DMVPN to 4 PSI

Similar Questions

• DMVPN and INTERNET VIA HUB RENTAL ISSUES

  Hello everyone,

  I really wish you can help me with the problem I have.

  I explain. I test a double Hub - double DMVPN Layout for a client before we set it up in actual production.
  The client has sites where routers are behind some ISP routers who do NAT.

  

  How things are configured:

  -All rays traffic must go through the location of the hub if no local internet traffic on the rays.
  -Hub 1 and 2 hub sends a default route to rays through EIGRP. But only Hub 1 is used.
  -Hub 1 is the main router to DMVPN. In case of connection / hardware failure of the Internet Hub 2 become active for DMVPN and Internet.
  -Hub 1 and 2 hub are both connected to an ISP and Internet gateway for rays.
  -Hub 1 and 2 hub are configured with IOS Firewall.
  -On the shelves I used VRF for separate DMVPN routning Global routning table so I could receive a default route of 1 Hub and Hub 2 to carry the traffic of rays to the Internet via the location of the hub

  What works:

  -All rays can have access to the local network to the location of the hub.
  -All the rays can do talk of talk
  -Working for DMVPN failover
  -Rais NOT behind the router NAT ISP (i.e. the public IP address) directly related to their external interface can go Internet via hub location and all packages are inspected properly by the IOS and Nat firewall properly
   
  What does not work:

  -Rays behind the NAT ISP router can not access Internet via Hub location. They can reach a local network to the location of the hub and talk of talks.
  IOS Firewall Router hub shows packages from rays of theses (behind a NAT) with a source IP address that is the router og PSI of public IP address outside the interface. Not the private address LAN IP back spoke.
  In addition, the packets are never natted. If I do some captge on an Internet Server, the private source IP is the IP LAN to the LAN behind the rays. This means that the hub, router nat never these packages.

  How to solve this problem?

  / * Style definitions * / table. MsoNormalTable {mso-style-name : « Tabel - Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 cm 5.4pt cm 0 5.4pt ; mso-para-margin : 0 cm ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

  Well I don't know that's why I need your help/advice :-)

  I don't know that if I have to configure a VRF on the location of the hub gets also like things might mess upward.

  The problem seems to be NAT - T the rays that are not behind a NAT, among which go over the Internet through a Hub and inspection of Cisco IOS and NAT are trying to find.

  I tested today with the customer at the start them talking behind nat could ping different server on the Internet but not open an HTTP session. DNS was to find work. The IOS Firewall has been actually

  inspection of packages with private real IP address. Then I thought it was a MTU issue, so I decided to do a ping on the Internet with the largest MTU size and suddenly the pings were no more.

  I could see on the router Hub1 IOS Firewall was inspecting the public IP of the ISP NAT router again alongside with rays and not more than the actual IP address private. Really strange!

  Attached files:

  I attach the following files: a drawing of configuration called drawing-Lab - Setup.jpeg | All files for HUB1, BRANCH1 and BRANCH2 ISP-ROUTER configs, named respectively: HUB1.txt, BRANCH1.txt, BRANCH2.txt and ISP - ROUTER .txt

  Hub1 newspapers when ping host 200.200.200.200 on the Internet of Branch2 (behind the NAT ISP router):

  Branch2 #ping vrf DMVPN-VRF 200.200.200.200 source vlan 100

  Type to abort escape sequence.
  Send 5, echoes ICMP 100 bytes to 200.200.200.200, time-out is 2 seconds:
  Packet sent with a source address of 192.168.110.1
  .....
  Success rate is 0% (0/5)

  * 06:04:51.017 Jul 15 UTC: % FW-6-SESS_AUDIT_TRAIL_START: start session icmp: initiator (110.10.10.2:8) - answering machine (200.200.200.200:0)

  If the IOS Firewall does not inspect the true private source IP address that can be, in this case: 192.168.110.2. He sess on the public IP address.

