VTI & OSPF tunnel

Hi all

I have configured the interfaces of tunnel VTI (ipv4 ipsec tunnel mode) and OSPF on which interacts.

VTI is encrypt all traffic data. But what about the OSPF traffic?

Is encrypted as OSPF traffic or I need to configure OSPF authentication?

Thank you

OSPF Exchange is already encrypted inside the tunnel, so u don't have to use the ospf authentication. OSPF uses IPs of tunnel for the communications and traffic between these two addresses is possible only through the secure tunnel.

Tags: Cisco Security

Similar Questions

A Site with IPsec without restoring a new tunnel

Hello, I have a question about IPSec S2S.

Network.PNG

In this topoloy, I would like to that IPSec S2S between 172.21.0.0/24 and 172.22.0.0/24.

The serial line is the first priority and route on ISP is the second priority for routing.

The question is how can I create the IPsec Site to Site connection without restore when the routing path changes?

The AR configuration:

!
version 15.1
no service the timestamps don't log datetime msec
no service timestamps debug datetime msec
no password encryption service
!
hostname AR
!
!
!
!
!
!
!
!
no ip cef
No ipv6 cef
!
!
!
username cisco password 0 BR
!
!
license udi pid CISCO2901/K9 sn FTX1524YO05
licence start-up module c2900 technology-package securityk9
!
!
!
crypto ISAKMP policy 10
BA 3des
md5 hash
preshared authentication
Group 2
!
cisco key crypto isakmp 10.0.0.2 address
address of cisco crypto isakmp 200.200.200.2 keys
!
!
!
Crypto ipsec transform-set esp-3des esp-sha-hmac TS
!
CMAP 10 ipsec-isakmp crypto card
defined peer 10.0.0.2
defined by peer 200.200.200.2
game of transformation-TS
match the vpn address
!
!
!
!
!
!
pvst spanning-tree mode
!
!
!
!
!
!
interface GigabitEthernet0/0
IP 100.100.100.2 255.255.255.252
automatic duplex
automatic speed
card crypto WCPA
!
interface GigabitEthernet0/1
IP 172.21.0.254 255.255.255.0
automatic duplex
automatic speed
!
interface Serial0/0/0
the IP 10.0.0.1 255.255.255.252
encapsulation ppp
Chap PPP authentication protocol
2000000 clock frequency
card crypto WCPA
!
interface Serial0/0/1
no ip address
2000000 clock frequency
Shutdown
!
interface Vlan1
no ip address
Shutdown
!
router ospf 1
Log-adjacency-changes
Network 10.0.0.0 0.0.0.3 area 0
network 172.21.0.0 0.0.0.255 area 0
!
router RIP
version 2
network 100.0.0.0
network 172.21.0.0
No Auto-resume
!
IP classless
!
IP flow-export version 9
!
!
list of IP - vpn access scope
IP 172.21.0.0 allow 0.0.0.255 172.22.0.0 0.0.0.255
!
!
!
!
!
Line con 0
!
line to 0
!
line vty 0 4
opening of session
!
!
!
end

Configuration of BR:

!
version 15.1
no service the timestamps don't log datetime msec
no service timestamps debug datetime msec
no password encryption service
!
hostname BR
!
!
!
!
!
!
!
!
no ip cef
No ipv6 cef
!
!
!
Cisco spends 0 username AR
!
!
license udi pid CISCO2901/K9 sn FTX1524L63A
licence start-up module c2900 technology-package securityk9
!
!
!
crypto ISAKMP policy 10
BA 3des
md5 hash
preshared authentication
Group 2
!
cisco key crypto isakmp 10.0.0.1 address
address of cisco crypto isakmp 100.100.100.2 keys
!
!
!
Crypto ipsec transform-set esp-3des esp-sha-hmac TS
!
CMAP 10 ipsec-isakmp crypto card
defined peer 10.0.0.1
defined by peer 100.100.100.2
game of transformation-TS
match the vpn address
!
!
!
!
!
!
pvst spanning-tree mode
!
!
!
!
!
!
interface GigabitEthernet0/0
IP 200.200.200.2 255.255.255.252
automatic duplex
automatic speed
card crypto WCPA
!
interface GigabitEthernet0/1
IP 172.22.0.254 255.255.255.0
automatic duplex
automatic speed
!
interface Serial0/0/0
the IP 10.0.0.2 255.255.255.252
encapsulation ppp
Chap PPP authentication protocol
card crypto WCPA
!
interface Serial0/0/1
no ip address
2000000 clock frequency
Shutdown
!
interface Vlan1
no ip address
Shutdown
!
router ospf 1
Log-adjacency-changes
Network 10.0.0.0 0.0.0.3 area 0
network 172.22.0.0 0.0.0.255 area 0
!
router RIP
version 2
network 172.22.0.0
network 200.200.200.0
No Auto-resume
!
IP classless
!
IP flow-export version 9
!
!
list of IP - vpn access scope
IP 172.22.0.0 allow 0.0.0.255 172.21.0.0 0.0.0.255
!
!
!
!
!
Line con 0
!
line to 0
!
line vty 0 4
opening of session
!
!
!
end

