Dual DMVPN
Dual DMVPN
DMVPN stands for Dynamic Multipoint Virtual Private Network. It is basically a concept involving three different technologies- multipoint GRE (mGRE), Next-Hop Resolution Protocol (NHRP) and IPSec.
Traditional site-to-site IPSec VPNs require individual (point-to-point GRE or IPSec) tunnels between a pair of Hub and Branch routers. For all new branch routers, configurations need to be added on the Branch router as well as the Hub router. Also, traffic between Branch routers go through the Hub router.
Conversely, DMVPN uses mGRE tunnel which has multiple end-points and is treated as a non-broadcast multi-access (NBMA) network. DMVPN has evolved into 3 phases-
Phase 1: Hub and Spoke - mGRE at the Hub and p2p GRE at the Branch routers
Phase 2: Hub and Spoke with Spoke-to-spoke tunnels (mGRE at the Hub and Branch routers)
Phase 3: Same as Phase 2 but now Spoke routers can also respond to NHRP Requests.
This article discusses Phase 2.
DMVPN Components
1. mGRE - Multipoint GRE
mGRE serves as a one-to-many interface for the creation of multiple hub-and-spoke tunnels. The tunnel destination for an mGRE tunnel does not have to be configured. mGRE tunnel is effectively NBMA medium like Frame-Relay. A mechanism like ARP is required to map logical (tunnel) IP addresses to physical (NBMA) IP addresses. This is taken care by NHRP.
All the Hub routers are configured with mGRE tunnel interface. If Hub-and-Spoke model is to be deployed, the Branch routers are configured with p2p GRE tunnel interface only. However, if Spoke-to-Spoke model is to be deployed, the Branch routers must be configured with mGRE tunnel interface.
2. NHRP - Next-Hop Resolution Protocol
NHRP (RFC 2332) is a Layer-2 address resolution protocol like ARP and Frame-relay Inverse-ARP. NHRP is used by a Branch router connected to NBMA network to determine the IP address of the NBMA Next-Hop (physical address)- this could be the Hub router or another Branch router.
All Branch routers register their physical (NBMA) IP addresses mapped to logical (tunnel) IP addresses with the Next-Hop Server (NHS). The IP address of the NHS is pre-configured on the Branch routers. These Branch routers become Next-Hop Clients (NHC). The NHS stores all registered mappings and replies to NHRP Requests from NHCs. An NHS can be an NHC to another NHS and can forward NHRP Requests to its NHS if it cannot find a registered mapping in its database.
NHRP facilitates in building mGRE tunnels. NHRP allows mGRE tunnel endpoints to discover each other's physical IP address.
Sample Scenario - Dual DMVPN
A dual DMVPN cloud topology with spoke-to-spoke model consists of two Hub routers, each with mGRE tunnel interface(s) connecting all Branch routers. Each DMVPN cloud represents a unique subnet. One DMVPN cloud is considered Primary- this is preferred by all Branch routers to send traffic. The second DMVPN cloud is implemented to provide resiliency to the Primary DMVPN cloud.
mGRE Tunnel and IP Addressing
Tunnel 11 is the Primary tunnel while Tunnel 22 is the Backup tunnel. The tunnel mode gre multipoint command configures the tunnel as multipoint GRE tunnel. The tunnel destination is not configured; destination endpoints (Branch routers) are dynamically discovered.
All LAN subnets on all routers belong to 192.168.x.0/24 network. The Primary cloud belongs to 10.1.0.0/24 subnet and the Backup cloud belongs to 10.2.0.0/24 subnet. The WAN interfaces use public addresses.
Primary router
interface Serial 0/0
description WAN Interface
ip address 172.16.1.1 255.255.255.0
!
interface Fastethernet 0/0
description LAN Interface
ip address 192.168.0.1 255.255.255.0
!
interface Tunnel 11
ip address 10.0.1.1 255.255.255.0
tunnel mode gre multipoint
tunnel source serial 0/0
tunnel key 123
!
Backup router
interface Serial 0/0
description WAN Interface
ip address 172.26.1.1 255.255.255.0
!
interface Fastethernet 0/0
description LAN Interface
ip address 192.168.0.2 255.255.255.0
!
interface Tunnel 22
ip address 10.0.2.1 255.255.255.0
tunnel mode gre multipoint
tunnel source serial 0/0
tunnel key 456
!
Branch1 router
interface Serial 0/0
description WAN Interface
ip address 172.36.1.1 255.255.255.0
!
interface Fastethernet 0/0
ip address 192.168.1.1 255.255.255.0
!
interface Tunnel 11
ip address 10.0.1.2 255.255.255.0
tunnel mode gre multipoint
tunnel source serial 0/0
tunnel key 123
!
interface Tunnel 22
ip address 10.0.2.2 255.255.255.0
tunnel mode gre multipoint
tunnel source serial 0/0
tunnel key 456
!