  HUB1 #sh ip nat translations
  Inside global internal local outside global local outdoor Pro
  ICMP 80.10.10.2:1 80.10.10.2:1 100.10.10.2:1 100.10.10.2:1
  ICMP 80.10.10.2:2 80.10.10.2:2 110.10.10.2:2 110.10.10.2:2
  UDP 80.10.10.2:4500 80.10.10.2:4500 110.10.10.2:4500 110.10.10.2:4500

  There is no entry for packets of teas present NAT

  Captge on Tunnel 1 on Hub1 interface (incoming packets in):

  7 7.355997 192.168.110.1 200.200.200.200 request ICMP (ping) echo
  So that the firewall controllable IOS to the 110.10.10.2:8 public IP sniffing capture said that the package come from private real IP address

  Inhalation of vapours on the server (200.200.200.200) with wireshark:

  114 14.123552 192.168.110.1 200.200.200.200 request ICMP (ping) echo

  If the private IP address of source between local network of BRANCH2 is never natted by HUB1

  If the server sees the address source IP private not natted although firewall IOS Hub1 inspect the public IP address 110.10.10.2:8

  Hub1 newspapers when ping host 200.200.200.200 on the Internet of Branch1 (not behind the NAT ISP router):

  Branch1 #ping vrf DMVPN-VRF 200.200.200.200 source vlan 100

  Type to abort escape sequence.
  Send 5, echoes ICMP 100 bytes to 200.200.200.200, time-out is 2 seconds:
  Packet sent with a source 192.168.100.1 address
  !!!!!

  * 06:05:18.217 Jul 15 UTC: % FW-6-SESS_AUDIT_TRAIL_START: start session icmp: initiator (192.168.100.1:8) - answering machine (200.200.200.200:0)

  This is so the firewall sees the actual private IP which is 192.168.100.1

  HUB1 #sh ip nat translations
  Inside global internal local outside global local outdoor Pro
  ICMP 80.10.10.2:1 80.10.10.2:1 100.10.10.2:1 100.10.10.2:1
  ICMP 80.10.10.2:2 80.10.10.2:2 110.10.10.2:2 110.10.10.2:2
  UDP 80.10.10.2:4500 80.10.10.2:4500 110.10.10.2:4500 110.10.10.2:4500
  ICMP 80.10.10.2:22 192.168.100.1:22 200.200.200.200:22 200.200.200.200:22

  The real private source IP address is also find natted 1 Hub outside the public IP address

  Captge on Tunnel 1 on Hub1 interface (incoming packets in):

  8 7.379997 192.168.100.1 200.200.200.200 request ICMP (ping) echo

  Real same as inspected by IOS Firewall so all private IP address is y find.

  Inhalation of vapours on the server (200.200.200.200) with wireshark:

  / * Style definitions * / table. MsoNormalTable {mso-style-name : « Tabel - Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 cm 5.4pt cm 0 5.4pt ; mso-para-margin : 0 cm ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

  67 10.441153 80.10.10.2 200.200.200.200 request ICMP (ping) echo

  So, here's all right. The address is natted correctly.

  __________________________________________________________________________________________

  Best regards

  Laurent

  Hello

  Just saw your message, I hope this isn't too late.

  I don't know what your exact problem, but I think we can work through it to understand it.

  One thing I noticed was that your NAT ACL is too general. You need to make it more

  specific.  In particular, you want to make sure that it does not match the coming of VPN traffic

  in to / out of the router.

  For example you should not really have one of these entries in your NAT translation table.

  HUB1 #sh ip nat translations
  Inside global internal local outside global local outdoor Pro
  ICMP 80.10.10.2:1 80.10.10.2:1 100.10.10.2:1 100.10.10.2:1
  ICMP 80.10.10.2:2 80.10.10.2:2 110.10.10.2:2 110.10.10.2:2
  UDP 80.10.10.2:4500 80.10.10.2:4500 110.10.10.2:4500 110.10.10.2:4500

  Instead use:

  Nat extended IP access list
  deny ip any 192.168.0.0 0.0.255.255 connect
  allow an ip
  deny ip any any newspaper

  If you can use:

  Nat extended IP access list
  deny ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255 connect
  IP 192.168.0.0 allow 0.0.255.255 everything
  deny ip any any newspaper

  Also, I would be very careful with the help of the "log" keyword in an ACL, NAT.

