OSPF question

Router in new york who will be my ABR/ASBR, I redistributed ospf 200 with a default metric of 10 and router nycore I redistributed ospf metric by default of 1000 10.

When I'm running route ip on corertr1 I see the O THE road to router 192.168.13.0/28 2, but I see no way of nycore for 172.20.2.0/24.

On Router 2, using the ip see route displays O THE routes 172.16.111.0/24, 172.16.112.0/24, 172.16.113.0/24, 172.16.114.0/24, but once again no route from nycore for the 172.20.2.0/24 network.

But on nycore in that I see all routes announced for 1000 OSPF routing table.

What if I do something wrong? You responses will be very appreciated.

I am re-reading your response and can see that there are some errors in your topology. NYcore cannot have interfaces in zone 0 and 1 since it is connected to New York via zone 1 and itself has interfaces in zone 0 and 1 more. It breaks the contiguity of zone 0.

Hope this helps,

Tags: Cisco Network

Similar Questions

FlexVPN and OSPF question

I have a problem with rountig OSPF on the routers configured in the hub-and-spoke topology.

One question is on a course that OSPF don't advertise hub to rays.

Created on a hub, router subnets are not seen on the rays, but new added subnet on talk appears in the table of routing hub.

The addition of broadcast command network ip ospf on a virtual-template interface hub causes OSPF adjacency downstairs.

Also, EIGRP works very well.

A that someone has experienced this problem with OSPF.

Please, look at a few config below;

-----------------------HUB-------------------------------

IKEv2 crypto by default authorization policy

Road enabled interface

!

Crypto ikev2 proposal ikev2_prop

encryption aes-cbc-256

integrity sha512

Group 16

!

IKEv2 crypto policy ikev2_policy

proposal ikev2_prop

!

Crypto ikev2 keyring Flex_key

Rays peer

address 192.168.50.197

pre-shared key local 12345

pre-shared key remote 12345

!

peer RTB

address 192.168.50.199

pre-shared key local 12345

pre-shared key remote 12345

!

Profile of ikev2 crypto Flex_IKEv2

match one address remote identity 192.168.50.197 255.255.255.255

match one address remote identity 192.168.50.199 255.255.255.255

sharing front of remote authentication

sharing of local meadow of authentication

local Flex_key keychain

virtual-model 1

!

no default isakmp crypto policy

!

Crypto ipsec transform-set esp - aes 256 esp-sha512-hmac ipsec_trans

tunnel mode

!

by default the crypto ipsec profile

Set transform-set ipsec_trans

Flex_IKEv2 Set ikev2-profile

!

interface Loopback1

address 172.16.10.1 IP 255.255.255.0

IP ospf 10 area 0

!

interface Loopback10

10.1.1.1 IP address 255.255.255.0

IP ospf 10 area 0

!

interface Loopback50

IP 50.1.1.1 255.255.255.0

IP 10 50 ospf area

!

the Embedded-Service-Engine0/0 interface

no ip address

!

interface GigabitEthernet0/1

bandwidth 100000

IP 192.168.50.198 255.255.255.0

automatic duplex

automatic speed

!

type of interface virtual-Template1 tunnel

IP unnumbered Loopback1

IP 1400 MTU

IP tcp adjust-mss 1360

source of tunnel GigabitEthernet0/1

ipv4 ipsec tunnel mode

tunnel path-mtu-discovery

tunnel protection ipsec default profile

!

router ospf 10

redistribute connected subnets

Network 10.1.1.0 0.0.0.255 area 0

SH cryp ike his

IPv4 Crypto IKEv2 SA

Tunnel-id Local Remote fvrf/ivrf status

1 192.168.50.198/500 192.168.50.197/500 no/no LOAN

BA: AES - CBC, keysize: 256, Hash: SHA512, DH Grp:16, Auth sign: PSK, Auth check: PSK

Duration of life/active: 86400/77565 sec

Tunnel-id Local Remote fvrf/ivrf status

2 192.168.50.198/500 192.168.50.199/500 no/no LOAN

BA: AES - CBC, keysize: 256, Hash: SHA512, DH Grp:16, Auth sign: PSK, Auth check: PSK