Branch2 router
interface Serial 0/0
description WAN Interface
ip address 172.46.1.1 255.255.255.0
!
interface Fastethernet 0/0
ip address 192.168.2.1 255.255.255.0
!
interface Tunnel 11
ip address 10.0.1.3 255.255.255.0
tunnel mode gre multipoint
tunnel source serial 0/0
tunnel key 123
!
interface Tunnel 22
ip address 10.0.2.3 255.255.255.0
tunnel mode gre multipoint
tunnel source serial 0/0
tunnel key 456
!
Branch3 router
interface Serial 0/0
description WAN Interface
ip address 172.56.1.1 255.255.255.0
!
interface Fastethernet 0/0
ip address 192.168.3.1 255.255.255.0
!
interface Tunnel 11
ip address 10.0.1.4 255.255.255.0
tunnel mode gre multipoint
tunnel source serial 0/0
tunnel key 123
!
interface Tunnel 22
ip address 10.0.2.4 255.255.255.0
tunnel mode gre multipoint
tunnel source serial 0/0
tunnel key 456
!
NHRP Configuration
The most basic commands to implement NHRP are as follows-
1) ip nhrp map <tunnel-ip> <physical-ip> command creates a static binding between a tunnel IP address and physical IP address. This command is usually configured on the Branch routers (who act as NHRP Clients) to provide the information to Branch routers to reach the tunnel address of the Hub.
2) ip nhrp map multicast <dynamic | static-ip> command specifies the destination(s) that will receive multicast/broadcast traffic. Spokes map multicast to the physical IP address of the Hub, and the Hub maps multicast packets to the dynamic mappings i.e. to all NHRP Clients registered to the Hub (NHRP Server). This is important for routing protocols to form adjacency and exchange routing updates.
3) ip nhrp nhs <server-ip> command specifies the NHRP Server to the Branch routers. The "Server IP Address" is the tunnel IP address.
4) ip nhrp authentication <key> command is optional. The key is in plain-text and is used to authenticate the NHRP Client. This must be same on all NHRP routers.
5) ip nhrp network-id <id> command identifies the logical network. This must be same on all NHRP routers.
6) ip nhrp holdtime <seconds> command specifies the hold-time value in registration requests. The NHS will keep the registration request cache for the hold-time period, and if no updates are received, it will flush them out.
Primary router
interface Tunnel11
......
ip nhrp map multicast dynamic
ip nhrp network-id 123
ip nhrp holdtime 60
!
Backup router
interface Tunnel22
.....
ip nhrp map multicast dynamic
ip nhrp network-id 456
ip nhrp holdtime 60
!
The NHRP configuration on all Branch routers looks same.
All Branch routers
interface Tunnel11
....
ip nhrp map 10.0.1.1 172.16.1.1 ! Statically mapping Primary Hub Tunnel IP and Physical IP Addresses
ip nhrp map multicast 172.16.1.1
ip nhrp nhs 10.0.1.1 ! Pre-configured NHRP Server- Primary Hub
ip nhrp network-id 123
ip nhrp holdtime 60
!
interface Tunnel22
....
ip nhrp map 10.0.2.1 172.26.1.1 ! Statically mapping Backup Hub Tunnel IP and Physical IP Addresses
ip nhrp map multicast 172.26.1.1
ip nhrp nhs 10.0.2.1 ! Pre-configured NHRP Server- Backup Hub
ip nhrp network-id 456
ip nhrp holdtime 60
!
Routing Instances
We will use two separate instance of routing protocol on Hub and Branch routers- one for WAN domain (OSPF) and another for VPN domain (EIGRP).
For EIGRP, we need to disable split-horizon on Hub mGRE tunnel interface to ensure optimal forwarding. We also need to disable the default EIGRP behavior to overwrite the next-hop as itself. And lastly, we also need to tweak the metric in EIGRP for tunnels to prefer Primary over Backup.
Primary router
router ospf 1
! WAN domain
!
network 172.16.1.0 0.0.0.255 area 0
!
router eigrp 1
! VPN domain
!
no auto-summary
network 10.0.0.0
network 192.168.0.0
!
interface Tunnel11
....
no ip split-horizon eigrp 1
no ip next-hop-self eigrp 1 ! This command is not required in DMVPN Phase 1
delay 5
!
Backup router
router ospf 1
! WAN domain
!
network 172.26.1.0 0.0.0.255 area 0
!
router eigrp 1
! VPN domain
!
no auto-summary
network 10.0.0.0
network 192.168.0.0
!
interface Tunnel22
....
delay 10
no ip split-horizon eigrp 1
no ip next-hop-self eigrp 1
! This command is not required in DMVPN Phase 1
!
Branch routers
Branch1 router:
router ospf 1
network 172.36.1.0 0.0.0.255 area 0
!
router eigrp 1
no auto-summary
network 10.0.0.0
network 192.168.1.0
!
interface Tunnel11
....
delay 5
!
interface Tunnel22
....
delay 10
!