  I saw problems.

  What are the IOS versions do you use?

  Try to make changes to the NAT so that you no longer see the entries of translation NAT

  for packages of NAT - T (UDP 4500) in the table of translation NAT on the hub. It may be

  This puts a flag on the package structure, that IOS Firewall and NAT is

  pick up on and then do the wrong thing in this case.

  If this does not work then let me know.

  Maybe it's something for which you will need to open a TAC case so that we can

  This debug directly on your installation.

  Mike.

• entry of mV/psi for SCXI-1102 using the SCXI-1308 module?

  Is there a way to physically connect a mV/psi signal to an SCXI-1102 module, which also uses a block to connect SCXI-1308? What I've read, the terminal block can use only a signal 4-20 or 0-20 Ma, right? I don't see the pins that the terminal block plug to use for output of the pressure sensor mV.

  Thank you very much for the help!

  TQ

  Hi FMC_Pumptest,

  The 1308 Terminal is designed for the current input. You are right that you have entered for 0-20 mA and 4-20 signals my with this block.

  Kind regards

• switch 10 update camera (2400 PSI)

  I installed a windows update to 2400 PSI. After I tried to launch the camera app and it now tells me, first install a camera. I tried to roll back the driver yet am still not able to get the camera.

  I had the same problem. After I restored the ISP 2400 driver, the camera work again.

  This problem happened also to other tablets only after the windows update driver update.

  So I think that's not for lack of acer.

  Uninstall the 2400 PSI update driver may fix the problem.

• PSI key stopped working

  My printer will stop printing, then I get a message indicating that your PSI key stopped working. How can I fix it?

  WD

  Have you installed Corel products?
  http://answers.Microsoft.com/en-us/Windows/Forum/windows_vista-windows_programs/psikey/c06c8485-e2f0-4f31-9aaf-e2c5c4e21b7c

• URL error message when click on a link in the PSI

  I run Secunia PSI to check my computer for insecure programs.  I can usually just click on the icon to update or download or patch and uninstall a program, a program not secure.  Now I get an error "an error has occurred so they were trying to open the specified URL". My browser is set to default.

  Hello

  Since it is directly involved with a product of part 3, they should be more qualified to help in this matter,http://secunia.com/community/forum/

  Otherwise, try the IT Pro to Vista forum, http://social.technet.microsoft.com/Forums/en-US/itprovistanetworking/threads

  Jack-MVP Windows Networking. WWW.EZLAN.NET

• Adobe Flash Player, Secunia PSI and Me.

  Of all the software that I use, probably none irritates me quite as much as Adobe Flash Player. (I've dumped at least since Adobe Reader, Java and all things Google). What a pain it is to keep this evil need patched on all my systems and browsers!

  -All the weeks Flash seems to release a new version addressing "vulnerabilities", the latest version being seemingly 11.4.402.278 after being released 10 days ago.

  -C' is my practice to avoid downloading the new software until the info on new changelog or release notes
  are published. I want to know exactly why it is important to upgrade until I get a 'pig in a poke. "

  -Adobe (and Secunia) still have to publish this info for the latest version of Flash. Thus, all my systems continue to use the old version 11.4.402.265. And Secunia PSI continues to tell me that this version is fully patched and 'up-to-date' on all my systems (XP and Win7). PSI has historically had a day or two to get the current with security updates, but after 10 days, I tend to trust him.

  -Finally, it is my understanding that the latest versions of Flash (Control Panel > Flash console > Advanced tab) allowed to auto-update to the newer versions of the Flash, or at least to indicate a when newer versions were available to install (option I chose). I still get this function runs on any of my systems.

  I missing something here, or is the top a valid rant?