Thank you very much!

Although you might go this route, I wouldn't.

I would use VTI (GRE tunnels that run over IPSec) interfaces. One on the series circuit and the other on the circuit of the ISP.

You can then either use GRE KeepAlive to detect which tunnels are in place and use static routes or dynamic routing as EIGRP Protocol (put a higher value of the 'bandwidth' with the 'bandwidth' command on the favorite tunnel).

GRE with VPN IPSec with OSPF

Gents,

This is my first post ever here, on this platform, I have a problem to Setup GRE tunnel with IPSEC with OSPF tunnel... I have 2 sites connected to my HQ (Media is VSAT). I want all the encriptación data + Multicast Ospf enabled...

Can I do it with DWVPN using SDM - I did a single document to this topic but its all about IEGRP OSPF not...

Anyone please help me with this problem... If anyone NEED any other information please update me... I'll be happy to do...

Thanking you in anticipation.

Tabuk router is misconfigured:

defined by peer 172.31.111.93

This should be

defined by peer 172.31.111.97

Concerning

Farrukh

WebVPN split and VTI

Hi all

We have a router in 1841 with enable webvpn and the split tunneling. This router is also connected to a second office using a VTI. We would like the remote clients of webvpn (using anyconnect) accessing the remote network through VTI.

Office network 1: 192.168.10.0

Office 2 (remote) network: 192.168.11.0

I think split webvpn with tunneling installation is properly install, however I do not know how to get the 192.168.60.0 package (pool dhcp client webvpn) to 192.168.11.0 network.

Does someone have an idea?

Kind regards

Olivier

Router config:

interface Tunnel0

VTI description to the office 2

192.168.50.1 IP address 255.255.255.0

source of Dialer1 tunnel

ipv4 ipsec tunnel mode

destination 217.x.x.133 tunnel

tunnel path-mtu-discovery

protection of profile vti ipsec tunnel

!

interface FastEthernet0/0

LAN Interface Description

IP address 192.168.10.254 255.255.255.0

IP nat inside

IP virtual-reassembly in

automatic duplex

automatic speed

!

ATM0/0/0 interface

no ip address

No atm ilmi-keepalive

!

point-to-point interface ATM0/0/0.1

PVC 8/35

aal5mux encapsulation ppp Dialer

Dialer pool-member 1

!

!

interface Dialer1

Description for ADSL

the negotiated IP address

NAT outside IP

IP virtual-reassembly in

encapsulation ppp

Dialer pool 1

Authentication callin PPP chap Protocol

PPP chap hostname x

PPP chap password 7 x

!

IP pool local PoolVpnAdsl 192.168.60.1 192.168.60.10

IP forward-Protocol ND

!

IP nat inside source overload map route IspADSL interface Dialer1

IP route 0.0.0.0 0.0.0.0 Dialer1

IP route 192.168.11.0 255.255.255.0 192.168.50.2

!

exploitation forest esm config

access-list 10 permit 192.168.10.0 0.0.0.255

access-list 10 deny all

access ip-list 100 permit a whole

Dialer-list 1 ip protocol allow

!

allowed IspADSL 1 route map

corresponds to the IP 10

match interface Dialer1

!

WebVPN gateway GateSslAdsl

IP address 193.x.x.113 port 443

redirect http port 80

SSL trustpoint xxx

development

!

WebVPN context VpnSslAdsl

SSL authentication check all

!