Branch2 router:
router ospf 1
network 172.46.1.0 0.0.0.255 area 0
!
router eigrp 1
no auto-summary
network 10.0.0.0
network 192.168.2.0
!
interface Tunnel11
....
delay 5
!
interface Tunnel22
....
delay 10
!
Branch3 router:
router ospf 1
network 172.56.1.0 0.0.0.255 area 0
!
router eigrp 1
no auto-summary
network 10.0.0.0
network 192.168.3.0
!
interface Tunnel11
....
delay 5
!
interface Tunnel22
....
delay 10
!
All the Spoke routers try to register their logical IP address to NBMA IP address mapping with the Hub. Each Spoke router has 2 tunnel interfaces to two different Hubs- Primary and Backup. Hence all Spoke routers send Registration Request packets to both Primary and Backup with its logical-to-NBMA address mapping. The following output shows Spoke1 router registering with two Hubs. The Hubs respond with Registration Reply packet to the Spoke routers.
NHRP Registration
Primary#
*Mar 1 09:55:23.589: NHRP: Receive Registration Request via Tunnel11 vrf 0, packet size: 92
*Mar 1 09:55:23.589: NHRP: netid_in = 123, to_us = 1
*Mar 1 09:55:23.589: NHRP: Tu11: Creating dynamic multicast mapping NBMA: 172.36.1.1
*Mar 1 09:55:23.589: NHRP: Attempting to send packet via DEST 10.0.1.2
*Mar 1 09:55:23.593: NHRP: Encapsulation succeeded. Tunnel IP addr 172.36.1.1
*Mar 1 09:55:23.593: NHRP: Send Registration Reply via Tunnel11 vrf 0, packet size: 112
*Mar 1 09:55:23.597: src: 10.0.1.1, dst: 10.0.1.2
*Mar 1 09:55:23.597: NHRP: 112 bytes out Tunnel11
Backup#
*Mar 1 09:54:59.585: NHRP: Receive Registration Request via Tunnel22 vrf 0, packet size: 92
*Mar 1 09:54:59.585: NHRP: netid_in = 456, to_us = 1
*Mar 1 09:54:59.585: NHRP: Tu22: Creating dynamic multicast mapping NBMA: 172.36.1.1
*Mar 1 09:54:59.589: NHRP: Attempting to send packet via DEST 10.0.2.2
*Mar 1 09:54:59.589: NHRP: Encapsulation succeeded. Tunnel IP addr 172.36.1.1
*Mar 1 09:54:59.593: NHRP: Send Registration Reply via Tunnel22 vrf 0, packet size: 112
*Mar 1 09:54:59.593: src: 10.0.2.1, dst: 10.0.2.2
*Mar 1 09:54:59.593: NHRP: 112 bytes out Tunnel22
This registration on the mGRE interface on the Hub router to build a dynamic tunnel back to the registering Branch/Spoke router without having to know the Branch tunnel destination statically. NHRP tells mGRE interface where to tunnel a packet to reach a certain address.
The NHRP cache can be viewed using show ip nhrp command. The Hubs learn the mappings dynamically and the Spoke routers have only a single static mapping via each tunnel interface in their NHRP cache.
NHRP Cache
Primary# show ip nhrp
10.0.1.2/32 via 10.0.1.2, Tunnel11 created 07:57:45, expire 00:00:58
Type: dynamic, Flags: unique registered used
NBMA address: 172.36.1.1
10.0.1.3/32 via 10.0.1.3, Tunnel11 created 00:36:01, expire 00:00:49
Type: dynamic, Flags: unique registered used
NBMA address: 172.46.1.1
10.0.1.4/32 via 10.0.1.4, Tunnel11 created 00:03:49, expire 00:00:49
Type: dynamic, Flags: unique registered used
NBMA address: 172.56.1.1
Spoke3# show ip nhrp
10.0.1.1/32 via 10.0.1.1, Tunnel11 created 00:14:53, never expire
Type: static, Flags: used
NBMA address: 172.16.1.1
10.0.2.1/32 via 10.0.2.1, Tunnel22 created 00:14:46, never expire
Type: static, Flags: used
NBMA address: 172.26.1.1
The unique flag indicates that the Registration Request message had unique flag enabled. The NHS rejects all Registration Requests if the mapping in the message is already present or not unique. The used flag indicates that the router uses this mapping to switch IP packets.
All Branch routers learn about remote 192.168.x.0/24 networks via EIGRP over Tunnel 11 (Primary tunnel).