Duration of life/active: 86400/77542 sec

IPv6 Crypto IKEv2 SA

SH ip rou

S * 0.0.0.0/0 [1/0] via 192.168.50.1

10.0.0.0/8 is variably divided into subnets, 2 subnets, 2 masks

C 10.1.1.0/24 is directly connected, Loopback10

L 10.1.1.1/32 is directly connected, Loopback10

50.0.0.0/8 is variably divided into subnets, 2 subnets, 2 masks

C 50.1.1.0/24 is directly connected, Loopback50

L 50.1.1.1/32 is directly connected, Loopback50

100.0.0.0/32 is divided into subnets, subnets 1

AI 100.1.1.1 [110/2] via 172.16.10.254, 21:32:58, Virtual Network1

172.16.0.0/16 is variably divided into subnets, 2 subnets, 2 masks

172.16.10.0/24 C is directly connected, Loopback1

L 172.16.10.1/32 is directly connected, Loopback1

192.168.50.0/24 is variably divided into subnets, 2 subnets, 2 masks

C 192.168.50.0/24 is directly connected, GigabitEthernet0/1

The 192.168.50.198/32 is directly connected, GigabitEthernet0/1

200.1.1.0/32 is divided into subnets, subnets 1

AI 200.1.1.1 [110/2] via 172.16.10.253, 21:32:38, Access2-virtual

201.1.1.0/32 is divided into subnets, subnets 1

AI 201.1.1.1 [110/2] via 172.16.10.253, 21:32:38, Access2-virtual

220.1.1.0/32 is divided into subnets, subnets 1

AI 220.1.1.1 [110/2] via 172.16.10.253, 00:06:11, Access2-virtual

---------------------------SPOKE---------------------------------------------

Crypto ikev2 proposal ikev2_prop

encryption aes-cbc-256

integrity sha512

Group 16

!

IKEv2 crypto policy ikev2_policy

proposal ikev2_prop

!

Crypto ikev2 keyring Flex_key

Rays peer

address 192.168.50.198

pre-shared key local 12345

pre-shared key remote 12345

!

Profile of ikev2 crypto Flex_IKEv2

match one address remote identity 192.168.50.198 255.255.255.0

sharing front of remote authentication

sharing of local meadow of authentication

local Flex_key keychain

virtual-model 1

!

no default isakmp crypto policy

!

!

Crypto ipsec transform-set esp - aes 256 esp-sha512-hmac ipsec_trans

tunnel mode

!

by default the crypto ipsec profile

Set transform-set ipsec_trans

Flex_IKEv2 Set ikev2-profile

!

interface Loopback200

200.1.1.1 IP address 255.255.255.0

IP ospf 10 200 area

!

interface Loopback201

IP 201.1.1.1 255.255.255.0

IP ospf 10 201 area

!

interface Loopback220

IP 220.1.1.1 255.255.255.0

IP ospf 10 220 area

!

Tunnel1 interface

IP 172.16.10.253 255.255.255.0

IP 1400 MTU

IP tcp adjust-mss 1360

source of tunnel GigabitEthernet0/1

ipv4 ipsec tunnel mode

tunnel destination 192.168.50.198

tunnel path-mtu-discovery

tunnel protection ipsec shared default profile

!

interface GigabitEthernet0/1

IP 192.168.50.199 255.255.255.0

automatic duplex

automatic speed

!

router ospf 10

network 172.16.10.0 0.0.0.255 area 0

SH cryp ike his

IPv4 Crypto IKEv2 SA

Tunnel-id Local Remote fvrf/ivrf status

1 192.168.50.199/500 192.168.50.198/500 no/no LOAN

BA: AES - CBC, keysize: 256, Hash: SHA512, DH Grp:16, Auth sign: PSK, Auth check: PSK

Duration of life/active: 77852/86400 sec

IPv6 Crypto IKEv2 SA

SH ip route

S * 0.0.0.0/0 [1/0] via 192.168.50.1

172.16.0.0/16 is variably divided into subnets, 2 subnets, 2 masks

172.16.10.0/24 C is directly connected, Tunnel1

L 172.16.10.253/32 is directly connected, Tunnel1

192.168.50.0/24 is variably divided into subnets, 2 subnets, 2 masks

C 192.168.50.0/24 is directly connected, GigabitEthernet0/1

The 192.168.50.199/32 is directly connected, GigabitEthernet0/1

200.1.1.0/24 is variably divided into subnets, 2 subnets, 2 masks

C 200.1.1.0/24 is directly connected, Loopback200

L 200.1.1.1/32 is directly connected, Loopback200

201.1.1.0/24 is variably divided into subnets, 2 subnets, 2 masks

C 201.1.1.0/24 is directly connected, Loopback201

L 201.1.1.1/32 is directly connected, Loopback201

220.1.1.0/24 is variably divided into subnets, 2 subnets, 2 masks

C 220.1.1.0/24 is directly connected, Loopback220

L 220.1.1.1/32 is directly connected, Loopback220

SH ip ospf database ro 172.16.10.1

Router OSPF with ID (200.1.1.1) (the process ID of 10)

Router link States (zone 0)