!

policy_1 political group

functions compatible svc

SVC-pool of addresses "PoolVpnAdsl."

SVC Dungeon-client-installed

SVC split dns 'domain.dom '.

SVC split include 192.168.10.0 255.255.255.0

SVC split include 192.168.11.0 255.255.255.0

Primary dns 192.168.10.X SVC-Server

Group Policy - by default-policy_1

XauthRadius of AAA authentication list.

Gateway GateSslAdsl

development

Hi Olivier,.

You must change your extended '10' to an ACL ACL

"access-list 10 permit 192.168.10.0 0.0.0.255.

Please create an ACL 101 as shown below.

access-list 101 deny ip 192.168.60.0 0.0.0.255 192.168.11.0 0.0.0.255

access-list 101 deny ip 192.168.11.0 0.0.0.255 192.168.60.0 0.0.0.255

access-list 101 permit ip 192.168.10.0 0.0.0.255 any

Delete this line: IspADSL route map permit 1

Delete this line: corresponds to the IP 10

allowed IspADSL 1 route map

corresponds to the IP 101

In addition, please make sure you that you have a static route in place other end of TIV to push "192.168.60.0 0.0.0.255.

Let me know if it helps.

Thank you

Post edited by: Mohamed Rizwan

DMVPN, deny traffic to the satellite mission

Hello

Maybe it's a weird qeustion but im DMVPN test with several scenarios.

At the moment I have 1 Hub with 4 spoke, they all work properly. We test it because we have a lot of customers who do not have a fixed IP address to the outside, then an IP address changes each time, you have to configure VPN to our headquarters all over again. DMVPN appears as a perfect solution...

Now my goal is to configure the DMVPN of all customers (speaks) at our headquarters. But I don't want guests to have access to our local network and nor, I want to have access to the other satellite mission. The only one who has full access allowed to all LAN's headquarters (Hub).

What is the best way to achieve this? I started working with access lists or can I do it with EIGRP somehow? And make the ACL on the tunnels or the ethernet interfaces?

Or maybe DMVPN is not the best solution? All comments and advice ar worm appreciated!

Thanks already,

Bart

In this scenario, you use the better the VTI/DVTI tunnels. On the Hub, you can accept any peers with the DVTI-config VPN. The rays use traditional VTI-tunnels. The virtual model on the hub (which is used to build the-access-virtual interfaces by talk can be configured with a value by default-ACL (deny an ip) and CBAC firewall rule that inspects your outgoing traffic to allow packets back.) You can even use the zone based firewall, but this seems an exaggeration in this configuration.

Sent by Cisco Support technique iPad App

Double TIV wan, double between two offices

Hello

We have two offices with two 1841 routers. Each office has two (an ADSL with dialer, a SDSL) WAN links with fixed IP.

The adsl link is the default route with failover.

There is no single VTI works correctly with the configuration below (adsl one). If I remove the road ' ip route 0.0.0.0 0.0.0.0 track 1 1 Dialer ' two VTI work fine, but all the traffic going to witch SDSL is not the behavior we'd like to get.

You have any suggestions to get the two VTI working with the default route to the ADSL link?

Thanks in advance,

Kind regards

Olivier

------------------------------------------------

track 1 accessibility of als 1 ip

delay the decline in 1 1

!

!

crypto ISAKMP policy 1

BA aes

preshared authentication

Group 2

ISAKMP crypto key XXXXXX address 217.x.x.133 No.-xauth

ISAKMP crypto keys YYYYYY address 95.x.x.22 No.-xauth

!

!

Crypto ipsec transform-set esp-aes128-sha esp - aes esp-sha-hmac

!

Crypto ipsec profile vti

the value of the transform-set esp-aes128-sha

!

!

interface Tunnel0

VTI description to boussolebea

192.168.50.1 IP address 255.255.255.0

source of Dialer1 tunnel

ipv4 ipsec tunnel mode

destination 217.x.x.133 tunnel

tunnel path-mtu-discovery

protection of profile vti ipsec tunnel

!