EIGRP routes
Spoke1# show ip route eigrp
D 192.168.0.0/24 [90/284471296] via 10.0.1.1, 00:05:58, Tunnel11
D 192.168.2.0/24 [90/284472576] via 10.0.1.3, 00:05:53, Tunnel11
D 192.168.3.0/24 [90/284472576] via 10.0.1.4, 00:03:56, Tunnel11
Spoke2# show ip route eigrp
D 192.168.0.0/24 [90/284471296] via 10.0.1.1, 00:25:18, Tunnel11
D 192.168.1.0/24 [90/284472576] via 10.0.1.2, 00:06:11, Tunnel11
D 192.168.3.0/24 [90/284472576] via 10.0.1.4, 00:04:15, Tunnel11
Spoke3# show ip route eigrp
D 192.168.0.0/24 [90/284471296] via 10.0.1.1, 00:04:38, Tunnel11
D 192.168.1.0/24 [90/284472576] via 10.0.1.2, 00:04:38, Tunnel11
D 192.168.2.0/24 [90/284472576] via 10.0.1.3, 00:04:38, Tunnel11
However, the CEF adjacency for prefixes connected to remote Branch router over the DMVPN cloud, are seen as invalid adjacency on the Branch3 routers. While the CEF adjacency for the next-hop is valid punt adjacency which means that the packet cannot be CEF-switched and need to be fast-switched or process-switched.
Spoke3# show ip cef 192.168.1.0
192.168.1.0/24, version 33, epoch 0
0 packets, 0 bytes
via 10.0.1.2, Tunnel11, 0 dependencies
next hop 10.0.1.2, Tunnel11
invalid adjacency
Spoke3# show ip cef 10.0.1.2
10.0.1.0/24, version 22, epoch 0, attached, connected
0 packets, 0 bytes
via Tunnel11, 0 dependencies
valid punt adjacency
When Branch3 router tries to send packet to 192.168.1.0/24, it finds out that it has a punt adjacency for its next-hop of 10.0.1.2. Then Branch3 router attempts to send NHRP Resolution Request directly to its next-hop 10.0.1.2 i.e. Spoke1 router, but it fails as the NBMA address of Branch1 router is unknown. However, the Branch3 router continues to send packets via the NHS.
*Mar 1 08:36:58.865: NHRP: MACADDR: if_in null netid-in 0 if_out Tunnel11 netid-out 123
*Mar 1 08:36:58.865: NHRP: Checking for delayed event 0.0.0.0/10.0.1.2 on list (Tunnel11).
*Mar 1 08:36:58.869: NHRP: No node found.
*Mar 1 08:36:58.869: NHRP: Sending packet to NHS 10.0.1.1 on Tunnel11
*Mar 1 08:36:58.881: NHRP: Checking for delayed event 0.0.0.0/10.0.1.2 on list (Tunnel11).
*Mar 1 08:36:58.881: NHRP: No node found.
*Mar 1 08:36:58.881: NHRP: Attempting to send packet via DEST 10.0.1.2
*Mar 1 08:36:58.885: NHRP: Send Resolution Request via Tunnel11 vrf 0, packet size: 72
*Mar 1 08:36:58.885: src: 10.0.1.4, dst: 10.0.1.2
*Mar 1 08:36:58.885: (F) afn: IPv4(1), type: IP(800), hop: 255, ver: 1
*Mar 1 08:36:58.889: shtl: 4(NSAP), sstl: 0(NSAP)
*Mar 1 08:36:58.889: (M) flags: "router auth src-stable nat ", reqid: 129
*Mar 1 08:36:58.889: src NBMA: 172.56.1.1
*Mar 1 08:36:58.889: src protocol: 10.0.1.4, dst protocol: 10.0.1.2
*Mar 1 08:36:58.893: (C-1) code: no error(0)
*Mar 1 08:36:58.893: prefix: 0, mtu: 1514, hd_time: 60
*Mar 1 08:36:58.893: addr_len: 0(NSAP), subaddr_len: 0(NSAP), proto_len: 0, pref: 0
*Mar 1 08:36:58.893: NHRP: Encapsulation failed for destination 10.0.1.2 out Tunnel11
*Mar 1 08:36:58.897: NHRP: Attempting to send packet via NHS 10.0.1.1
*Mar 1 08:36:58.897: NHRP: Encapsulation succeeded. Tunnel IP addr 172.16.1.1
An NHRP packet contains 3 parts-
1. Fixed Part (F): It specifies the address-family (afn), protocol type (IP) as well as subnetwork type and length.
2. Mandatory Part (M): It specifies the flags and the request ID (reqid). It also includes the source NBMA address and source/destination protocol IP addresses.
3. Client Information Element (CIE C-1) part: It contains information about networks connected to requesting/responding routers.
The Spoke3 router then tries to send the Resolution Request to NHS. It contains the source NBMA address of Spoke3 router (itself) and tunnel source address of Spoke3 router and tunnel destination address of Spoke1 router.