  This will bring you back up then

  Personal Adobe

  
  This version is simply the result of changes made to our build process.  There was no code carried out changes and no need to update your client systems.

  http://forums.Adobe.com/message/4711916#4711916

  Nice to Adobe to officially announce this information and not bury deep in their forums .

  .

  Do not make comparisons here, between the video below and a typical day at Adobe...

  cs_setInnerHtml ('video_1f35c31e-f7ad-45db-8197 - 0650686070 b 3', ");

  .

  Edit: Added text for clarity.

• DMVPN Question ISAKMP Security Association

  Hi all

  I have implemented a full mesh base DMVPN, similar to the int of config used life package

  http://packetlife.net/blog/2008/Jul/23/dynamic-multipoint-VPN-DMVPN/ tutorial.

  I have a Hub and two rays. Everything seems to be ok functioing. I've included the config below for tunnels.

  My Question is, when I do an isakmp crypto see the its, for example 2A talked, I have three ISAKMP SA with three different addresses of CBC...

  How is that possible when I only have the tunnels to two other devices, the hub and rays 1? and why a foreign source address appears as an association of ISAKMP security on this router?

  status of DST CBC State conn-id slot

  172.16.1.2 172.16.2.2 QM_IDLE 1 0 ACTIVE

  172.16.2.2 172.16.3.2 QM_IDLE 3 0 ACTIVE

  172.16.2.2 172.16.1.2 QM_IDLE 2 0 ACTIVE

  A similar result on the hub

  status of DST CBC State conn-id slot

  172.16.2.2 172.16.1.2 QM_IDLE 2 0 ACTIVE

  172.16.1.2 172.16.2.2 QM_IDLE 1 0 ACTIVE

  172.16.1.2 172.16.3.2 QM_IDLE 3 0 ACTIVE

  Still 1 spoke only a 2

  172.16.1.2 172.16.3.2 QM_IDLE 1 0 ACTIVE

  172.16.2.2 172.16.3.2 QM_IDLE 2 0 ACTIVE

  Crypto config for all:

  crypto isakmp policy 10 authentication pre-share crypto isakmp key P4ssw0rd address 172.16.0.0 255.255.0.0 ! crypto ipsec transform-set MyTransformSet esp-aes esp-sha-hmac ! crypto ipsec profile MyProfile set transform-set MyTransformSet ! interface Tunnel0 tunnel protection ipsec profile MyProfile

  Config of Tunnel hub

  interface Tunnel0

  10.0.100.1 IP address 255.255.255.0

  dynamic multicast of IP PNDH map

  PNDH network IP-1 id

  tunnel source fa0/0

  multipoint gre tunnel mode

  Spoke 1 Tunnel Config

  !

  interface FastEthernet0/0

  address 172.16.3.2 IP 255.255.255.0

  automatic duplex

  automatic speed

  !

  interface Tunnel0

  10.0.100.2 IP address 255.255.255.0

  no ip redirection

  map of PNDH IP 10.0.100.1 172.16.1.2

  map of PNDH IP multicast 172.16.1.2

  PNDH network IP-1 id

  property intellectual PNDH nhs 10.0.100.1

  source of tunnel FastEthernet0/0

  multipoint gre tunnel mode

  Profile of tunnel MyProfile ipsec protection

  Spoke 2 Config of Tunnel

  !

  interface FastEthernet0/0

  IP 172.16.2.2 255.255.255.0

  automatic duplex

  automatic speed

  !

  interface Tunnel0

  IP 10.0.100.3 255.255.255.0

  no ip redirection

  map of PNDH IP 10.0.100.1 172.16.1.2

  map of PNDH IP multicast 172.16.1.2

  PNDH network IP-1 id

  property intellectual PNDH nhs 10.0.100.1

  source of tunnel FastEthernet0/0

  multipoint gre tunnel mode

  Profile of tunnel MyProfile ipsec protection

  SRC and DST IP addresses indicate that was author and answering machine. They do not represent information outlet (in the traditional sense of the term).

