{"id":691,"date":"2021-09-11T04:24:00","date_gmt":"2021-09-11T12:24:00","guid":{"rendered":"https:\/\/tungle.ca\/?p=691"},"modified":"2023-01-06T21:39:19","modified_gmt":"2023-01-07T05:39:19","slug":"dmvpn-over-ipsec","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=691","title":{"rendered":"Implementing DMVPN over IPSEC"},"content":{"rendered":"\n

Below is a topology that is used to configure DMVPN over IPSEC. This is one of the most important topics that I have learned on CCNP ENCOR.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

HUB Configuration:<\/strong><\/p>\n\n\n\n

int tun 0\nip addr 10.40.1.1 255.255.255.0\nipv6 addr 2001:10:40:1::1\/64\nipv6 addr fe80::1 link-local\ntu source gig 0\/0\ntun mode gre multipoint\nip nhrp authentication Cisco123\n# Using NHRP to define tunnel destination on remote sites.\nip nhrp network-id 1\nip nhrp map multicast dynamic\nipv6 nhrp network-id 1\nipv6 nhrp map multicast dynamic\n\n<\/code><\/pre>\n\n\n\n
SPOKE Configuration<\/strong>:<\/p>\n\n\n\n
# Site 1:\nint tun 0\nip addr 10.40.1.2 255.255.255.0\nipv6 addr 2001:10:40:1::2\/64\nipv6 addr fe80::2 link-local\ntu source gig 0\/0\ntun mode gre multipoint\nip nhrp authentication Cisco123\n# Using NHRP to define tunnel destination on remote sites.\nip nhrp network-id 1\nip nhrp nhs 10.40.1.1 nbma 150.40.1.1 multicast\n\nipv6 nhrp network-id 1\nipv6 nhrp nhs 2001:10:40:1::1 nbma 150.40.1.1 multicast\n\n# Site 2:\nint tun 0\nip addr 10.40.1.3 255.255.255.0\nipv6 addr 2001:10:40:1::3\/64\nipv6 addr fe80::2 link-local\ntu source gig 0\/0\ntun mode gre multipoint\nip nhrp authentication Cisco123\n# Using NHRP to define tunnel destination on remote sites.\nip nhrp network-id 1\nip nhrp nhs 10.40.1.1 nbma 150.40.1.1 multicast\n\nipv6 nhrp network-id 1\nipv6 nhrp nhs 2001:10:40:1::1 nbma 150.40.1.1 multicast\n\n# Site 3:\nint tun 0\nip addr 10.40.1.4 255.255.255.0\nipv6 addr 2001:10:40:1::4\/64\nipv6 addr fe80::2 link-local\ntu source gig 0\/0\ntun mode gre multipoint\nip nhrp authentication Cisco123\n# Using NHRP to define tunnel destination on remote sites.\nip nhrp network-id 1\nip nhrp nhs 10.40.1.1 nbma 150.40.1.1 multicast\n\nipv6 nhrp network-id 1\nipv6 nhrp nhs 2001:10:40:1::1 nbma 150.40.1.1 multicast<\/code><\/pre>\n\n\n\n
Using a nice TCLSH script to test connectivity between sites.<\/p>\n\n\n\n
tclsh \n\nforeach X {\n10.40.1.1\n10.40.1.2\n10.40.1.3\n10.40.1.4\n2001:10:40:1::1\n2001:10:40:1::2\n2001:10:40:1::3\n2001:10:40:1::4\n} {ping $X repeat 2}<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
#sh ip nhrp\n# sh ipv6 nhrp  <\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
# sh dmvpn<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
+ Using IPSec tunnel to protect DMVPN traffic.<\/p>\n\n\n\n
  • IKE Configuration<\/li><\/ul>\n\n\n\n
    crypto keyring VPN-BCITCISA\n pre-shared-key address 0.0.0.0 0.0.0.0 key Pa$$w0rd\n\ncrypto isakmp enable\n\ncrypto isakmp policy 10\n encryption aes 256\n hash sha\n authentication pre-share\n group 5\n\ncrypto isakmp profile ISAKMP-Profile\n Keyring VPN-BCITCISA\n Match identity address 0.0.0.0<\/code><\/pre>\n\n\n\n
    • IPsec Configuration<\/li><\/ul>\n\n\n\n
      crypto ipsec transform-set IPSEC-TRANSFORM esp-aes 256 esp-sha256-hmac\n\ncrypto ipsec profile DMVPN\n set security-association lifetime seconds 120\n set transform-set IPSEC-TRANSFORM\n set isakmp-profile ISAKMP-Profile\n set pfs group2<\/code><\/pre>\n\n\n\n
      • Apply the profile to the interface Tunnel0<\/li><\/ul>\n\n\n\n
        Interface Tunnel0
         tunnel protection ipsec profile DMVPN<\/p>\n\n\n\n
        + Verify DMVPN over IPSEC:<\/p>\n\n\n\n
        #show dmvpn detail<\/code><\/pre>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        \"\"<\/figure>\n\n\n\n
        # show crypto isakmp sa<\/code><\/pre>\n\n\n\n
        \"\"
        #show crypto ipsec sa<\/figcaption><\/figure>\n\n\n\n
        \"\"
        + Capture DMVPN over IPSEC traffic.<\/figcaption><\/figure>\n\n\n\n
        \"\"
        Capture packets from Wireshark. It can be seen that the ping traffic has been encrypted by ESP on the IPSEC tunnel.<\/figcaption><\/figure>\n\n\n\n
        \"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"
        Below is a topology that is used to configure DMVPN over IPSEC. This is one of the most important topics that I have learned on CCNP ENCOR. HUB Configuration: SPOKE Configuration: Using a nice TCLSH script to test connectivity between sites. + Using IPSec tunnel to protect DMVPN traffic. IKE Configuration IPsec Configuration Apply the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[15],"class_list":["post-691","post","type-post","status-publish","format-standard","hentry","category-cisco","tag-cisco"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=691"}],"version-history":[{"count":7,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/691\/revisions"}],"predecessor-version":[{"id":2677,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/691\/revisions\/2677"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=691"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=691"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}