*Mar 1 08:36:58.897: NHRP: Send Resolution Request via Tunnel11 vrf 0, packet size: 72
*Mar 1 08:36:58.901: src: 10.0.1.4, dst: 10.0.1.1
*Mar 1 08:36:58.901: (F) afn: IPv4(1), type: IP(800), hop: 255, ver: 1
*Mar 1 08:36:58.901: shtl: 4(NSAP), sstl: 0(NSAP)
*Mar 1 08:36:58.901: (M) flags: "router auth src-stable nat ", reqid: 129
*Mar 1 08:36:58.905: src NBMA: 172.56.1.1
*Mar 1 08:36:58.905: src protocol: 10.0.1.4, dst protocol: 10.0.1.2
*Mar 1 08:36:58.905: (C-1) code: no error(0)
*Mar 1 08:36:58.905: prefix: 0, mtu: 1514, hd_time: 60
*Mar 1 08:36:58.909: addr_len: 0(NSAP), subaddr_len: 0(NSAP), proto_len: 0, pref: 0
*Mar 1 08:36:58.909: NHRP: 72 bytes out Tunnel11
*Mar 1 08:36:59.125: NHRP: MACADDR: if_in null netid-in 0 if_out Tunnel11 netid-out 123
*Mar 1 08:36:59.125: NHRP: Checking for delayed event 0.0.0.0/10.0.1.2 on list (Tunnel11).
*Mar 1 08:36:59.129: NHRP: No node found.
*Mar 1 08:36:59.129: NHRP: Sending packet to NHS 10.0.1.1 on Tunnel11
The request arrives at NHS. The NHS has a mapping for 10.0.1.2 in its NHRP cache. It responds with a Resolution Reply message with correct mapping in the Mandatory part.
*Mar 1 08:36:59.133: NHRP: Receive Resolution Request via Tunnel11 vrf 0, packet size: 92
*Mar 1 08:36:59.137: (F) afn: IPv4(1), type: IP(800), hop: 254, ver: 1
*Mar 1 08:36:59.137: shtl: 4(NSAP), sstl: 0(NSAP)
*Mar 1 08:36:59.137: (M) flags: "router auth src-stable nat ", reqid: 2970
*Mar 1 08:36:59.137: src NBMA: 172.36.1.1
*Mar 1 08:36:59.137: src protocol: 10.0.1.2, dst protocol: 10.0.1.4
*Mar 1 08:36:59.141: (C-1) code: no error(0)
*Mar 1 08:36:59.141: prefix: 0, mtu: 1514, hd_time: 60
*Mar 1 08:36:59.141: addr_len: 0(NSAP), subaddr_len: 0(NSAP), proto_len: 0, pref: 0
*Mar 1 08:36:59.141: NHRP: netid_in = 123, to_us = 1
The Spoke3 router receives the Resolution Reply packet and hence its CEF adjacency is now completed for 10.0.1.2. It now attempts to send the packet directly to Spoke1 router rather than through Hub router.
*Mar 1 08:36:59.285: NHRP: Receive Resolution Reply via Tunnel11 vrf 0, packet size: 120
*Mar 1 08:36:59.289: (F) afn: IPv4(1), type: IP(800), hop: 255, ver: 1
*Mar 1 08:36:59.289: shtl: 4(NSAP), sstl: 0(NSAP)
*Mar 1 08:36:59.289: (M) flags: "router auth dst-stable unique src-stable nat ", reqid: 129
*Mar 1 08:36:59.289: src NBMA: 172.56.1.1
*Mar 1 08:36:59.293: src protocol: 10.0.1.4, dst protocol: 10.0.1.2
*Mar 1 08:36:59.293: (C-1) code: no error(0)
*Mar 1 08:36:59.293: prefix: 32, mtu: 1514, hd_time: 59
*Mar 1 08:36:59.293: addr_len: 4(NSAP), subaddr_len: 0(NSAP), proto_len: 4, pref: 0
*Mar 1 08:36:59.297: client NBMA: 172.36.1.1
*Mar 1 08:36:59.297: client protocol: 10.0.1.2
*Mar 1 08:36:59.297: NHRP: netid_in = 0, to_us = 1
*Mar 1 08:36:59.297: NHRP: Checking for delayed event 0.0.0.0/10.0.1.2 on list (Tunnel11).
*Mar 1 08:36:59.301: NHRP: No node found.
*Mar 1 08:36:59.301: NHRP: No need to delay processing of resolution event nbma src:172.56.1.1 nbma dst:172.36.1.1
The show ip cef command now shows that the CEF adjacency is completed. Also, the show ip nhrp command shows a dynamically learnt NHRP entry.