Tunnel1 interface

VTI to Boussolebea SDSL description

IP 192.168.51.1 255.255.255.0

source of tunnel FastEthernet0/1

ipv4 ipsec tunnel mode

destination 95.x.x.22 tunnel

tunnel path-mtu-discovery

protection of profile vti ipsec tunnel

!

interface FastEthernet0/0

LAN Interface Description

IP address 192.168.10.254 255.255.255.0

IP nat inside

IP virtual-reassembly in

automatic duplex

automatic speed

!

interface FastEthernet0/1

Of SDSL description

IP address 62.x.x.10 255.255.255.252

NAT outside IP

IP virtual-reassembly in

automatic duplex

automatic speed

!

ATM0/0/0 interface

no ip address

No atm ilmi-keepalive

!

point-to-point interface ATM0/0/0.1

PVC 8/35

aal5mux encapsulation ppp Dialer

Dialer pool-member 1

!

!

interface Dialer1

Description for ADSL

the negotiated IP address

NAT outside IP

IP virtual-reassembly in

encapsulation ppp

Dialer pool 1

Authentication callin PPP chap Protocol

PPP chap hostname

PPP chap password 7

!

local policy IP map route IspSDSL-redirection

IP pool local PoolVpnAdsl 192.168.60.1 192.168.60.10

IP pool local PoolVpnSdsl 192.168.61.1 192.168.61.10

IP forward-Protocol ND

IP http server

10 class IP http access

local IP http authentication

IP http secure server

!

!

IP nat inside source overload map route IspADSL interface Dialer1

IP nat inside source map route IspSDSL interface FastEthernet0/1 overload

IP route 0.0.0.0 0.0.0.0 Dialer1 track 1

IP route 0.0.0.0 0.0.0.0 62.x.x.9 10

IP route 192.168.11.0 255.255.255.0 192.168.51.2

IP route 192.168.11.0 255.255.255.0 192.168.50.2 10

!

Ipsec extended IP access list

license to host tcp 62.x.x.10 eq 500 all

SSH extended IP access list

permit tcp 62.x.x.10 eq 22 host everything

SSL extended IP access list

host 62.x.x.10 eq 443 tcp permit all

!

radius of the IP source interface FastEthernet0/0

ALS IP 1

193.x.x.3 message echo ICMP source-interface Dialer1

threshold of 60

timeout of 1000

IP SLA annex 1 point of life to always start-time now

exploitation forest esm config

access-list 10 permit 192.168.10.0 0.0.0.255

access-list 10 deny all

access ip-list 100 permit a whole

Dialer-list 1 ip protocol allow

!

!

!

!

allowed IspSDSL 1 route map

corresponds to the IP 10

is the interface FastEthernet0/1

!

allowed IspADSL 1 route map

corresponds to the IP 10

match interface Dialer1

!

IspSDSL-Redirect route map permit 10

corresponds to the ip SSH SSL address

is the interface FastEthernet0/1

IP 62.x.x.9 next value break

Hi Olivier,.

Add the following static route...

IP route 95.x.x.22 255.255.255.255

It's so this router stops his attempts get to destination tunnel tunnel 1 via the link dialer1.

Kind regards

Kevin

* Do not forget to note the useful messages but also to mark it as 'responded' once your problem is solved. This will help others find your solution more quickly.

Configuration of router Hub Tunnel Virtual Interface (VTI)

When you configure several VTI tunnels on a hub, router, is it recommended that each tunnnel use a unique game of transformation and an ipsec profile, or they can share the same configuration.

Example:

crypto ISAKMP policy 1

BA 3des

preshared authentication

Group 2

isakmp encryption key * address 0.0.0.0 0.0.0.0

ISAKMP crypto keepalive 10

!

!

Crypto ipsec transform-set esp-3des esp-sha-hmac TSET

!

Profile of crypto ipsec VTI

game of transformation-TSET

!

Thank you.--

Hello

IPsec profile can be shared.

You can also create several set of transformation and reference it to IPsec profile and then apply it to a specific VTI.

Sent by Cisco Support technique iPhone App

VTI and NAT IPsec Tunnel mode

Hello world

I don't know that this subject has been beaten to death already on these forums. Nevertheless, I have yet to find the exact solution, I need. I have three machines, two routers and an ASA. One of the routers sits behind the ASA and I have a GRE VTI configuration between two routers with ASA NATting, one of the routers to a public IP address. I can guarantee the tunnel mode IPsec transport, but as soon as I pass in tunnel mode, the communication fails even if the SA is established.

