI 0 Jun 25 10:01:44 SUMMERT: IPSEC(send_delete_notify_kmi): not sending KEY_ENGINE_DELETE_SAS Jun 25 10:01:44 SUMMERT: CRYPTO_SS(TUNNEL SEC): Sending request for CRYPTO SS CLOSE SOCKET

 #sh pl ha qf ac fe ipsec data drop ------------------------------------------------------------------------ Drop Type Name Packets ------------------------------------------------------------------------ 3 IN_US_V4_PKT_FOUND_IPSEC_NOT_ENABLED 127672 19 IN_OCT_ANTI_REPLAY_FAIL 13346 20 IN_UNEXP_OCT_EXCEPTION 4224 33 OUT_V4_PKT_HIT_IKE_START_SP 1930 62 IN_OCT_MAC_EXCEPTION 9 #sh plat hard qfp act stat drop | e _0_ ------------------------------------------------------------------------- Global Drop Stats Packets Octets ------------------------------------------------------------------------- Disabled 1 82 IpFragErr 170536 246635169 IpTtlExceeded 4072 343853 IpsecIkeIndicate 1930 269694 IpsecInput 145256 30071488 Ipv4Acl 2251965 215240194 Ipv4Martian 6248 692010 Ipv4NoAdj 43188 7627131 Ipv4NoRoute 278 27913 Ipv4Unclassified 6 378 MplsNoRoute 790 69130 MplsUnclassified 1 60 ReassTimeout 63 10156 ServiceWireHdrErr 2684 585112

In addition, after you run "logging dmvpn rate-limit 20' on the hub

 %DMVPN-3-DMVPN_NHRP_ERROR: Tunnel292: NHRP Encap Error for Resolution Request , Reason: protocol generic error (7) on (Tunnel:  NBMA: )

On the talks both the following can be seen debugging as well:

 *Jun 25 09:17:26.884: ISAKMP:(1032): sitting IDLE. Starting QM immediately (QM_IDLE ) *Jun 25 09:17:26.884: ISAKMP:(1032):beginning Quick Mode exchange, M-ID of 1599359281 *Jun 25 09:17:26.884: ISAKMP:(1032):QM Initiator gets spi *Jun 25 09:17:26.884: ISAKMP:(1032): sending packet to  my_port 500 peer_port 500 (R) QM_IDLE *Jun 25 09:17:26.884: ISAKMP:(1032):Sending an IKE IPv4 Packet. *Jun 25 09:17:26.884: ISAKMP:(1032):Node 1599359281, Input = IKE_MESG_INTERNAL, IKE_INIT_QM *Jun 25 09:17:26.884: ISAKMP:(1032):Old State = IKE_QM_READY New State = IKE_QM_I_QM1 *Jun 25 09:17:26.940: ISAKMP (1032): received packet from  dport 500 sport 500 Global (R) QM_IDLE *Jun 25 09:17:26.940: ISAKMP:(1032): processing HASH payload. message ID = 1599359281 *Jun 25 09:17:26.940: ISAKMP:(1032): processing SA payload. message ID = 1599359281 *Jun 25 09:17:26.940: ISAKMP:(1032):Checking IPSec proposal 1 *Jun 25 09:17:26.940: ISAKMP: transform 1, ESP_AES *Jun 25 09:17:26.940: ISAKMP: attributes in transform: *Jun 25 09:17:26.940: ISAKMP: encaps is 2 (Transport) *Jun 25 09:17:26.940: ISAKMP: SA life type in seconds *Jun 25 09:17:26.940: ISAKMP: SA life duration (basic) of 3600 *Jun 25 09:17:26.940: ISAKMP: SA life type in kilobytes *Jun 25 09:17:26.940: ISAKMP: SA life duration (VPI) of 0x0 0x46 0x50 0x0 *Jun 25 09:17:26.940: ISAKMP: authenticator is HMAC-SHA *Jun 25 09:17:26.940: ISAKMP: key length is 256 *Jun 25 09:17:26.940: ISAKMP:(1032):atts are acceptable. *Jun 25 09:17:26.940: IPSEC(ipsec_process_proposal): proxy identities not supported *Jun 25 09:17:26.940: ISAKMP:(1032): IPSec policy invalidated proposal with error 32 *Jun 25 09:17:26.940: ISAKMP:(1032): phase 2 SA policy not acceptable! (local  remote ) *Jun 25 09:17:26.940: ISAKMP: set new node -1745931191 to QM_IDLE *Jun 25 09:17:26.940: ISAKMP:(1032):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3 spi 834718720, message ID = 2549036105 *Jun 25 09:17:26.940: ISAKMP:(1032): sending packet to  my_port 500 peer_port 500 (R) QM_IDLE *Jun 25 09:17:26.940: ISAKMP:(1032):Sending an IKE IPv4 Packet. *Jun 25 09:17:26.940: ISAKMP:(1032):purging node -1745931191 *Jun 25 09:17:26.940: ISAKMP:(1032):deleting node 1599359281 error TRUE reason "QM rejected" *Jun 25 09:17:26.940: ISAKMP:(1032):Node 1599359281, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH *Jun 25 09:17:26.940: ISAKMP:(1032):Old State = IKE_QM_I_QM1 New State = IKE_QM_I_QM1 *Jun 25 09:17:34.068: ISAKMP (1032): received packet from  dport 500 sport 500 Global (R) QM_IDLE *Jun 25 09:17:34.068: ISAKMP: set new node 1021264821 to QM_IDLE *Jun 25 09:17:34.072: ISAKMP:(1032): processing HASH payload. message ID = 1021264821 *Jun 25 09:17:34.072: ISAKMP:(1032): processing NOTIFY DPD/R_U_THERE protocol 1 spi 0, message ID = 1021264821, sa = 0x32741028 *Jun 25 09:17:34.072: ISAKMP:(1032):deleting node 1021264821 error FALSE reason "Informational (in) state 1" *Jun 25 09:17:34.072: ISAKMP:(1032):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY *Jun 25 09:17:34.072: ISAKMP:(1032):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Jun 25 09:17:34.072: ISAKMP:(1032):DPD/R_U_THERE received from peer , sequence 0x64B2279D *Jun 25 09:17:34.072: ISAKMP: set new node 716440334 to QM_IDLE *Jun 25 09:17:34.072: ISAKMP:(1032):Sending NOTIFY DPD/R_U_THERE_ACK protocol 1 spi 834719464, message ID = 716440334 *Jun 25 09:17:34.072: ISAKMP:(1032): seq. no 0x64B2279D *Jun 25 09:17:34.072: ISAKMP:(1032): sending packet to  my_port 500 peer_port 500 (R) QM_IDLE *Jun 25 09:17:34.072: ISAKMP:(1032):Sending an IKE IPv4 Packet. *Jun 25 09:17:34.072: ISAKMP:(1032):purging node 716440334 *Jun 25 09:17:34.072: ISAKMP:(1032):Input = IKE_MESG_FROM_PEER, IKE_MESG_KEEP_ALIVE *Jun 25 09:17:34.072: ISAKMP:(1032):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Jun 25 09:17:35.356: ISAKMP:(1032):purging node 206299144

Obviously something seems to be wrong Phase 2 not to come. But why is it going up after having erased the session encryption or close the tunnel interface and activate the interface of tunnel has spoken?

Very weird. Also, in looking at att the hub debugging messages it seems that Cryptography is associated with evil Tu3300 tunnel interface when it is Tu2010. Normal or Bug?

The configuration of the hub looks like this:

 crypto keyring ISP1-DMVPN vrf ISP1-DMVPN pre-shared-key address 0.0.0.0 0.0.0.0 key  crypto isakmp policy 10 encr aes authentication pre-share crypto isakmp keepalive 10 3 periodic crypto isakmp nat keepalive 10 crypto isakmp profile ISP1-DMVPN keyring ISP1-DMVPN match identity address 0.0.0.0 ISP1-DMVPN keepalive 10 retry 3 crypto ipsec transform-set AES256-MD5 esp-aes 256 esp-md5-hmac mode tunnel crypto ipsec transform-set AES256-SHA-TRANSPORT esp-aes 256 esp-sha-hmac mode transport crypto ipsec profile ISP1-DMVPN set transform-set AES256-SHA AES256-SHA-TRANSPORT set isakmp-profile ISP1-DMVPN vrf definition ISP1-DMVPN description DMVPN-Outside-ISP1 rd 65527:10 ! address-family ipv4 exit-address-family ! ! interface TenGigabitEthernet0/0/0 no ip address ! interface TenGigabitEthernet0/0/0.71 description VPN;ISP1-DMVPN;Outside;VLAN71 encapsulation dot1Q 71 vrf forwarding ISP1-DMVPN ip address  255.255.255.128 no ip proxy-arp ip access-group acl_ISP1-DMVPN_IN in ! ip route vrf ISP1-DMVPN 0.0.0.0 0.0.0.0  name ISP1;Default ip access-list extended acl_ISP1-DMVPN_IN permit icmp any any permit esp any host  permit gre any host  permit udp any host  eq isakmp permit udp any host  eq non500-isakmp deny ip any any vrf definition 2010  description CUSTA - Customer A  rd 65527:2010 route-target export 65527:2010 route-target import 65527:2010 ! address-family ipv4 exit-address-family ! ! interface Tunnel2010 description CUSTA;DMVPN;Failover-secondary vrf forwarding 2010 ip address 10.97.0.34 255.255.255.240 no ip redirects ip mtu 1380 ip nhrp map multicast dynamic ip nhrp network-id 2010 ip nhrp holdtime 120 ip nhrp server-only ip nhrp max-send 1000 every 10 ip tcp adjust-mss 1340 tunnel source TenGigabitEthernet0/0/0.71 tunnel mode gre multipoint tunnel key 2010 tunnel vrf ISP1-DMVPN tunnel protection ipsec profile ISP1-DMVPN shared router bgp 65527 ! address-family ipv4 vrf 2010 redistribute connected metric 10 redistribute static metric 15 neighbor 10.97.0.39 remote-as 65028 neighbor 10.97.0.39 description spokerouter;Tunnel1 neighbor 10.97.0.39 update-source Tunnel2010 neighbor 10.97.0.39 activate neighbor 10.97.0.39 soft-reconfiguration inbound neighbor 10.97.0.39 prefix-list EXPORT-IVPN-VRF2010 out neighbor 10.97.0.39 route-map AllVRF-LocalPref-80 in neighbor 10.97.0.39 maximum-prefix 5000 80 default-information originate exit-address-family

Configuring spoke:

 crypto keyring DMVPN01 pre-shared-key address 0.0.0.0 0.0.0.0 key  crypto isakmp policy 10 encr aes authentication pre-share crypto isakmp invalid-spi-recovery crypto isakmp profile DMVPN01 keyring DMVPN01 match identity address 0.0.0.0 keepalive 10 retry 3 crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac mode tunnel crypto ipsec transform-set AES256-SHA-TRANSPORT esp-aes 256 esp-sha-hmac mode transport crypto ipsec profile DMVPN01 set transform-set AES256-SHA-TRANSPORT set isakmp-profile DMVPN01 vrf definition inside rd 65028:1 route-target export 65028:1 route-target import 65028:1 ! address-family ipv4 exit-address-family ! interface Tunnel1 description DMVPN to HUB vrf forwarding inside ip address 10.97.0.39 255.255.255.240 no ip redirects ip mtu 1380 ip nhrp map 10.97.0.33  ip nhrp map multicast  ip nhrp map 10.97.0.34  ip nhrp map multicast  ip nhrp network-id 1 ip nhrp holdtime 120 ip nhrp nhs 10.97.0.33 ip nhrp nhs 10.97.0.34 ip nhrp registration no-unique ip nhrp registration timeout 60 ip tcp adjust-mss 1340 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key 2010 tunnel protection ipsec profile DMVPN01 shared router bgp 65028 ! address-family ipv4 vrf inside bgp router-id 172.28.5.137 network 10.97.20.128 mask 255.255.255.128 network 10.97.21.0 mask 255.255.255.0 network 10.97.22.0 mask 255.255.255.0 network 10.97.23.0 mask 255.255.255.0 network 172.28.5.137 mask 255.255.255.255 neighbor 10.97.0.33 remote-as 65527 neighbor 10.97.0.33 description HUB1;Tunnel2010 neighbor 10.97.0.33 update-source Tunnel1 neighbor 10.97.0.33 timers 10 30 neighbor 10.97.0.33 activate neighbor 10.97.0.33 send-community both neighbor 10.97.0.33 soft-reconfiguration inbound neighbor 10.97.0.33 prefix-list IROUTE-EXPORT out neighbor 10.97.0.33 maximum-prefix 5000 80 neighbor 10.97.0.34 remote-as 65527 neighbor 10.97.0.34 description HUB2;tunnel2010 neighbor 10.97.0.34 update-source Tunnel1 neighbor 10.97.0.34 timers 10 30 neighbor 10.97.0.34 activate neighbor 10.97.0.34 send-community both neighbor 10.97.0.34 soft-reconfiguration inbound neighbor 10.97.0.34 prefix-list IROUTE-EXPORT out neighbor 10.97.0.34 route-map AllVRF-LocalPref-80 in neighbor 10.97.0.34 maximum-prefix 5000 80 exit-address-family

If more information is needed, please say so.