Spoke3# show ip cef 192.168.1.0
192.168.1.0/24, version 65, epoch 0
0 packets, 0 bytes
via 10.0.1.2, Tunnel11, 0 dependencies
next hop 10.0.1.2, Tunnel11
valid adjacency
Spoke3# show ip nhrp
10.0.1.1/32 via 10.0.1.1, Tunnel11 created 00:10:37, never expire
Type: static, Flags: used
NBMA address: 172.16.1.1
10.0.1.2/32 via 10.0.1.2, Tunnel11 created 00:00:20, expire 00:00:54
Type: dynamic, Flags: router
NBMA address: 172.36.1.1
10.0.1.4/32 via 10.0.1.4, Tunnel11 created 00:00:19, expire 00:00:40
Type: dynamic, Flags: router unique local
NBMA address: 172.56.1.1
(no-socket)
10.0.2.1/32 via 10.0.2.1, Tunnel22 created 00:10:30, never expire
Type: static, Flags: used
NBMA address: 172.26.1.1
The router flag means that the mapping is either for the remote router or for a network behind the remote router.
Backup Hub into picture
When the Primary Hub is not available, all Spoke routers learn about remote prefixes through Tunnel 22 rather than Tunnel 11.
Prefixes learnt through Tunnel 22
Spoke1# show ip route eigrp 1
D 192.168.0.0/24 [90/284472576] via 10.0.2.1, 00:06:04, Tunnel22
D 192.168.2.0/24 [90/284475136] via 10.0.2.3, 00:00:26, Tunnel22
D 192.168.3.0/24 [90/284475136] via 10.0.2.4, 00:06:02, Tunnel22
Spoke2# show ip route eigrp
D 192.168.0.0/24 [90/284472576] via 10.0.2.1, 00:00:43, Tunnel22
D 192.168.1.0/24 [90/284475136] via 10.0.2.2, 00:00:43, Tunnel22
D 192.168.3.0/24 [90/284475136] via 10.0.2.4, 00:00:43, Tunnel22
Spoke3# show ip route eigrp
D 192.168.0.0/24 [90/284472576] via 10.0.2.1, 00:06:35, Tunnel22
D 192.168.1.0/24 [90/284475136] via 10.0.2.2, 00:06:32, Tunnel22
D 192.168.2.0/24 [90/284475136] via 10.0.2.3, 00:00:57, Tunnel22
Spoke3# show ip cef 192.168.1.0
192.168.1.0/24, version 72, epoch 0
0 packets, 0 bytes
via 10.0.2.2, Tunnel22, 0 dependencies
next hop 10.0.2.2, Tunnel22
invalid adjacency
Once again when Spoke3 router attempts to send packet to 192.168.1.0/24 prefix connected to Spoke1 router, first it tries to send the packet directly to Spoke1 router but since the CEF adjacency is not complete, the packets are forwarded to the Hub. However, the Spoke3 router also sends a Resolution Request packet for Backup NHS via Tunnel 22.
Backup#
*Mar 1 18:11:13.611: NHRP: Receive Resolution Request via Tunnel22 vrf 0, packet size: 72
*Mar 1 18:11:13.615: (F) afn: IPv4(1), type: IP(800), hop: 255, ver: 1
*Mar 1 18:11:13.615: shtl: 4(NSAP), sstl: 0(NSAP)
*Mar 1 18:11:13.615: (M) flags: "router auth src-stable nat ", reqid: 195
*Mar 1 18:11:13.615: src NBMA: 172.56.1.1
*Mar 1 18:11:13.615: src protocol: 10.0.2.4, dst protocol: 10.0.2.2
*Mar 1 18:11:13.619: (C-1) code: no error(0)
*Mar 1 18:11:13.619: prefix: 0, mtu: 1514, hd_time: 60
*Mar 1 18:11:13.619: addr_len: 0(NSAP), subaddr_len: 0(NSAP), proto_len: 0, pref: 0
The Backup NHS receives the Resolution Reply packet. It looks up its NHRP cache and finds a valid mapping. It responds with a Resolution Reply packet back to the Spoke3 router with correct mapping.
*Mar 1 18:11:13.623: NHRP: Forwarding Resolution Request via Tunnel22 vrf 0, packet size: 92
*Mar 1 18:11:13.627: src: 10.0.2.1, dst: 10.0.2.2
*Mar 1 18:11:13.627: (F) afn: IPv4(1), type: IP(800), hop: 254, ver: 1
*Mar 1 18:11:13.627: shtl: 4(NSAP), sstl: 0(NSAP)
*Mar 1 18:11:13.627: (M) flags: "router auth src-stable nat ", reqid: 195
*Mar 1 18:11:13.631: src NBMA: 172.56.1.1
*Mar 1 18:11:13.631: src protocol: 10.0.2.4, dst protocol: 10.0.2.2
*Mar 1 18:11:13.631: (C-1) code: no error(0)
*Mar 1 18:11:13.631: prefix: 0, mtu: 1514, hd_time: 60
*Mar 1 18:11:13.631: addr_len: 0(NSAP), subaddr_len: 0(NSAP), proto_len: 0, pref: 0
The show ip nhrp command confirms the dynamically learnt mapping on Spoke3 router.