Please see the configuration below and tell me what I am missing please. I changed the IP addresses for security.

The following configuration works when transform-set is set to the mode of transport

Note: The Router 2 is sitting behind the ASA and is coordinated to the public IP 200.1.1.2

Router 1:

Crypto ipsec transform-set SEC esp - aes 256 esp-md5-hmac

tunnel mode

!

Crypto ipsec IPSEC profile

transformation-SEC game

!

!

interface tunnels2

IP 172.16.1.1 255.255.255.252

tunnel source 200.1.1.1

tunnel destination 200.1.1.2

Ipsec IPSEC protection tunnel profile

!

SECURITYKEY address 200.1.1.2 isakmp encryption key

!

crypto ISAKMP policy 1

BA aes 256

md5 hash

preshared authentication

Group 2

ASA:

public static 200.1.1.2 (indoor, outdoor) 10.1.1.1 netmask 255.255.255.255

Router 2:

interface Tunnel121

address 172.16.1.2 IP 255.255.255.252

IP nat inside

IP virtual-reassembly

tunnel source 10.1.1.1

tunnel destination 200.1.1.1

Ipsec IPSEC protection tunnel profile

!

Crypto ipsec transform-set SEC esp - aes 256 esp-md5-hmac

tunnel mode

!

Crypto ipsec IPSEC profile

transformation-SEC game

!

SECURITYKEY address 200.1.1.1 isakmp encryption key

!

crypto ISAKMP policy 2

BA aes 256

md5 hash

preshared authentication

Group 2

There is no access-lists on the SAA except to allow a whole ICMP

I am very grateful for any guidance you can provide in advance guys.

Hello

MTU, and the overhead was in this case.

You changed encapsulating ipv4 instead of LIKING - which have less overhead (no GRE inside). This is why it started working.

If you want to continue using GRE you decrease the MTU as described.

---

Michal

Tunnel of Volition on OSPF

Hello

I am configuring a GRE Tunnel on OSPF. The VPN is in place and the Gre Tunnel is up, but when I do a debug ip ospf Wo all that I see is that its not have passed the stage of change/exstart. I don't know why its not making is not a contiguity and only say suggestions I have far to look at the MTU size, but these are all default values.

W6D: OSPF: RRs DBD 172.18.111.100 on Tunnel0 seq 0x1A42 opt 0 x 52 indicator 0 x 7
Len 32 mtu 1400 State EXCHANGE
4w6d: OSPF: Nbr 172.18.111.100 has smaller interface MTU
4w6d: OSPF: Send DBD to 172.18.111.100 on Tunnel0 seq 0x1A42 opt 0 x 52 indicator 0 x 2 l
in 1452
4w6d: OSPF: RRs DBD 172.18.111.100 on Tunnel0 seq 0x1A42 opt 0 x 52 indicator 0 x 7
Len 32 mtu 1400 State EXCHANGE
4w6d: OSPF: Nbr 172.18.111.100 has smaller interface MTU
4w6d: OSPF: Send DBD to 172.18.111.100 on Tunnel0 seq 0x1A42 opt 0 x 52 indicator 0 x 2 l
in 1452
4w6d: OSPF: RRs DBD 172.18.111.100 on Tunnel0 seq 0x1A42 opt 0 x 52 indicator 0 x 7
Len 32 mtu 1400 State EXCHANGE
4w6d: OSPF: Nbr 172.18.111.100 has smaller interface MTU
4w6d: OSPF: Send DBD to 172.18.111.100 on Tunnel0 seq opt fla 0 x 52 0x1A42

Kind regards

Kevin

We will first check if your VPN tunnel is up without problem.

See the isa crypto his

Crypto ipsec to show his

I took a quick glance to your configuration, the ACL used for VPN traffic must be mirror on both peers. I know that you only need to encode the GRE traffic. So you can change your ACL as follows.