ADV router is accessible via is not in the Base with MTID topology 0

LS age: 336

Options: (no TOS-capability, DC)

LS type: Router links

Link state ID: 172.16.10.1

Advertising router: 172.16.10.1

LS number of Seq: 80000065

Checksum: 0x4B6E

Length: 60

Area border router

ROUTER limits

Number of links: 3

Link to: a Stub network

(Link ID) Network/subnet number: 10.1.1.1

(Data link) Network mask: 255.255.255.255

Number of parameters MTID: 0

TOS 0 metric: 1

Link to: another router (point to point)

(Link ID) Neighbors router ID: 100.1.1.1

(Data link) Address of the router Interface: 0.0.0.18

Number of parameters MTID: 0

TOS 0 metric: 1

Link to: another router (point to point)

(Link ID) The router ID neighbors: 200.1.1.1

(Data link) Address of the router Interface: 0.0.0.17

Number of parameters MTID: 0

TOS 0 metric: 1

Kamil,

A tunnel in this deployment (and VT / going also) is an interface point to point, there is really no good reason to keep anything other than 32 (I might not be aware of some subtleties in more complex deployment).

'Set interface route' is your greatest friend ;-)

M.

PIX OSPF question load balancing

I have a pix 515e with two default routes, via OSPF from two routers on the "outside" interface

Route #2 is currently being preferred spending much more than the #1 router. There are thousands of destinations for traffic. These two routers are still NAT nat rfc1918 IP Internet (the pix doesn't nat)

Can you get it someone please let me know how the PIX is load balancing? is it by destination IP address? is it something else?

Thank you

Joe

TAC:

"the PIX will be per destination load balancing instead of by package

load balancing. The algorithm will look at the source and destination

addresses. It is not 1:1 load balancing. Given quite different

the source address and destination, the packets will reach more or less one

spindle of 50-50 between the two next-hops. However, in the real world test

with the same source and destination addresses, it may not reach the same

load balancing. »

Question of offset for the OSPF mtu

Hello

I have following cisco catalyst and OSPF running switches.

3750G (C3750-ADVIPSERVICESK 12.2 (25) SED1)

3750 X (C3750E-UNIVERSALK9-M 15.0 (1) SE3)

3850 (cat3k_caa-universalk9 03.02.01.SE)

They are all connected through the WAN L2 (192.168.40.x/24 star topology)

Link 3750 X 3850 does not state in its own RIGHT.

I think it's because that incompatibility of MTU.

3750G VLAN60 SVI mtu 1500

3750 X VLAN60 SVI mtu 1500

3850 VLAN60 SVI mtu 9198

But 3750G complain about anything whatsoever and stay a State COMPLETE and 3750 X 3850.

The output of the show ip ospf will tell about each switch is similar to the following.

3750G (ID: 10.10.11.1 IP address: 192.168.40.101)

Neighbor ID Pri State Dead Time Interface address

2.2.2.2 1 FULL/DROTHER 00:00:36 192.168.40.102 Vlan60

3.3.3.3 1 FULL/BDR 00:00:33 192.168.40.103 Vlan60

3750 X (ID: IP address 2.2.2.2: 192.168.40.102)

Neighbor ID Pri State Dead Time Interface address

3.3.3.3 EXSTART/BDR 1 00:00:36 192.168.40.103 Vlan60 (rehearsal EXSTART > down)

10.10.11.1 1 FULL/DR 00:00:30 192.168.40.101 Vlan60

3850 (address IP ID:3.3.3.3: 192.168.40.103)

Neighbor ID Pri State Dead Time Interface address

2.2.2.2 EXSTART/DROTHER 1 00:00:38 192.168.40.102 Vlan60 (rehearsal EXSTART > down)

10.10.11.1 1 FULL/DR 00:00:32 192.168.40.101 Vlan60

I think that if I changed the MTU on 3850 to 1500 (ip mtu) 1500, all seem to be OK.

But the question is why 3750G do not complain now.

Thanks in advance,

Taro

Simulated, but didn't work as I thought seems mtu must match, why 3750g worked with low mtu, I don't know. But like told u, or the other less than 3800 mtu setting or configuration ip ospf mtu - ignore the problem resolves.
Other expertise can feed some light to the behavior. bug in iOS?

Sent by Cisco Support technique iPhone App

OSPF quick Convergence on specific links in a network.

Hello

I have a couple of question regarding the acceleration of the convergence of OSPF to help me understand it better.

In this case, I would like to speed up the OSPF convergence failure occurred between two specific locations without causing problems for the other routers on the network. These two sites are part of the area of the spine. The two communities have two connection point to point between them on two different routers at each end.