Any help or advice would be greatly appreciated!

Thank you!

It is possible that you touch it--the failure of negotiations of phase 2:

https://Tools.Cisco.com/bugsearch/bug/CSCup72039/?reffering_site=dumpcr

[Too little detail to say with certainty:]

DMVPN spoke with HSRP sells HUB

I have a basic DMVPN with an IPSEC config protect profile.

On the shelves, I use the VIP HSRP for (192.168.1.1) configuration and traffic stops treatment

map of PNDH 10.29.32.1 IP 192.168.1.1

If I use the real IP address of the HUB 192.168.1.2 interface, it works fine.

I changed the mode of multipoint gre tunnel and changed to point to the real or VIP and seems not in line with the VIP HSRP.

Is this a supported configuration, or am I missing something?

The end result is routers DMVPN HUB running HSRP and we talked, pointing to the VIP address.

I feel that, since then, IPSec, the communication breaks when you use the VIP

Thank you

Juan

Spoke about config below

interface Tunnel100

Description

bandwidth 6000

IP 10.29.47.254 255.255.240.0

no ip redirection

IP 1400 MTU

property intellectual PNDH authentication nhrpdomain

map of PNDH IP 192.168.1.2 multicast

map of PNDH 10.29.32.1 IP 192.168.1.2

PNDH id network IP-100

property intellectual PNDH holdtime 360

property intellectual PNDH nhs 10.29.32.1

IP tcp adjust-mss 1360

load-interval 30

QoS before filing

source of tunnel GigabitEthernet0/2

multipoint gre tunnel mode

tunnel key 1000

Protection ipsec DMVPN tunnel profile

end

Hello

The hub does not generate the packages using the VIP.

If the RADIUS is trying to connect to 192.168.1.1 while the hub will respond with 192.168.1.2.

For redundancy, you can create two tunnels on the RADIUS. 1 for every router and use eigrp to decide the best option.

You can still use hsrp to the internal network on the hubs (the network doesn't not facing rays) so the right router will be the gateway for internal routers.

P - P WILL link

Hello

I want to route a public rate range IP from one provider to another spinal column of suppliers. I want to deliver this range statically through a GRE tunnel.

However, point final (Talk client) is only DYNAMIC IP PUBLIC address.

Is it possible to create a tunnel between the two sites, which is dynamic, the other static and where I can deliver a range of IP addresses through this tunnel if does not know the end point IP spoke?

Thank you!

Have you looked at DMVPN (a hub and a spoken)?

DMVPN uses PNDH to rays of form on the fly. The HUB has no need to know the public rays IP address during Setup. The public IP / Tunnel of the hub are hard coded in the spoke (s). Once that happens the RADIUS registers on the hub dynamically (using the PNDH Protocol).

Concerning

Farrukh

problem with EZvpn

Hello

I'm trying to set up a server EzVPN which will allow users to connect remotely via internet through my router 2820

the client can connect successfully, but it can reach the router and not the devices in the router subnet

crypto ISAKMP policy 100
BA aes
md5 hash
preshared authentication
Group 2

ISAKMP crypto 20 10 keepalive
!
ISAKMP crypto client configuration group easyvpn
easyvpn key
pool easyvpn
ACL easyvpn
Save-password
MAX User 9
netmask 255.255.255.0
!
!
Crypto ipsec transform-set aes - esp esp-md5-hmac dmvpn
!
Crypto ipsec profile dmvpn
Set transform-set dmvpn
!
!
Crypto-map dynamic easyvpn 10
Set transform-set dmvpn
market arriere-route
!
!
card crypto client easyvpn of authentication list easyvpn
card crypto isakmp authorization list easyvpn easyvpn
client configuration address card crypto easyvpn answer
easyvpn 100 card crypto ipsec-isakmp dynamic easyvpn

interface GigabitEthernet0/0
description of the DSL interface
no ip address
automatic duplex
automatic speed
PPPoE enable global group
PPPoE-client dial-pool-number 1
!
interface GigabitEthernet0/1
interface internal Description
IP 100.0.0.1 255.255.255.0
IP nat inside

!
interface Dialer1
the negotiated IP address
IP mtu 1492
NAT outside IP
IP virtual-reassembly
encapsulation ppp
Dialer pool 1
PPP authentication chap callin pap
PPP chap hostname
PPP chap password 0
PPP pap sent-name to user
easyvpn card crypto

IP local pool easyvpn 70.0.0.1 70.0.0.100
!

easyvpn extended IP access list
IP 100.0.0.0 allow 0.0.0.255 70.0.0.0 0.0.0.255

Please be notified that I can reach only the private router only address not connected devices

Thank you

Please make sure that the exemption of NAT is configured (you must deny traffic to your internal subnets to the subnet of the ip pool so it is not coordinated).

problem applying IPSEC to DMVPN

Hi, I have a few problems with DMVPN

I have configured the PNDH between a HUB and aSPOKE:

HUB

tU0 tu1

| |

INTERNET SERVICE PROVIDER

|

tU0, tu1

TALK

the HUB has two physical interfaces and two logical interfaces.