1. the TDNVPN01

change

access-list 160 permit ip host 172.18.47.100 172.18.47.1
access-list 160 permit ip host 172.18.47.1 172.18.47.100
access-list 160 permit ip host 172.18.46.1 172.18.46.2
access-list 160 permit ip host 172.18.46.2 172.18.46.1

TO

access-list 160 allow accord 172.18.47.100 host 172.18.47.1

2. on the SAA,

change

access list ACL-VPN600 extended permit ip host 172.18.47.1 172.18.47.100
access list ACL-VPN600 extended permit ip host 172.18.111.1 172.18.111.100
access list ACL-VPN600 extended permit ip host 172.18.46.1 172.18.46.2
access list ACL-VPN600 extended permit ip host 172.18.46.2 172.18.46.1
access list ACL-VPN600 extended permit ip host 172.18.47.100 172.18.47.1

TO

extended access list ACL-VPN600 allow accord 172.18.47.1 host 172.18.47.100

3. on the SAA, you might need ignore NAT for this traffic. (maybe not since I have not seen nat-control is enabled, but you have not a "nat 0 ' configured)

INSIDE_nat0_outbound list of allowed access host ip 172.18.47.1 172.18.47.100

After making the above change, use "show crypto isa his ' and ' show crypto ipsec his" on both sides to verify if IPSec is implemented.

If so, use "crypto ipsec to show his" to check if the two encryption and decipher the County are incrementing.

is it possible to create a tunnel my router to my ASA 877 VTI

Hi all

I woulke would like to know is possible to create a tunnel VTI my router 877 to my ASA, rather than create a cryptomap on the router?

see you soon

Carl

Yes, you can

I forgot to add that it is possible during the ezvpn configuration where the 877 is a remote client and a server Asa

Sent by Cisco Support technique iPhone App

Routing OSPF on a VRF with Tunnel GRE ISAKMP

Hello

I'm trying to implement a routing OSPF on a VRF using GRE Tunnel with ISAKMP encryption.

Almost everything works fine:

1 OSPF routing incl. VRF - perfect

2. distribution of routing OSPF using the GRE Tunnel and VRF - perfect

3 ISAKMP encryption - I think I've done one or several mistackes.

On the attaced file, you might find the Excel sheet, which includes router configurations and a scetch of netzwork.

I would be very happy if someone could solve my problem or give me a hint.

Thank you very much.

Hi Kai,

your key ring is not in the good vrf - note that there is a difference between the FVRF and the IVRF, see

In case you, ISAKMP traffic is sent on / arriving on the interface F0/1.10 so the FVRF is the global vrf, and therefore the set of keys should be in global vrf.

In other words replace this:

VRF crypto keyring Customer_10_Keyring Customer_10

with:

door-key crypto Customer_10_Keyring

BTW, the above document also has an example on how to use 'tunnel of protection', so you no longer have to use a card encryption. Actually I'm not 100% if it is supported to the GRE/IPsec with VRF without using protection tunnel, so maybe try that if you still have problems.

HTH

Herbert

The router configuration VPN VTI adding a third site/router

Hello

I currently have two cisco routers configured with a connection to a primary WAN interface and a connection to an Internet interface. I have a VPN configured using a VTI interface as a secondary path if the primary circuit WAN fails. IM also using OSPF as a dynamic routing protocol. Failover works and itineraries are exchanged. The question I have is that if I want to put a third-party router in this configuration I just add another interface tunnel with the tunnel proper Public source and destination IP and new IP addresses for a new tunnel network.
The current configuration of the VTI is below:

Any guidance would be appreciated.

Thank you

Andy

Router1_Configurtation_VTI

crypto ISAKMP policy 1

BA 3des

preshared authentication

Group 2

ISAKMP crypto key Cisco12345 address 0.0.0.0 0.0.0.0

Crypto IPsec transform-set esp-3des esp-sha-hmac T1

Crypto IPsec profile P1

game of transformation-T1

!

interface Tunnel0

IP 10.0.1.1 255.255.255.0

IP ospf mtu - ignore

load-interval 30

tunnel source 1.1.1.1 Internet Source * Public

2.2.2.1 tunnel * Public Destination Internet destination

ipv4 IPsec tunnel mode

profile P1 IPsec tunnel protection

!