  You could get in double sessions of the two scenarios IKE, are the most common.

  (1) the negotiation started at both ends "simultaneously".

  (2) renegotiation of IKE.

  What is strange to me, is that you seem to have initiated session and responsed by the hub.

  What I would do, is to add:

  -ip server only PNDH (on the hub, it is not a provided ASR)

  -DPD (on all devices).

  Assures us that this hub initiates not anything in the PNDH and useless/deceased sessions are torn down eventually.

• DMVPN (NAT?) solution with rais as subnets

  Hi all

  I have a large number of remote networks that are prevalent all over the world. Currently, they are all individual island with no connectivity to anywhere else.

  What I would do is connect all back to Headquarters on the internet so I can access it remotely. The internet service that I receive from all the sites will be different and unknown for example some directly on the internet, some behind NAT.

  So I think that the solution to this is DMVPN.

  But my problem is that all of the remote locations have the same internal subnet. So, how can I make sure that they are all connected and remote devices are all available at the same time?

  I wonder if I can configure NAT on the router may talk so that each device has a static nat with the Natted IP is unique. I labbed this place GNS3 and it seems to work. However the problem is that there are hundreds of devices on each site, which means a large number of NAT entries.

  I was wondering is it possible to make a fair full 1:1 Nat specifies a network to network. For example, something like 192.168.20.0/24 NAT to 10.0.1.0/24, so try to access the 192.168.20.5 in fact, it connects to 10.0.1.5

  Has anyone never has something like this work?

  Y at - it a good solution?

  Thank you, Simon

  It is possible, but (assuming they already use NAT for Internet access) you'll need to define things very carefully to avoid interference with what they have.

  Do a complete translation of subnet is easy and is a good word:

  IP nat inside source static 10.0.0.0 network 192.168.0.0/24

  The problem is that this will replace all existing for this subnet NAT, condition and the existing NAT configuration.

  Can you provide an example of how the current NAT is set up for one of these sites?

• DMVPN BGP and EIGRP

  I am in the initial phase of research DMVPN.  We currently have an MPLS network running BGP.  Each site has Internet at home as well as a VPN site-to-site is built on the router and talks to an ASA when the SPLM fails.

  I want to implement DMVPN to do away with the site to site VPN and ASA.  I'm going to run EIGRP on routers to connect DMVPN.  Are there any good whitepapers on BGP as the main path and by EIGRP on the DMVPN as a backup?  Or no focus on a general config?

  Thank you

  It's really the main issue.

  With your configuration DMVPN roads will be internal EIGRP of an advertisement of 90, so your default DC prefer DMVPN on MPLS, which is exactly what you don't want.

  There are several ways around this as summarizing through DMPVN, redistribution connected on the sites of the branch in EIGRP so roads DMVPN are external as well and then changing measures etc.

  The other alternative I have ever done so it's for your information is really Cisco have what is called a solution IWAN where DMVPN is performed everywhere that is, even through the MPLS network.

  That would solve your problem of external routes internal EIGRP but IWAN vs is much more than just that, even if you do not need necessarily to implement the entire solution at a time.

  I just thought that it should be mentioned, and if you want more information on this I can direct you to the design guide.

  Jon

• DMVPN/IPSEC, GRE and IPSEC Multi Point

  Hi all

  I have a project of construction of 50 locations connectivity to my data center 2. Each location has Internet with router 877 with image dry.

  my DC has 1900 router. Now I want what tunnel I go with. DMVPN IPSEC or IPSEC GRE.

  The data will come from DC locations only. No inter connections location. I want to know the pros and cons as well as any change of required equipment.