The RADIUS has a physical interface and two logical interfaces.

in PNDH configured correctly, the tunnels are detected in the HUB and the SPOKES.

When I add the IPSEC profile for the controls I lose tunnel1.

SPOKE1 #sh ip PNDH

10.1.1.4/32 via 10.1.1.4, Tunnel0 created 02:22:01, never expire

Type: static, flags: used by authority

The NBMA Address: 190.1.1.1

10.2.2.4/32 via 10.2.2.4 Tunnel1 created 02:18:21, never expire

Type: static, flags: used by authority

The NBMA Address: 190.1.2.1

SPOKE1 #debug ip PNDH

Tunnel0

* 03:50:09.399 Mar 1: PNDH: try to send packages via DEST 10.1.1.4

* 03:50:09.399 Mar 1: PNDH: Encapsulation succeeded. Tunnel IP addr 190.1.1.1

* 03:50:09.399 Mar 1: PNDH: send the registration request via Tunnel0 vrf 0, the packet size: 82

* 03:50:09.403 Mar 1: CBC: 10.1.1.1, dst: 10.1.1.4

* 03:50:09.403 Mar 1: PNDH: 82 bytes in Tunnel0

* 03:50:09.519 Mar 1: PNDH: receive the response for registration via Tunnel0 vrf 0, the packet size: 102

* 03:50:09.519 Mar 1: PNDH: netid_in = 0, to_us = 1

tunnel 1

* 03:50:30.575 Mar 1: PNDH: try to send packages via DEST 10.2.2.4

* 03:50:30.575 Mar 1: PNDH: Encapsulation succeeded. Tunnel IP addr 190.1.2.1

* 03:50:30.575 Mar 1: PNDH: send the registration request via Tunnel1 vrf 0, the packet size: 82

* 03:50:30.579 Mar 1: CBC: 10.2.2.1, dst: 10.2.2.4

* 03:50:30.579 Mar 1: PNDH: 82 bytes to Tunnel1

* 03:50:30.579 Mar 1: PNDH: reset retransmission due to the wait timer for 10.2.2.4

no response from the HUB.

HUB #sh ip PNDH

10.1.1.1/32 through 10.1.1.1, 00:05:05 created Tunnel0, expire 00:08:29

Type: dynamic, flags: single authority registered

The NBMA Address: 191.1.1.11

just tunnel0 is here!

I also have it on the HUB:

* 03:58:54.519 Mar 1: % CRYPTO-6-IKMP_MODE_FAILURE: fast processing mode failed with the peer to 191.1.1.11 (physical address of the SPOKE1)

configs:

HUBS:

!

crypto ISAKMP policy 10

BA aes

md5 hash

preshared authentication

Group 2

techservices key crypto isakmp address 0.0.0.0 0.0.0.0

!

!

Crypto ipsec transform-set AES_MD5 aes - esp esp-md5-hmac

!

Profile of crypto ipsec DMVPN

game of transformation-AES_MD5

!

!

interface Tunnel0

bandwidth 10000

10.1.1.4 IP address 255.255.255.0

no ip redirection

IP 1400 MTU

no ip next-hop-self eigrp 123

property intellectual PNDH authentication dmvpn1

dynamic multicast of IP PNDH map

PNDH id network IP-123

no ip split horizon eigrp 123

source of tunnel FastEthernet0/0

multipoint gre tunnel mode

tunnel key 123

Protection ipsec DMVPN tunnel profile

!

Tunnel1 interface

bandwidth 10000

10.2.2.4 IP address 255.255.255.0

no ip redirection

IP 1400 MTU

no ip next-hop-self eigrp 124

property intellectual PNDH authentication dmvpn2

dynamic multicast of IP PNDH map

PNDH id network IP-124

no ip split horizon eigrp 124

source of tunnel FastEthernet1/0

multipoint gre tunnel mode

tunnel key 124

Protection ipsec DMVPN tunnel profile

!