Router2_Configuration_VTI

crypto ISAKMP policy 1

BA 3des

preshared authentication

Group 2

ISAKMP crypto key Cisco12345 address 0.0.0.0 0.0.0.0

Crypto IPsec transform-set esp-3des esp-sha-hmac T1

Crypto IPsec profile P1

game of transformation-T1

!

interface Tunnel0

10.0.1.2 IP address 255.255.255.0

IP ospf mtu - ignore

load-interval 30

2.2.2.1 tunnel source * Source public Internet

1.1.1.1 tunnel * Public Destination Internet destination

ipv4 IPsec tunnel mode

profile P1 IPsec tunnel protection

Since this config is configuration of keys ISAKMP using address 0.0.0.0 0.0.0.0 is not required for a new encryption key isakmp with the new address of the site. Simply configure the VTI on the new router and one or both of the existing routers.

One of the aspects of this application that should consider the original poster, that's how they want data to flow when the third-party router is implemented. With both routers, you have just a simple point-to-point connection. When you introduce the third-party router do you want one of the routers to use hub? In this case, the hub router has tunnels each remote Ray. Each remote RADIUS has a tunnel to the hub. Talk about communication talk is possible but will have to go to the hub and then out to the other remote. The other option is a mesh configuration where each router has VTI tunnel to the other router.

HTH

Rick

OSPF on IPSEC?

Hi guys,.

Can I run ospf based IPSEC? (No WILL).

Marco,

Not really a bug in the right direction, paste the description.

He explains what you see and why people in the past have seen a different behavior. :-)


    CSCtq94342 - Self originated, multicast traffic handling through IPsec tunnel


    This is a documentation bug only.

    Symptom:

    A note needs to be added into configuration guide to specify that:

    As of release 12.4(9)T multicast traffic originated from the box will be encapsulated into IPsec if proxy identities allow this.

    Further description

    A typical use case for this is when router is sourcing OSPF packets and traffic selectors for IPsec allows OSPF packets (protocol number 89, group 224.0.0.5 & 224.0.0.6).

    As of release 12.4(9)T those packets will be put into the tunnel and encrypted.

    At the same time, please be aware that using "any any" as your proxy identities is HIGHLY discouraged.

    "any any" proxy identities can be achieved in case of using VTI configuration which is recommended if those proxy identities are desired.

VTI problem

Could Hello someone help me? I created VTI tunnels between HO and branches HO is 3925 and branches are 871 and 881, configuration is very basic, and when traffic goes through ping tunnel rises very strongly from 200 to 1000 ms, CPU on 871 and 881 is ok, how can we improve this problem?

881

interface Tunnel10

Description of C-3925

bandwidth 4196

IP 192.168.193.22 255.255.255.252

MTU IP 1300

IP tcp adjust-mss 1260

penetration of the IP stream

stream IP output

route IP cache flow

IP ospf cost 90

IP ospf mtu - ignore

KeepAlive 5 20

source of tunnel X.X.X.X

destination tunnel X.X.X.X

ipv4 ipsec tunnel mode

Tunnel VTI_BR ipsec protection profile

3925

interface Tunnel5

Description of 881

bandwidth 4192

IP 192.168.193.21 255.255.255.252

MTU IP 1300

IP virtual-reassembly

IP tcp adjust-mss 1260

route BRANCHES_TO_ASA card intellectual property policy

IP ospf cost 100

IP ospf mtu - ignore

no link-status of snmp trap

Traffic-shape 111 512000 7936 7936 1000 Group

source of tunnel X.X.X.X

ipv4 ipsec tunnel mode

destination tunnel X.X.X.X

Tunnel VTI_BR ipsec protection profile

before GRE VTI and averything was OK

This configuration could be the problem

Traffic-shape 111 512000 7936 7936 1000 Group

provide the rest of the relevant configuration to this.

Using OSPF on entirely mesh VPN L2L

We have four sites linked together (full mesh) over VPN tunnels on the features of the NSA. The traffic from a given site can use a VPN tunnel to connect directly with any other peer on the network. We want to use OSPF to redirect traffic when the VPN tunnel between two sites goes down.

For example, if the VPN between sites A and B goes down we want to redirect the traffic from site A, (designed for Site B) to be diverted to site C, and site C traffic would then cross the tunnel to B.

How can we define it?

Hi Christine,

In the course of Network Security Advanced Administration (SSSC), hands-on exercise Guide (NS-202-EG-A) on page 61, you'll find a VPN type exercise road using OSPF. Works great!

VTI &amp; OSPF tunnel

Similar Questions

Network.PNG

Maybe you are looking for

VTI & OSPF tunnel