R1---(Serv Provider1) - R3

SiteA Site B

---(Serv fournisseur 2) - R4 R2

All I see there are two main factors controlling the rapid convergence of OSPF.

1. the breach of the detection time.

2. propagation of error / time recalulation FPS.

The first factor - failure detection time can be reduced by decreasing the OSPF Hello/dead or using BFD programmable intervals to detect the failure. What is the best option?

Of what I see if using timers in OSPF Hello/dead I should only match values of timer on router interfaces on part and on the other of my links point to point and could leave other interfaces as they are. Is this correct?

Consider the second part - by strangling the timers of SPF, OSPF SPF computation time is reduced. New account my two links Point to what I can fix timers on the routers to share back and forth across the point-to-point link or I have to put the same on all routers in the OSPF network.

("Timers SPF throttle"command).

Hi Pat,
```
Regarding the SPF hold timers. to confirm is there any issue with having different values on different routers in the network. I presume not as the value is random anyway?
```
the values to see the SPFA is always a compromise: on the one hand you don't want a permanent recalculation caused by a link heartbeat, on the other hand, expect a rapid convergence. It means finding values that meet the requirements in terms of stability and convergence at the same time.

I think that the main problem with different values in a box is micro-boucles. Since the new calculation (and update routing tables) not be made never exactly at the same time on routers, link-state routing protocols can produce short times with micro-boucles once the topology changes because some transfer tables are updated as soon as the others (we are talking about tens-hundreds of milliseconds).

If you change the FPS-timer to say that 1 second or even less and other routers in the region still have the default (which is 5 seconds), the period of time where are micro-boucles may occur could be considerably long and that there could be a side effect, according to the topology/design.

Hope that helps

Rolf

OSPF and balancing

Hi all

I have 2 - E1 links from place A to place b. I am running OSPF in the network.

For both the serial interface, I gave cost ospf as 100.

How can I configure loadbalancing over links series that takes place in OSPF?

Is - is my setup load balancing?

How to verify that OSPF is loadbalancing links?

Hello

You need not specifically configure OSPF to balance the load too long that the two links have the same administrative distance then your peer routers will learn the same routing information from two different IP addresses that are the opposite of your E1 links.

To check if you are balancing you can use 'show ip route '.

The following example uses EIGRP but this will output similar to OSPF with different codes and distance from the admin:

D [90/289536] 192.168.72.0/24 through 10.48.1.2, 1w2d, FastEthernet4/1/1

[90/289536] through 10.48.1.6, 1w2d, FastEthernet0/1/1

You can see that 192.168.72.0/24 is announced two IP addresses.

You can do per package or per destination load balancing, I think that by default on a fast router switching is enabled, which means the load balancing is done by destination. If you want to package you can disable the quick change on the interface in question using "no ip route-cache".

HTH

PJD

Notice to Cisco employees who ask questions

Would it not possible to display a screen to tips for Cisco employees when they appear?

I understand that they need to find answers for them and their customers, but some of their questions are a bit annoying, for example "How do I configure OSPF?

In the old interface, there was a banner when you want to create a new discussion, but I tried it and now you get nothing, if you try to create a new thread.

I agree that old warning on the accounting should be, I mean, we have a lot of internal resources, we can use instead.

Java

BGP, OSPF with default route

Hello

My branch becomes internet through seat & connected through lease line and ospf is running. a static route id 0.0.0.0 set to HO.

Now an additional link is added to our extensive network of MPLS link redundancy & EBGP is running.

My question is how to configure ospf route (my internal network) to bgp & default (for internet) route for connectivity?

Please help with examples.

Thank you

For the internet, you need a default route. I am assuming that you will get by default route of MPLS as well so leased will remain DEFAULT road get MPLS BGp inject into LAN by this command that I already added to your config file.

router ospf xxx

default information are created

!

Also if you connect line Lased and MPLS on the same router then router chooses MPLS as the main path as favorite eBGP and ospf. If you ave to change AD BGP routes to ospf will get better than BGP. Use in config for leased line primary and secondary MLP.

router bgp xxx

BGP distance 200 200 200

!

Passive routes with OSPF on the PIX

Hello

Having just upgraded my PIX to software v8 finally hoping to participate in OSPF on the network.

The PIX have all many DMZ I want to advertise on OSPF to remove a * much * of fragile static routes but of course I would * not * advertise or get OSPF of these demilitarized. I thought I could do these interfaces passive - or better still, question:

router ospf 1
passive-interface default

And then exempt only the internal interface.

However, (unlike IOS) it seems to be without notion of passive in the implementation of OSPF from the PIX - a place where I thought it would be very useful...