!

Router eigrp 123

Network 10.1.1.0 0.0.0.255

network 172.16.4.0 0.0.0.255

No Auto-resume

!

Router eigrp 124

Network 10.2.2.0 0.0.0.255

network 172.16.4.0 0.0.0.255

No Auto-resume

!

SPOKE1:

!

crypto ISAKMP policy 10

BA aes

md5 hash

preshared authentication

Group 2

techservices key crypto isakmp address 0.0.0.0 0.0.0.0

!

!

Crypto ipsec transform-set AES_MD5 aes - esp esp-md5-hmac

!

Profile of crypto ipsec DMVPN

game of transformation-AES_MD5

!

!

interface Tunnel0

bandwidth 10000

10.1.1.1 IP address 255.255.255.0

IP 1400 MTU

property intellectual PNDH authentication dmvpn1

map of PNDH IP multicast 190.1.1.1

map of PNDH 10.1.1.4 IP 190.1.1.1

PNDH id network IP-123

property intellectual PNDH holdtime 600

property intellectual PNDH nhs 10.1.1.4

property intellectual PNDH registration timeout 300

source of tunnel FastEthernet0/0

multipoint gre tunnel mode

tunnel key 123

Protection ipsec DMVPN tunnel profile

!

Tunnel1 interface

bandwidth 10000

10.2.2.1 IP address 255.255.255.0

IP 1400 MTU

property intellectual PNDH authentication dmvpn2

map of PNDH IP multicast 190.1.2.1

property intellectual PNDH 10.2.2.4 card 190.1.2.1

PNDH id network IP-124

property intellectual PNDH holdtime 600

property intellectual PNDH nhs 10.2.2.4

property intellectual PNDH registration timeout 300

source of tunnel FastEthernet0/0

multipoint gre tunnel mode

tunnel key 124

Protection ipsec DMVPN tunnel profile

!

!

Router eigrp 123

Network 10.1.1.0 0.0.0.255

network 172.16.1.0 0.0.0.255

No Auto-resume

!

Router eigrp 124

Network 10.2.2.0 0.0.0.255

network 172.16.1.0 0.0.0.255

No Auto-resume

!

concerning

Good to hear. Looks like it could be a timing problem. Recent releases logic for restart the timer recording during certain delays caused by the sequence of configuration has been added. Since you're using an old code that could be the reason why it worked after the reconfiguration of tunnel interface.

F.F. make sure that assign you this thread has responded so he can help others.

On DMVPNs selective IPSec encryption

Hello

I have a DMVPN with two rays on a MPLS-L3-IPVPN network. IPSec over GRE profiles using crypto. Works very well. Now, he only need to encrypt all traffic except EF DSCP. Tried with the help of ACB defining IP-Next Hop for EF-packages and just normal dug routing for all other types of traffic.

My question is, I know cryptographic cards that use ACLs can selectively encrypt traffic through the IPSec/GRE tunnels. Cryptographic profiles don't seem to have this feature. Is there another way to do this?

A snip Config by couple spoke it as below.

===============

interface GigabitEthernet0/0.1
DESC LAN i / f
IP 10.10.10.1 255.255.255.0
political intellectual property map route ACB

interface Tunnel100
IP 172.16.254.13 255.255.254.0
no ip redirection
property intellectual PNDH card 172.16.254.1 103.106.169.10
map of PNDH IP multicast 103.106.169.10
PNDH network IP-1 id
property intellectual PNDH nhs 172.16.254.1
property intellectual shortened PNDH
KeepAlive 10 3
source of tunnel GigabitEthernet0/1.401
multipoint gre tunnel mode
key 1 tunnel
Profile of tunnel DMVPN-Crypto ipsec protection
end

GIE Router 1
no car
NET 172.16.254.0 0.0.1.255
EIGRP log-neighbor-warnings
EIGRP log-neighbor-changes
! - router id
NET 10.10.10.0 0.0.0.255

ACB allowed 10 route map
ACB match ip address
IP 11.2.100.2 jump according to the value
!
ACB allowed 20 route map

ACB extended IP access list
permit icmp host 10.10.10.5 host 15.1.1.1 dscp ef
allow icmp host 10.10.10.5 host 15.1.1.1 dscp 41
deny ip any any newspaper

===============

Note: the routing table contains only a default route learned via EIGRP. Thus, if the ACB 10 past, policy would transmit to the Next-hop (PE). Or would otherwise use 0/0 and route thro' the tunnel.