  Kind regards

  Satya.M

  Given your criteria, I would say THAT DMVPN would be best suited

  Cisco - Configuration dynamic Multipoint Virtual Private Networks DMVPN

  Implementation in DMVPN GDOI

  Pete

• PSI triple with Cisco IOS XR

  Hey the Cisco Experts

  Greeting

  I've lost my way with config RPL, calling all of you to help me how config RPL looks for the scenario below, 2 X ASR 9006

  political 0utbound
  ===============

  1. LIKE 52 X accepts the local routes of 3 providors, as well as the default value for the rest of the internet routes
  2. the traffic destined to the ISP - 1 through ASR - 1
  3. the traffic destined to the ISP-2 goes via ASR - 1
  4. the traffic destined to the ISP - 3 through ASR - 2
  5. all other traffic prefer ISP of ASR-1-1
  6. If the link to ISP-1 breaks down the traffic should re - route via ASR - 1 ISP-2
  7. If the link to ISP-2 breaks down the traffic should re - route via ASR - 2 PSI-3

  Inbound policy
  ==============

  1. traffic is destinet at the subnet IP Internet shoud 91.X.X.X/24 come Via ASR - 1 ISP-1
  2 traffic is destinet at the subnet IP Internet shoud 92.X.X.X/24 come Via ASR - 1 ISP-2
  3. the traffic is destinet at the subnet IP Internet shoud 93.X.X.X/24 come Via ASR - 2 PSI-3
  4. If an ISP or link fails, other ISP should route traffic to ACE 52 X on the internet

  Thank you all

  Sayed Hassan Mubarak

  which seems good now! MPIO is enabled and that the two default routes will be used on a per flow basis. and if there is good distribution it will be close to 50%.

  If you want to take the bw in consideration and ratio 2:1 you must use the bandwidth of link dmz to help the BGP to understand the bandwidth of each link, so instead of 50-50 to us 66/33. You can read here how to configure the dmz link bw.

  article 5 of the best BGP path selection is as the path. the shortest path will win.

  in many cases of the load balancing across paths, the different available paths have different lengths of the AS path showing a shorter as hop count to the destination. With the way like ignore we can omit the PATH AS looking like a switch to a preferred route.

  ACE relax would negate the rule was for mpath which correspond to two AS-paths of all channels. It is also a stupid, since rule as in your case, you have different ISP and they will have different as-path sets and or length, each of these buttons do not know either of these two rules for review in the path.

  Xander

• Is it possible to use hub dual double cloud in Phase 1 DMVPN?

  Hello, I'm studying DMVPN in Phase 1. I'm doing a lab where I have 2 hubs and 2 spokes connected through 2 providers. In DMVPN phase 1, what I understand, destined for the tunnel must be configured manually (gre tunnel mode is point to point). But for each ray, I have 2 hubs. How can I specify addresses NBMA the two poles of the same tunnel interface IP spoke? I can only specify a single destination tunnel, then a hub.

  Hubs do not need four interfaces in this case, one by ISP is enough. You end up with the following connections by talk:

  Tun1-isps1 <->Tun1-isps1-Hub1
  Tun2-isps1 <->Tun1-isps1-Hub2
  Tun3-ISP2 <->Tun2-ISP2-Hub1
  Tun4-ISP2 <->Tun2-ISP2-Hub2

• DMVPN - PSK to Auth RSA - Sig move

  Hi all

  I'm moving a laboratory DMVPN config PSK has the use of certificates.

  Installed root CA + certificates without problem.

  I imagined it would be just a case of creating a different strategy on the hubs ISAKMP and rays and gradually introduce speaks talks about but I am receiving and error on the hub "x.x.x.x IKE message failed the validation test or is incorrect.

  the problem disappears if I remove the ISAKMP policy in the hub, he returns to the original policy of the PSK. I checked the correspondence of policies a million times and the certificates are installed properly.