How to distribute the these DMZ on OSPF without advertising OSPF in them?

I had planned to use:

redistributed connected subnets

However, which redistributes things like the public interface of the Internet, I don't want to. In addition, even if there is a way to stop there including the public interface, it seems more prone to the error of the user than passive by default with one exception.

Any ideas? If this is not the case, can I restrict the interfaces in connected subnets redrawn?

Thanks for all the ideas!

Hi Peter,.

Thank you, Yes... I was suggesting to remove network dmz under the OSPF process commands. As you said, it used to really do what you want to do with the removal of the static since its disabling ospf for this network.

Start-up eigrp would seem to be a lot of extra work just to eliminate the static if that's what it will be used for, but it would allow you to make the passive interface that would not accomplish snd/RRs eigrp on the specific interface.

I just re-read your first message and I think I understand now what you're after - which goes back to your first survey of redistribution... you can redistribute static electricity and use a road map to control what roads you want to redistribute. You can then remove the networks for the demilitarized zone under router ospf process.

example:
```
access-list ospfredist standard permit 10.10.10.0 255.255.255.0

access-list ospfredist standard permit 192.168.10.0 255.255.255.0
route-map static-ospf

  match ip address ospfredist
router ospf 10

  redistribute static subnets route-map static-ospf
this should redistribute only the statics that you listed above.
hope this helps a bit.
-scott
```

OSPF on PIX w / 6.2

Code OK 6.3 is out of the question for this example. I'm looking for solutions for 6.2 code only. Thanks in advance!

Here is the configuration:

(r1---> area 1 in) | PIX | area 1---> (fate) r2 s0/0---> - 0

AS 1 is R1, r2 is AS 2 and zone out interface s0/0 0. R1 has also zone 2 out interface s0/0. I'm looking for examples on how to run OSPF from r1 to r2 r1 being in zone 2 and r2 being in zone 0 without using a GRE tunnel. I was able to redistribute OSPF via BGP, but this would be the best/only solution... ? Any suggestion would be great.

Jeff,

In the solution, I've implemented BGP passed the single protocol for routing through the firewall. Initially, I tried to put the PIX up to allow traffic through thinking I could use the neighboring OSPF for routers could see each other. The operation failed because this feature also uses multicast traffic, which falls the PIX.

So ultimately I redistributed BGP OSPF, routing through the firewall in the tunnel information and redistributed into OSPF.

I didn't try to use a virtual link, but as OSPF relies heavily on multicast traffic I don't know that such a link also fails.

Virtual links are often described as 'tunnels' but which is intended to promote the understanding of the concept, they operate only at breast contiguous OSPF networks.

6.3 sounding attractive yet?

Bad VPN ASA injection road on OSPF when using remote access

Has anyone ever seen the ASA by inserting a bad road in a connection that has been set up with it? I'll explain more below:

I'm using a reverse road Injection. When access remotely with IPSEC (CLIENT) connects to the camera ASA, ASA create a static route to the remote access to the closest router for the SAA to come to this remote access. This itinerary is distributed on OSPF. OK, it may be a normal situation. But, the problem is when I ask another participant of this OSPF area, which is the road to this remote access (CLIENT), the answer is the router closer to the ASA and don't have to ASA. Does anyone have a solution for this? I tried to create a roadmap but that you did not.

If I understand your question, my question for you is whether the OSPF route to the remote VPN client is source by ASA or another device?

Is the IP address in the space I wrote ASA_ROUTER_ID ASA router ID or it is the router from another device ID? What I've listed below are an example of the output of "show ip route. The value in bold must be ASA router ID, if she is from the road to the VPN client. Other OSPF routers will forward packets destined to VPN to ASA client.

#sh ip route 1.1.1.0
Routing for 1.1.1.0/24 entry
Known through the "ospf 1", metric 110, distance 310, type intra zone
Last updated on GigabitEthernet0 1.2.2.2, 2w there
Routing descriptor blocks:
* 1.2.2.2, ASA_ROUTER_ID, there is, through GigabitEthernet0 2w
Path metric is 310, number of shares of traffic 1

OSPF on VPN GREoIPSec.

Hello.

I have a network where some spoke of routers (branch offices, all routers are 2811) to connect with the IPSec VPN on adsl lines to my office and an ASA 5540. There is also a central backup with an another ASA 5540 site where VPN end in the case of primary failure asa.

So at each router spoke there is a card encryption with these two counterparts. A default primary and the other as secondary. Primary and secondary offices communicate with each other via a line of metro ethernet.

I want to do is put a router behind accessible of these two ASA to two of them, and then create the GRE tunnels since spoke to the hub router routers and run the Protocol ospf or eigrp on them. You can see the configuration that I am creating in the attached jpeg.