Thanks in advance!

See you soon
Aravind

With DMVPN, no. You will need to return to the use of just cryptographic cards, only using access lists to control what is and is not encrypted.

If the "EF" traffic was dedicated VoIP subnets so you would have more options, you can choose everything just don't not to route these subnets above the Tunnel.

2 IPSec VPN + DMVPN

Hello.

Could you please tell me, how to create the second IPSec VPN on my router if crypto card is already set to the interface, and there is no other. This interface is also the NHRP\DMVPN interface. Router is a hub.

Hey, Nikolay.

For new dmvpn cloud you don't don't have set up a crmap to the interface. You can create a new tunnel interface and link a different transfer for her.

If you want to add an IPsec-l2l connection or a new EasyVPN you can look at this example:

Crypto ipsec transform-set esp-3des esp-md5-hmac trset1
transport mode
output

Crypto ipsec transform-set trset2 aes - esp esp-sha-hmac

map CRNAME 1 ipsec-isakmp crypto
Description - VPN - 1
defined peer IP_1
Set transform-set trset1
match address ACL_1
output

map CRNAME 2 ipsec-isakmp crypto
Description - VPN - 2
defined peer IP_1
Set transform-set trset2
match address ACL_2
output

interface FastEthernet0/0
Description - outdoors-
card crypto CRNAME
output

For an EasyVPN (or any other dynamic encryption card), you can use this example:

crypto dynamic-map DYNMAP 1
transform-set Set feat
market arriere-route
output

card crypto crmap 3 - isakmp dynamic ipsec DYNMAP

And example for DmVPN clouds to the 1 Router 2:

Crypto ipsec transform-set esp-3des esp-sha-hmac trset_1
tunnel mode
output
Crypto ipsec transform-set esp-3des esp-md5-hmac trset_2
transport mode
output

Crypto ipsec Dmvpn-Profile1 profile
Set transform-set trset_1
output
Crypto ipsec profile Profil2 dmvpn
Set transform-set trset_2
output

Tunnel1 interface
[network] IP address
dynamic multicast of IP PNDH map
PNDH network IP-1 id
source of tunnel FastEthernet0/0
multipoint gre tunnel mode
key 1 tunnel
Tunnel protection ipsec Dmvpn-Profile1 profile
output

interface tunnels2
[network] IP address
dynamic multicast of IP PNDH map
PNDH network IP-2 id
source of tunnel FastEthernet0/0
multipoint gre tunnel mode
tunnel key 2
Profile of tunnel dmvpn Profil2 ipsec protection
output

Best regards.

Tunnel DMVPN is establishing is not - a wrong address PNDH

I am trying to establish a DMVPN tunnel a new router that move us in a remote location. We already have a hub and several other remote sites that work properly. I can ping everywhere on another remote site, but I do not see the correct address appears when I do a 'show dmvpn.' Also the SA does not appear when I do a "show isakmp crypto his.".

UARouter #show dmvpn

Legend: Attrb--> S - static, D - dynamic, I - incomplete

Local N - using a NAT, L-, X - no Socket

# Ent--> entries number of the PNDH with same counterpart NBMA

State of the NHS: E--> RSVPs, R--> answer, W--> waiting

UpDn time--> upward or down time for a Tunnel

==========================================================================

Interface: Tunnel0, IPv4 PNDH details

Type: talk, PNDH peers: 1,.

# Ent Peer NBMA Peer Tunnel Addr add State UpDn Tm Attrb

----- --------------- --------------- ----- -------- -----

1 63.162.52.254 172.19.1.1 UP 1d10h S

Then I do a ping on a remote machine.

UARouter #ping 192.168.2.40 loopback source 5

Type to abort escape sequence.

Send 5, echoes ICMP 100 bytes to 192.168.2.40, wait time is 2 seconds:

Packet sent with a source address of 192.168.12.254

!!!!!

Success rate is 100 per cent (5/5), round-trip min/avg/max = 352/353/356 ms

UARouter #show dmvpn

Legend: Attrb--> S - static, D - dynamic, I - incomplete

Local N - using a NAT, L-, X - no Socket

# Ent--> entries number of the PNDH with same counterpart NBMA

State of the NHS: E--> RSVPs, R--> answer, W--> waiting

UpDn time--> upward or down time for a Tunnel

==========================================================================

Interface: Tunnel0, IPv4 PNDH details

Type: talk, PNDH peers: 1,.

# Ent Peer NBMA Peer Tunnel Addr add State UpDn Tm Attrb

----- --------------- --------------- ----- -------- -----

2 63.162.52.254 172.19.1.1 UP 1d10h S

172.19.1.2 UP TO 00:00:32

It does not seem to resolve on the real peer NBMA Address 203.98.212.254, but rather fixed to the hub.

UARouter #show ip nh

UARouter #show ip PNDH bis

Target Via NBMA Mode claimed Intfc

172.19.1.1/32 172.19.1.1 63.162.52.254 Tu0 static<  >

172.19.1.2/32 172.19.1.2 63.162.52.254 dynamic Tu0<  >

UARouter #show cry isa his

IPv4 Crypto ISAKMP Security Association

DST CBC conn-State id

63.162.52.254 109.237.82.114 QM_IDLE 1003 ACTIVE

Here is the result of a different router that works.

TaiwanRTR #show dmvpn

Legend: Attrb--> S - static, D - dynamic, I - incomplete

Local N - using a NAT, L-, X - no Socket

# Ent--> entries number of the PNDH with same counterpart NBMA

State of the NHS: E--> RSVPs, R--> answer

UpDn time--> upward or down time for a Tunnel

==========================================================================

Interface: Tunnel0, IPv4 PNDH details

Type: talk, PNDH peers: 8.

# Ent Peer NBMA Peer Tunnel Addr add State UpDn Tm Attrb

----- --------------- --------------- ----- -------- -----

1 63.162.52.254 172.19.1.1 UP 1w4d S

1 203.98.212.254 D 1w4d 172.19.1.2

TaiwanRTR #show ip PNDH bis

Target Via NBMA Mode claimed Intfc

172.19.1.1/32 172.19.1.1 63.162.52.254 Tu0 static<  >

172.19.1.2/32 172.19.1.2 203.98.212.254 dynamic Tu0<  >

Here's the DMVPN configs. They are identical except for the ip address and the fact that I can not use the command no ip mroute-cache because it is not recommended on the new router because we use a newer IOS. I also use the interface directly instead of looping. The closure on the TawainRTR is a public IP address.

Router AU

interface Tunnel0

bandwidth 1000

IP 172.19.1.12 255.255.255.0

no ip redirection

IP 1400 MTU

the PNDH IP authentication

property intellectual PNDH card 172.19.1.1 63.162.52.254

map of PNDH IP multicast 63.162.52.254

PNDH 1000000 IP network ID.

property intellectual PNDH holdtime 600

property intellectual PNDH nhs 172.19.1.1

IP tcp adjust-mss 1360

delay of 1000

QoS before filing

source of tunnel GigabitEthernet0/0

multipoint gre tunnel mode

tunnel key 100000

Shared protection ipsec DMVPN tunnel profile

TaiwanRTR

interface Tunnel0

bandwidth 1000

IP 172.19.1.6 255.255.255.0

no ip redirection

IP 1400 MTU

the PNDH IP authentication

property intellectual PNDH card 172.19.1.1 63.162.52.254

map of PNDH IP multicast 63.162.52.254

PNDH 1000000 IP network ID.

property intellectual PNDH holdtime 600

property intellectual PNDH nhs 172.19.1.1

IP tcp adjust-mss 1360

no ip mroute-cache

delay of 1000

source of Loopback2 tunnel

multipoint gre tunnel mode

tunnel key 100000

Shared protection ipsec DMVPN tunnel profile

end

On both devices, we use the same crypto map parameters. We use certificates instead of pre-shared keys.

crypto ISAKMP policy 1

BA 3des

ISAKMP crypto keepalive 10

!

!

Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

transport mode

!

Profile of crypto ipsec DMVPN

Set transform-set RIGHT

Does anyone have ideas, what could happen?

Here is the my DMVPN router ACL...

10 licences of everything esp (22214502 matches)

20 permit udp any any eq isakmp (375 matches)

30 permit udp any any eq non500-isakmp

40 permits all icmp (40005 matches)

Works 100% for me.

I will note, my line 20 has been ' permit udp any isakmp eq all isakmp eq ' but I found when my routers were behind the devices from the source don't would not 500 and things didn't work so I had to open it.

DMVPN without IPsec

Hi all

Is the operation of DMVPN without IPsec configuration supported?

I'm testing it right now and hubs are losing conncetivity to rays. I wonder if it is because of not using IPsec.

Anyone tried this?

Attila

I guess you meant PNDH. If so look at the http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a0080435815.html

DMVPN - record PNDH, IPsec

Similar Questions

Maybe you are looking for