  I have included some of the config below. Policy 10 works very well.

  any help appreciated. Thank you

  -Hub-
  crypto ISAKMP policy 5
  BA aes
  md5 hash
  !
  crypto ISAKMP policy 10
  md5 hash
  preshared authentication
  ISAKMP crypto key address 0.0.0.0 xxxxxxxxxxxxxxxxxx
  !
  !
  Crypto ipsec transform-set esp-3des esp-md5-hmac hand
  tunnel mode
  !
  Profile of crypto ipsec ProfileName
  define security-association life seconds 900
  transformation-home game
  !
  !
  !
  !
  !
  !
  !
  interface Tunnel0
  bandwidth 20480
  IP x.x.x.x 255.255.255.0
  no ip redirection
  IP 1400 MTU
  NBAR IP protocol discovery
  penetration of the IP stream
  IP nat inside
  property intellectual PNDH authentication Auth
  dynamic multicast of IP PNDH map
  PNDH IP network id ID
  IP virtual-reassembly in
  No cutting of the ip horizon
  IP tcp adjust-mss 1300
  CDP enable
  source of tunnel Dialer
  multipoint gre tunnel mode
  tunnel key X
  Profile of tunnel ProfileName ipsec protection
  -Speaks-
  crypto ISAKMP policy 5
  BA aes
  md5 hash
  !
  crypto ISAKMP policy 10
  md5 hash
  preshared authentication
  ISAKMP crypto keys xxxxxxxxxxx address 0.0.0.0
  !
  !
  Crypto ipsec transform-set main esp-3des esp-md5-hmac
  tunnel mode
  !
  Profile of crypto ipsec IProfile
  define security-association life seconds 900
  Set main transformation game
  !
  !
  !
  !
  !
  !
  !
  interface Tunnel0
  IP x.x.x.x 255.255.255.0
  no ip redirection
  IP 1400 MTU
  IP nat inside
  property intellectual PNDH authentication Auth
  dynamic multicast of IP PNDH map
  property intellectual PNDH card x.x.x.x where x.x.x.x
  map of PNDH IP x.x.x.x multicast
  PNDH IP network id X
  property intellectual PNDH nhs x.x.x.x
  IP virtual-reassembly in
  No cutting of the ip horizon
  IP tcp adjust-mss 1300
  source of tunnel Dialer
  multipoint gre tunnel mode
  tunnel key X
  Profile of tunnel Iprofile ipsec protection

  Your certificates seem to be good. TGE of time is very important. Comes with service horodateurs time of the journal is your clock the ntp.

  When everything is set correctly in view, I would be very interested to get all debugs them.

  This question you have is based on the key or certificate not authencating together, coukd be mtu, could be something else.

  Would you mind to provide all debugs them and perhaps a trace of wireshark to see what is happening. Debugs isakmp, ipsec and certificates as well.

  Thank you

• DMVPN PPPoe MTU

  Hello

  I have a problem with all the PPPoe on my network with DMVPN spoker. The problem is the stability of the DMVPN tunnel. All the spoker with PPPoe, I have a problem.

  When I do a ping on the spoker to the hub like this:

  ping [dest IP Hub] [local IP tunnel] penny I have only 50% of success.

  Spoker newspaper I have this message:

  % DOUBLE-5-NBRCHANGE: 1 IPv4 EIGRP: neighbour X.X.X.X (tunnels2) is falling: Peer received termination

  I'm sure it has to do with the mtu setting. Only int tunnel 2 on spoker that I try to play with ip mtu and mss size adjust tcp ip. Without success

  But is it normal if in int dialer1, I set the mtu to 1492 and I do it with a sh int 1 Dialer is the mtu 1500?

  I don't know what is the right recipe in this case, when I have several spoker PPPoe not all with the hub? Do I have to create another DMVPN just for spoker PPPoe? If Yes, what is the parameter I need to do for PPPoe with DMVPN. Do I have to adjust the mtu on the tunnel port? Time place, hub and spoker? Etc...

  Because if I use GRE with VPN over a distance where PPPoe is installed, I have more a problem. For the code and maintenance simplicity, I prefer to use DMVPN for sure. So, if it is possible to set it up, it will be nice.

  Thank you

  MTU must be set on the interface of tunnel for the hubs and spockes.

  If you want to save bits, you can even use transport mode instead of tunnel of fashion.

  Thank you

  PS: Please do not forget to rate and score as good response if this solves your problem