My question is if it will work. It's going to be able to detect whether some were talking about lost the connection to the primary and correctly connected to the secondary and before traffic site? He really care what site connects the router speaks, or what he wants is connectivity from tunnel to tunnel only? And you prefer ospf or eigrp? All equipment is cisco.

Any help would be much appreciated. Thanks in advance.

Hello!

First of all the forums is probably not the best place to ask questions about the design, I would typically tell people to run their Cisco SE ;-)

That being said, here goes. My two cents.

The concept is not without it's charm, even if it looks like instead of using two hub routers DMVPN you really want IPsec for ASAs unloading.

That's ok.

Standard IPsec, several counterparts etc while in in theory ensure the traffic is on the Hub...

How did you change between ASA and hub failure on the path of routing?

I mean say tunnels to ASA elementary school go down because of the failure of the ISP, how does the hub know not to send traffic to the primary and send it to the backup?

I can see reverse road injection + dynamic redistribution in PR as a possibility, not without its flaws.

Possibilibity another would be to run OSPF (via neighbor) across the Board (SAA can run OSPF on IPsec when you use nearby, because we avoid multicast).

It also seems that GRE tunnel(s?) must be from a loopback interface, which means the need for the ASAs where it is ;-)

If you don't mind a suggestion.

Why not have two tunnels WILL, of each spoke to two "hubs" (a hub behind each ASA)...

Two tunnels of all time might mean actually you can try to load sharing, balance the traffic on two location.

Just thinking aloud I don't know about the context and requirements.

Versus EIGRP OSPF. I don't want to start a flame war, so I would say it depends :-)

Especially on what you have in the network, that the final goal is etc etc...

Hope this helps,
Marcin

OSPF on IPSec updates

Hello

I have 3 locations that this places is connected through the internet between them. We use ASA 5505 and 5510. It is possible to use OSPF or do I use IPP?

Thank you

Markus

Hello

Check and see if it answers your question:

http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00804acfea.shtml

Thank you

Jeet Kumar

VPN site2site & VPN client dailin on the question of a single interface

Hello dear colleagues,

First of all, the question of information subsequently:

Setup

C2801 race

(C2801-ADVENTERPRISEK9-M), Version 12.4 (25f)

----------                                                    ----------

| Central | Di1 IP:80.153.xxx.xxx | DISTANCE | IP: 91.218.xxx.xxx

| Router | <----------------------------------------->     | Router |

-IPsec via GRE Tu1 - works | Debian |

^                                                   |          |

|                                                     ----------

|    does not work

|---------------------------------------->-------------------

| Cisco VPN | Intellectual property: all

| Customer |

-------------------

!

AAA authentication login default local activate

AAA authentication login local VPN_Users

RADIUS group AAA authorization network default authenticated if

AAA authorization VPN_Users LAN

!

AAA - the id of the joint session

iomem 20 memory size

clock timezone THIS 1

clock summer-time EST recurring last Sun Mar 02:00 last Sun Oct 03:00

IP cef

!

username myVPN secret 5

!

!

crypto ISAKMP policy 1

BA 3des

preshared authentication

Group 2

life 3600

address key crypto isakmp xauth No. 91.218.xxx.xxx

ISAKMP crypto nat keepalive 20

!

Configuration group customer isakmp crypto VPN_dialin

key

DNS 192.168.198.4

domain example.com

pool VPN

ACL VPN

Crypto isakmp VPNclient profile

match of group identity VPN_dialin

client authentication list VPN_Users

ISAKMP authorization list VPN_Users

client configuration address respond

!

Crypto ipsec security association idle time 3600

!

Crypto ipsec transform-set esp-3des esp-sha-hmac hostb-transform

transport mode

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA-LZS, hmac-sha-esp esp - aes comp-lzs

!

!

crypto dynamic-map vpn-dynamic-map 10

game of transformation-ESP ESP-AES-128-SHA-AES-128-SHA-LZS

Define VPNclient isakmp-profile

!

!

!

HostB-cryptomap 1 ipsec-isakmp crypto map

the value of 91.218.xxx.xxx peer

the transform-set hostb-transform value

PFS group2 Set

corresponds to hostb-address list

!

dynamic map crypto hostb-crytomap 65535-isakmp ipsec vpn-dynamic-map

!

!

!

!

!

!

Tunnel1 interface

bandwidth 100000

IP vrf forwarding vl199

IP 10.0.201.2 255.255.255.0

IP 1400 MTU

IP nat inside

IP virtual-reassembly

IP ospf network point

source of Dialer1 tunnel

destination 91.218.xxx.xxx tunnel

bandwidth tunnel pass 10000

bandwidth tunnel receive 50000

!

interface Dialer1

Description # PPPoE T-Online.