show ip nhrp
Spoke3# show ip nhrp
10.0.1.1/32 via 10.0.1.1, Tunnel11 created 00:28:08, never expire
Type: static, Flags: used
NBMA address: 172.16.1.1
10.0.2.1/32 via 10.0.2.1, Tunnel22 created 00:28:01, never expire
Type: static, Flags: used
NBMA address: 172.26.1.1
10.0.2.2/32 via 10.0.2.2, Tunnel22 created 00:01:13, expire 00:00:23
Type: dynamic, Flags: router
NBMA address: 172.36.1.1
10.0.2.4/32 via 10.0.2.4, Tunnel22 created 00:01:12, expire 00:00:05
Type: dynamic, Flags: router unique local
NBMA address: 172.56.1.1
(no-socket)
Adding IPSec
For simplicity, we will use pre-shared keys for authentication for IKE Phase 1 in IPSec. For most scalability, X.509 digital certificates and PKI must be used. For IKE Phase 2, we use IPSec Profiles with tunnel interfaces. This can be applied to tunnel interfaces using tunnel protection ipsec profile <profile-name> [shared] command. The shared keyword is used on Branch routers as the two mGRE tunnel interfaces use the same tunnel source (Serial 0/0). All the traffic passing through the tunnel will be protected by IPSec.
Since mGRE adds new IP header, the transport mode is used with IPSec. The IPSec configuration on all routers is as follows:
IPSec Configuration on Primary router
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set TS esp-3des esp-md5-hmac
mode transport
!
crypto ipsec profile DMVPN
set transform-set TS
!
interface Tunnel 11
....
tunnel protection ipsec profile DMVPN
IPSec Configuration on Backup router
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set TS esp-3des esp-md5-hmac
mode transport
!
crypto ipsec profile DMVPN
set transform-set TS
!
interface Tunnel 22
....
tunnel protection ipsec profile DMVPN
All Branch routers share the same IPSec configuration.
IPSec Configuration on Branch routers
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set TS esp-3des esp-md5-hmac
mode transport
!
crypto ipsec profile DMVPN
set transform-set TS
!
interface Tunnel 11
....
tunnel protection ipsec profile DMVPN shared
!
interface Tunnel 22
....
tunnel protection ipsec profile DMVPN shared
Since all Branch routers send mGRE encapsulated EIGRP Hello multicast packets towards the Hub routers over both tunnels, ISAKMP negotiations start between Branch routers and Hub routers.
Both, Branch and Hub routers will create IPSec SA for GRE protocol (value = 47).
Spoke3# show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
172.26.1.1 172.56.1.1 QM_IDLE 1002 0 ACTIVE
172.16.1.1 172.56.1.1 QM_IDLE 1001 0 ACTIVE
IPv6 Crypto ISAKMP SA
Spoke3# show crypto ipsec sa
interface: Tunnel11
Crypto map tag: DMVPN-head-1, local addr 172.56.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (172.56.1.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (172.26.1.1/255.255.255.255/47/0)
current_peer 172.26.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 76, #pkts encrypt: 76, #pkts digest: 76
#pkts decaps: 77, #pkts decrypt: 77, #pkts verify: 77
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 172.56.1.1, remote crypto endpt.: 172.26.1.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0x6D677A69(1835498089)
inbound esp sas:
spi: 0x171FDA10(387963408)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 3, flow_id: SW:3, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4437345/3357)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x6D677A69(1835498089)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 4, flow_id: SW:4, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4437345/3357)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (172.56.1.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (172.16.1.1/255.255.255.255/47/0)
current_peer 172.16.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 75, #pkts encrypt: 75, #pkts digest: 75
#pkts decaps: 77, #pkts decrypt: 77, #pkts verify: 77
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 172.56.1.1, remote crypto endpt.: 172.16.1.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0xB4509812(3025180690)
inbound esp sas:
spi: 0xEF9D4CCB(4020063435)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 1, flow_id: SW:1, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4569056/3351)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xB4509812(3025180690)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 2, flow_id: SW:2, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4569056/3351)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
interface: Tunnel22
Crypto map tag: DMVPN-head-1, local addr 172.56.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (172.56.1.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (172.26.1.1/255.255.255.255/47/0)
current_peer 172.26.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 76, #pkts encrypt: 76, #pkts digest: 76
#pkts decaps: 77, #pkts decrypt: 77, #pkts verify: 77
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 172.56.1.1, remote crypto endpt.: 172.26.1.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0x6D677A69(1835498089)
inbound esp sas:
spi: 0x171FDA10(387963408)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 3, flow_id: SW:3, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4437345/3357)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x6D677A69(1835498089)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 4, flow_id: SW:4, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4437345/3357)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (172.56.1.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (172.16.1.1/255.255.255.255/47/0)
current_peer 172.16.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 75, #pkts encrypt: 75, #pkts digest: 75
#pkts decaps: 77, #pkts decrypt: 77, #pkts verify: 77
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 172.56.1.1, remote crypto endpt.: 172.16.1.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0xB4509812(3025180690)
inbound esp sas:
spi: 0xEF9D4CCB(4020063435)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 1, flow_id: SW:1, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4569056/3351)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xB4509812(3025180690)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 2, flow_id: SW:2, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4569056/3351)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
When Branch3 router sends packets to 192.168.1.0/24 connected to Branch1 router, Branch3 router tries to resolve the next-hop IP address using NHRP Resolution Request packets. The NHS provides the correct mapping- NBMA address 172.36.1.1 and tunnel IP address 10.0.1.2. Now Branch3 router tries to send the packets directly to Branch1 router. This triggers ISAKMP negotiation with NBMA address 172.36.1.1. This results in an IPSec SA corresponding to IP address pair 172.56.1.1,172.36.1.1 and GRE protocol (47).