MTU 1492

bandwidth 50000

IP ddns update hostname it-s - dd.dyndns.org

IP ddns update it-s-dd_dyndns_org

the negotiated IP address

NAT outside IP

IP virtual-reassembly max-pumping 512

encapsulation ppp

IP tcp adjust-mss 1452

no ip mroute-cache

Dialer pool 1

Dialer idle-timeout 0

persistent Dialer

KeepAlive 20

No cdp enable

Authentication callin PPP chap Protocol

PPP chap hostname

PPP chap password 7

PPP pap sent-username password 7

PPP ipcp dns request

card crypto hostb-cryptomap

Crypto ipsec fragmentation after encryption

!

!

local pool IP VPN 192.168.196.30 192.168.196.60

IP forward-Protocol ND

IP route 0.0.0.0 0.0.0.0 Dialer1 track 1

IP route 0.0.0.0 0.0.0.0 Tunnel1 20 Track3

IP route 0.0.0.0 0.0.0.0 Dialer1 254

IP route vrf vl199 0.0.0.0 0.0.0.0 192.168.1.251

IP route vrf vl99 0.0.0.0 0.0.0.0 192.168.3.1

!

The dns server IP

!

no ip address of the http server

no ip http secure server

TCP-time translation nat IP 3600

translation of nat IP udp-timeout 600

IP nat Pat_for_192.168.198.4 192.168.198.4 pool 192.168.198.4 netmask 255.255.255.0 type

IP nat Pat_for_192.168.200.50 192.168.200.50 pool 192.168.200.50 netmask 255.255.255.0 type

IP nat inside source static 5060 udp interface 192.168.200.50 Dialer1 5060

IP nat inside source static tcp 192.168.200.51 3389 3389 Dialer1 interface

IP nat inside source static tcp 192.168.198.4 3389 interface Dialer1 3390

IP nat inside source static tcp 192.168.198.9 interface 5000 Dialer1 5000

IP nat inside source overload map route dialer1 interface Dialer1

IP nat inside interface 13001 static udp 192.168.199.3 source Dialer1 13001

IP nat inside interface 32768 static udp 192.168.179.2 source Dialer1 32768

IP nat inside source static udp 192.168.179.2 Dialer1 49152 49152 interface

IP nat inside interface 64206 static udp 192.168.179.2 source Dialer1 64206

IP nat inside source static udp 192.168.179.2 interface 7597 Dialer1 7597

IP nat inside source static tcp 192.168.179.2 9998 interface Dialer1 9998

IP nat inside source static tcp 192.168.179.2 7597 interface Dialer1 7597

IP nat inside source static tcp 192.168.179.2 64206 interface Dialer1 64206

IP nat inside source static tcp 192.168.179.2 Dialer1 49152 49152 interface

IP nat inside source static tcp 192.168.179.2 Dialer1 32768 32768 interface

IP nat inside source static tcp 192.168.198.4 interface 443 443 Dialer1

IP nat inside destination list Pat_for_192.168.198.4 pool Pat_for_192.168.198.4

IP nat inside destination list Pat_for_192.168.200.50 pool Pat_for_192.168.200.50

!

Pat_for_192.168.198.4 extended IP access list

Note = Pat_for_192.168.198.4 =-

permit tcp any any eq www

permit tcp any any eq 987

permit tcp any any eq 143

permit tcp any any eq 993

permit tcp any any eq pop3

permit tcp any any eq 995

permit tcp any any eq 587

permit tcp any any eq ftp

permit tcp any any eq ftp - data

permit tcp any any eq smtp

Pat_for_192.168.200.50 extended IP access list

Note = Pat_for_192.168.200.50 =-

allow udp everything any 10000 20000 Beach

permit tcp everything any 5222 5223 Beach

allow udp any any eq 4569

permit any any eq 5060 udp

list of IP - VPN access scope

IP 192.168.198.0 allow 0.0.0.255 192.168.196.0 0.0.0.255

permit ip host 80.153.xxx.xxx 192.168.196.0 0.0.0.255

list hostb extended IP access list

permit ip host 91.218.xxx.xxx host 80.153.xxx.xxx

permit ip host 80.153.xxx.xxx host 91.218.xxx.xxx

permit ip host 10.0.201.2 10.0.201.1

!

!

access-list 10 permit 192.168.200.6

access-list 100 permit ip 192.168.0.0 0.0.255.255 everything

access-list 100 permit ip 10.1.0.0 0.0.255.255 everything

access-list 100 permit ip 10.0.0.0 0.0.255.255 everything

access-list 101 permit ip 192.168.199.3 host everything

access-list 101 permit ip 192.168.199.4 host everything

access-list 101 permit ip 192.168.199.13 host everything

access-list 101 permit ip 192.168.199.14 host everything

access list 101 ip allow any host 204.13.162.123

access-list 103 allow ip 10.0.1.0 0.0.0.255 any

!

dialer1 allowed 10 route map

corresponds to the IP 100

match interface Dialer1

!

!

####################################################################################################

SH crypto isakmp his:

status of DST CBC State conn-id slot

91.218.xxx.xxx 80.153.xxx.xxx QM_IDLE 7 0 ACTIVE

80.153.248.167 QM_IDLE 12 0 ASSETS

######################################################################################

SH encryption session

Current state of the session crypto

Interface: Virtual-Access5

The session state: down

Peer: port of 91.218.xxx.xxx 500

FLOW IPSEC: allowed ip host 10.0.201.2 10.0.201.1

Active sAs: 0, origin: card crypto

FLOW IPSEC: allowed ip host 80.153.xxx.xxx host 91.218.xxx.xxx

Active sAs: 0, origin: card crypto

FLOW IPSEC: allowed ip host 91.218.xxx.xxx host 80.153.xxx.xxx

Active sAs: 0, origin: card crypto

Interface: Dialer1

The session state: UP-NO-IKE

Peer: port of 91.218.xxx.xxx 500

IKE SA: local 80.153.xxx.xxx/500 remote 91.218.xxx.xxx/500 inactive

FLOW IPSEC: allowed ip host 10.0.201.2 10.0.201.1

Active sAs: 0, origin: card crypto

FLOW IPSEC: allowed ip host 80.153.xxx.xxx host 91.218.xxx.xxx

Active sAs: 4, origin: card crypto

FLOW IPSEC: allowed ip host 91.218.xxx.xxx host 80.153.xxx.xxx

Active sAs: 0, origin: card crypto

Interface: Dialer1

The session state: IDLE-UP

Peer: port of 55033

ITS IKE: local 80.153.xxx.xxx/4500 distance 55033 Active

################################################################################################################################

Error message:

020932: 2 Oct 21:55:14.459 CEST: IPSEC (validate_transform_proposal): No IPSEC cryptomap is to address local 80.153.xxx.xxx

020933: 2 Oct 21:55:14.459 CEST: IPSEC (validate_proposal_request): part #1 of the proposal

(Eng. msg key.) Local INCOMING = 80.153.xxx.xxx, distance =,.

local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

remote_proxy = 192.168.196.32/255.255.255.255/0/0 (type = 1),

Protocol = ESP, transform = esp - esp-md5-hmac (Tunnel-UDP).

lifedur = 0 and 0kb in

SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 400

020934: 2 Oct 21:55:14.459 CEST: IPSEC (validate_transform_proposal): No IPSEC cryptomap is to address local 80.153.xxx.xxx

020935: 2 Oct 21:55:14.459 CEST: IPSEC (validate_proposal_request): part #1 of the proposal

(Eng. msg key.) Local INCOMING = 80.153.xxx.xxx, distance = ,.

local_proxy = 0.0.0.0/0.0.0.0/0/0 (type = 4),

remote_proxy = 192.168.196.32/255.255.255.255/0/0 (type = 1),

Protocol = ESP, transform = null esp esp-md5-hmac (Tunnel-UDP).

lifedur = 0 and 0kb in

SPI = 0 x 0 (0), id_conn = 0, keysize = 0, flags = 0 x 400

#################################################################################################

I tried to understand where is my mistake, can someone help me find it?

Thank you very much

concerning
```
crypto map hostb-crytomap 65535 ipsec-isakmp dynamic vpn-dynamic-map
```
is the fault of typing in the name as in your original config?

--
Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
http://www.Kiva.org/invitedBy/karsteni

DMVPN double with OSPF

Hi all

I tried to set this up for a while now, but there is a question that threatens. Can I get something that looks like this?

Whenever I try this config, I find that I can not route through the backup tunnel. If anyone can shed some more light on if this is possible, or config warnings, etc., it would be very appreciated!

Also, can someone point me to a good document about how configure single cloud double hub with OSPF? I can't seem to find a...

Kind regards

Xavier

I second what Marcin says about this... I was able to complish the same thing through you GNS

For the part of the document, see this link, do not know whether you have already:

- http://www.cisco.com/en/US/tech/tk583/tk372/technologies_white_paper09186a008018983e.shtml#dualhubsingle

HTH,

Mo.

OSPF question

Similar Questions

Maybe you are looking for