Spoke3# show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
172.56.1.1 172.36.1.1 QM_IDLE 1003 0 ACTIVE
172.26.1.1 172.56.1.1 QM_IDLE 1002 0 ACTIVE
172.36.1.1 172.56.1.1 QM_IDLE 1004 0 ACTIVE
172.16.1.1 172.56.1.1 QM_IDLE 1001 0 ACTIVE
IPv6 Crypto ISAKMP SA
Spoke3# show crypto ipsec sa
interface: Tunnel11
Crypto map tag: DMVPN-head-1, local addr 172.56.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (172.56.1.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (172.26.1.1/255.255.255.255/47/0)
current_peer 172.26.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 150, #pkts encrypt: 150, #pkts digest: 150
#pkts decaps: 151, #pkts decrypt: 151, #pkts verify: 151
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 172.56.1.1, remote crypto endpt.: 172.26.1.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0x6D677A69(1835498089)
inbound esp sas:
spi: 0x171FDA10(387963408)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 3, flow_id: SW:3, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4437335/3078)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x6D677A69(1835498089)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 4, flow_id: SW:4, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4437336/3078)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (172.56.1.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (172.36.1.1/255.255.255.255/47/0)
current_peer 172.36.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 5, #pkts encrypt: 5, #pkts digest: 5
#pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 172.56.1.1, remote crypto endpt.: 172.36.1.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0x665BD18E(1717293454)
inbound esp sas:
spi: 0xDED5217E(3738509694)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 7, flow_id: SW:7, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4477180/3502)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x665BD18E(1717293454)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 8, flow_id: SW:8, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4477180/3502)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (172.56.1.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (172.16.1.1/255.255.255.255/47/0)
current_peer 172.16.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 156, #pkts encrypt: 156, #pkts digest: 156
#pkts decaps: 157, #pkts decrypt: 157, #pkts verify: 157
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 172.56.1.1, remote crypto endpt.: 172.16.1.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0xB4509812(3025180690)
inbound esp sas:
spi: 0xEF9D4CCB(4020063435)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 1, flow_id: SW:1, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4569045/3072)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xB4509812(3025180690)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 2, flow_id: SW:2, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4569046/3072)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
interface: Tunnel22
Crypto map tag: DMVPN-head-1, local addr 172.56.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (172.56.1.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (172.26.1.1/255.255.255.255/47/0)
current_peer 172.26.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 150, #pkts encrypt: 150, #pkts digest: 150
#pkts decaps: 151, #pkts decrypt: 151, #pkts verify: 151
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 1, #recv errors 0
local crypto endpt.: 172.56.1.1, remote crypto endpt.: 172.26.1.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0x6D677A69(1835498089)
inbound esp sas:
spi: 0x171FDA10(387963408)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 3, flow_id: SW:3, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4437335/3078)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x6D677A69(1835498089)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 4, flow_id: SW:4, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4437336/3078)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (172.56.1.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (172.36.1.1/255.255.255.255/47/0)
current_peer 172.36.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 5, #pkts encrypt: 5, #pkts digest: 5
#pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 172.56.1.1, remote crypto endpt.: 172.36.1.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0x665BD18E(1717293454)
inbound esp sas:
spi: 0xDED5217E(3738509694)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 7, flow_id: SW:7, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4477180/3502)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x665BD18E(1717293454)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 8, flow_id: SW:8, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4477180/3502)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (172.56.1.1/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (172.16.1.1/255.255.255.255/47/0)
current_peer 172.16.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 156, #pkts encrypt: 156, #pkts digest: 156
#pkts decaps: 157, #pkts decrypt: 157, #pkts verify: 157
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 172.56.1.1, remote crypto endpt.: 172.16.1.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0xB4509812(3025180690)
inbound esp sas:
spi: 0xEF9D4CCB(4020063435)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 1, flow_id: SW:1, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4569045/3072)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xB4509812(3025180690)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 2, flow_id: SW:2, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4569046/3072)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas: