2547oDMVPN

2547oDMVPN

2547oDMVPN is the second name for MPLS VPN over DMVPN. This solution is to extend MPLS VPN to the branches. In this solution, MPLS VPN is implemented in the enterprise network, while the Service Provider core network still runs on pure IP network.

Cisco recommends that to seamlessly extend MPLS VPN network to branches (spokes), the DMVPN Hub must be a P-device to label switch packets between Hub and Spokes. The P-device (DMVPN Hub) establishes an LDP neighbor relationship with Branch routers which act as MPLS VPN PE routers.

This article will demonstrate a scenario which consists of Dual DMVPN Hubs (for resiliency) acting as P-routers (P1-Hub and P2-Hub). Although DMVPN provides an ability to dynamically create Branch-to-Branch tunnel, that wont be available in MPLV VPN over DMVPN. The reason being MPLS network requires packets to be label switched all the way to PE routers. All the Branch routers in this solution becomes PE routers, and they perform label imposition and label switching. When a dynamic tunnel is setup between Branch-to-Branch, label imposition for this tunnel is not available. Hence, all Branch-to-Branch label switching is easily implemented through the Hub.

Since two hub routers (P1-Hub as Primary DMVPN Hub and P2-Hub as Backup DMVPN Hub) are implemented, two different tunnels will be configured on Br11-PE, Br12a-PE and Br12b-PE Branch routers for redundancy. When the Primary tunnel fails, after routing protocol convergence, the traffic can pass through the Backup tunnel.

The Route-Reflector (RR) router forms BGP adjacency with all PE devices in the enterprise network. This RR is responsible for distributing VPN routes between PE devices.

At a Branch location, Br12a-PE and Br12b-PE routers implement HSRP for high availability. The MPLS network supports two VRFs- IT_DEPT and ENGG_DEPT.

The following table provides the NBMA address to Tunnel IP address mapping for relevant routers.

MPLS VPN Configuration

All PE routers will have two VRFs configured as follows:

VRF Configuration

ip vrf IT_DEPT

 rd 1:1

 route-target both 1:1

ip vrf ENGG_DEPT

 rd 1:2

 route-target both 1:2

The Campus-PE and Br11-PE routers have similar configuration as below:

Campus-PE MPLS VPN Configuration

interface Loopback 0

 ip address 1.1.1.1 255.255.255.255

 ip ospf 1 area 0

interface fastethernet 0/1

 no shutdown

interface fastethernet 0/1.100

 ip vrf forwarding IT_DEPT

 encapsulation dot1q 100

 ip address 192.168.11.1 255.255.255.0

interface fastethernet 0/1.200

 ip vrf forwarding ENGG_DEPT

 encapsulation dot1q 200

 ip address 192.168.12.1 255.255.255.0

router bgp 100

 neighbor 2.2.2.2 remote-as 100

 neighbor 2.2.2.2 update-source Loopback 0

 address-family vpnv4

 neighbor 2.2.2.2 activate

 exit-address-family

 address-family ipv4 vrf IT_DEPT

 redistribute connected

 exit-address-family

 address-family ipv4 vrf ENGG_DEPT

 redistribute connected

 exit-address-family

Br11-PE MPLS VPN Configuration

interface Loopback 0

 ip address 5.5.5.5 255.255.255.255

 ip ospf 1 area 0

interface fastethernet 1/0

 no shutdown

interface fastethernet 1/0.100

 ip vrf forwarding IT_DEPT

 encapsulation dot1q 100

 ip address 192.168.21.1 255.255.255.0

interface fastethernet 1/0.200

 ip vrf forwarding ENGG_DEPT

 encapsulation dot1q 200

 ip address 192.168.22.1 255.255.255.0

router bgp 100

 neighbor 2.2.2.2 remote-as 100

 neighbor 2.2.2.2 update-source Loopback 0

 address-family vpnv4

 neighbor 2.2.2.2 activate

 exit-address-family

 address-family ipv4 vrf IT_DEPT

 redistribute connected

 exit-address-family

 address-family ipv4 vrf ENGG_DEPT

 redistribute connected

 exit-address-family

The Br12a-PE and Br12b-PE routers have HSRP configuration as well for better resiliency. Br12a-PE will be configured to the Active HSRP router for both VRFs by making the priority higher than default of 100. The configuration is as follows:

Br12a-PE MPLS VPN Configuration

interface Loopback 0

 ip address 6.6.6.6 255.255.255.255

 ip ospf 1 area 0

interface fastethernet 0/1

 no shutdown

interface fastethernet 0/1.100

 encapsulation dot1q 100

 ip vrf forwarding IT_DEPT

 ip address 192.168.31.2 255.255.255.0

 standby 1 ip 192.168.31.1        ! HSRP for IT_DEPT VRF

 standby 1 preempt

 standby 1 priority 105

 standby 1 track 10 decrement 10

 standby 1 track 20 decrement 10

interface fastethernet 0/1.200

 encapsulation dot1q 200

 ip vrf forwarding ENGG_DEPT

 ip address 192.168.32.2 255.255.255.0

 standby 2 ip 192.168.32.1        ! HSRP for ENGG_DEPT VRF

 standby 2 preempt

 standby 2 priority 105

 standby 2 track 10 decrement 10

 standby 2 track 20 decrement 10

track 10 interface Tunnel 11 line-protocol    ! Tracking Primary Tunnel line-protocol and reachability

track 20 ip route 192.168.100.1 255.255.255.0 reachability

router bgp 100

 neighbor 2.2.2.2 remote-as 100

 neighbor 2.2.2.2 update-source Loopback 0

 address-family vpnv4

 neighbor 2.2.2.2 activate

 exit-address-family

 address-family ipv4 vrf IT_DEPT

 redistribute connected

 exit-address-family

 address-family ipv4 vrf ENGG_DEPT

 redistribute connected

 exit-address-family

Br12b-PE MPLS VPN Configuration

interface Loopback 0

 ip address 7.7.7.7 255.255.255.255

 ip ospf 1 area 0

interface fastethernet 0/1

 no shutdown

interface fastethernet 0/1.100

 encapsulation dot1q 100

 ip vrf forwarding IT_DEPT

 ip address 192.168.31.3 255.255.255.0

 standby 1 ip 192.168.31.1        ! HSRP for IT_DEPT VRF

 standby 1 preempt

standby 1 track 10 decrement 10

 standby 1 track 20 decrement 10

interface fastethernet 0/1.200

 encapsulation dot1q 200

 ip vrf forwarding ENGG_DEPT

 ip address 192.168.32.3 255.255.255.0

 standby 2 ip 192.168.32.1        ! HSRP for ENGG_DEPT VRF

 standby 2 preempt

 standby 2 track 10 decrement 10

 standby 2 track 20 decrement 10

track 10 interface Tunnel 22 line-protocol    ! Tracking Backup Tunnel line-protocol and reachability

 delay up 20                                  ! Delay bringing the Tunnel UP for 20 seconds

track 20 ip route 192.168.200.1 255.255.255.0 reachability

 delay up 20

router bgp 100

 neighbor 2.2.2.2 remote-as 100

 neighbor 2.2.2.2 update-source Loopback 0

 address-family vpnv4

 neighbor 2.2.2.2 activate

 exit-address-family

 address-family ipv4 vrf IT_DEPT

 redistribute connected

 exit-address-family

 address-family ipv4 vrf ENGG_DEPT

 redistribute connected

 exit-address-family

MP-BGP Configuration

The Route-reflector (RR) will be responsible for distributing VRF prefixes between PE routers. All PE routers will be the Clients for RR.

RR Configuration

router bgp 100

 no bgp default route-target filter            ! This causes the RR to accept all VRF prefixes i.e. ignore Route-Target

 neighbor 1.1.1.1 remote-as 100

 neighbor 1.1.1.1 update-source Loopback 0

 neighbor 5.5.5.5 remote-as 100

 neighbor 5.5.5.5 update-source Loopback 0

 neighbor 6.6.6.6 remote-as 100

 neighbor 6.6.6.6 update-source Loopback 0

 neighbor 7.7.7.7 remote-as 100

 neighbor 7.7.7.7 update-source Loopback 0

 address-family vpnv4

 neighbor 1.1.1.1 activate

 neighbor 1.1.1.1 route-reflector-client        ! Campus-PE router

 neighbor 5.5.5.5 activate

 neighbor 5.5.5.5 route-reflector-client        ! Br11-PE router

 neighbor 6.6.6.6 activate

 neighbor 6.6.6.6 route-reflector-client        ! Br12a-PE router

 neighbor 7.7.7.7 activate

 neighbor 7.7.7.7 route-reflector-client        ! Br12b-PE router

DMVPN Configuration

P1-Hub router is the Primary DMVPN Hub. It is also a P-router for MPLS VPN network.

P1-Hub Tunnel Configuration

interface Tunnel 11

 ip address 192.168.100.1 255.255.255.0

 tunnel mode gre multipoint

 tunnel source Fastethernet 0/1

 tunnel key 123

 mpls ip                                ! Enables LDP on this tunnel interface

 ip nhrp map multicast dynamic

 ip nhrp network-id 123

 ip nhrp holdtime 240

 ip ospf 1 area 0

 ip ospf network point-to-multipoint    ! This will cause all the traffic to pass through the Hub

 ip ospf cost 10                        ! This causes this tunnel interface to be preferred

P2-Hub is a Backup NHS for the DMVPN cloud. Again, this router is also a P-router for MPLS VPN network.

P2-Hub Tunnel Configuration

interface Tunnel 22

 ip address 192.168.200.1 255.255.255.0

 tunnel mode gre multipoint

 tunnel source Fastethernet 0/1

 tunnel key 456

 mpls ip

 ip nhrp map multicast dynamic

 ip nhrp network-id 456

 ip nhrp holdtime 240

 ip ospf 1 area 0

 ip ospf network point-to-multipoint

 ip ospf cost 100

Br11-PE router has two tunnel interfaces. Primary tunnel is preferred over backup tunnel.

Br11-PE Tunnel Configuration

interface Tunnel 11

 ip address 192.168.100.2 255.255.255.0

 tunnel mode gre multipoint

 tunnel source Fastethernet 0/0

 tunnel key 123

 mpls ip

 ip nhrp nhs 192.168.100.1

 ip nhrp map 192.168.100.1 10.35.1.1

 ip nhrp map multicast 10.35.1.1

 ip nhrp network-id 123

 ip nhrp holdtime 240

 ip ospf 1 area 0

 ip ospf network point-to-multipoint

 ip ospf cost 10

interface Tunnel 22

 ip address 192.168.200.2 255.255.255.0

 tunnel mode gre multipoint

 tunnel source Fastethernet 0/1

 tunnel key 456

 mpls ip

 ip nhrp nhs 192.168.200.1

 ip nhrp map 192.168.200.1 10.46.1.1

 ip nhrp map multicast 10.46.1.1

 ip nhrp network-id 456

 ip nhrp holdtime 240

 ip ospf 1 area 0

 ip ospf network point-to-multipoint

 ip ospf cost 100

Br12a-PE router has the Primary Tunnel while Br12b-PE router has the Backup tunnel.

Br12a-PE Tunnel Configuration

interface Tunnel 11

 ip address 192.168.100.3 255.255.255.0

 tunnel mode gre multipoint

 tunnel source Fastethernet 0/0

 tunnel key 123

 mpls ip

 ip nhrp nhs 192.168.100.1

 ip nhrp map 192.168.100.1 10.35.1.1

 ip nhrp map multicast 10.35.1.1

 ip nhrp network-id 123

 ip nhrp holdtime 240

 ip ospf 1 area 0

 ip ospf network point-to-multipoint

 ip ospf cost 10

Br12b-PE Tunnel Configuration

interface Tunnel 22

 ip address 192.168.200.3 255.255.255.0

 tunnel mode gre multipoint

 tunnel source Fastethernet 0/1

 tunnel key 456

 mpls ip

 ip nhrp nhs 192.168.200.1

 ip nhrp map 192.168.200.1 10.46.1.1

 ip nhrp map multicast 10.46.1.1

 ip nhrp network-id 456

 ip nhrp holdtime 240

 ip ospf 1 area 0

 ip ospf network point-to-multipoint

 ip ospf cost 100

Verification

All Branch routers send Registration Request messages with NBMA-to-Tunnel IP address mapping to the NHS. Both, P1-Hub (Primary) and P2-Hub (Backup) NHS will learn about these mapping and respond with a Registration Reply message.

NHRP Mapping on Hub routers

P1-Hub# show ip nhrp

192.168.100.2/32 via 192.168.100.2, Tunnel11 created 00:04:14, expire 00:03:24

  Type: dynamic, Flags: unique registered used

  NBMA address: 10.57.1.2

192.168.100.3/32 via 192.168.100.3, Tunnel11 created 00:03:37, expire 00:02:41

  Type: dynamic, Flags: unique registered

  NBMA address: 10.68.1.2

P2-Hub# show ip nhrp

192.168.200.2/32 via 192.168.200.2, Tunnel22 created 00:04:51, expire 00:02:48

  Type: dynamic, Flags: unique registered

  NBMA address: 10.67.1.2

192.168.200.3/32 via 192.168.200.3, Tunnel22 created 00:04:08, expire 00:03:31

  Type: dynamic, Flags: unique registered used

  NBMA address: 10.69.1.2

Once NHRP mapping is completed, OSPF forms adjacency between Hub routers and Branch routers over Tunnel interfaces. Also, since the Tunnels are enabled for LDP, even LDP adjacency is formed between Hub routers and Branch routers over Tunnel interfaces.

LDP Adjacencies over Tunnel Interfaces

P1-Hub# show mpls ldp neighbor

    Peer LDP Ident: 2.2.2.2:0; Local LDP Ident 3.3.3.3:0            ! Route-Reflector Router

        TCP connection: 2.2.2.2.646 - 3.3.3.3.53238

        State: Oper; Msgs sent/rcvd: 29/22; Downstream

        Up time: 00:03:32

        LDP discovery sources:

          FastEthernet0/0, Src IP addr: 10.234.1.1

        Addresses bound to peer LDP Ident:

          10.12.1.2       2.2.2.2         10.234.1.1

    Peer LDP Ident: 4.4.4.4:0; Local LDP Ident 3.3.3.3:0        ! P2-Hub over LAN interface

        TCP connection: 4.4.4.4.20096 - 3.3.3.3.646

        State: Oper; Msgs sent/rcvd: 29/27; Downstream

        Up time: 00:03:20

        LDP discovery sources:

          FastEthernet0/0, Src IP addr: 10.234.1.3

        Addresses bound to peer LDP Ident:

          10.234.1.3      4.4.4.4         10.46.1.1       192.168.200.1

    Peer LDP Ident: 5.5.5.5:0; Local LDP Ident 3.3.3.3:0        ! Br11-PE Router over Tunnel 11

        TCP connection: 5.5.5.5.50517 - 3.3.3.3.646

        State: Oper; Msgs sent/rcvd: 27/27; Downstream

        Up time: 00:01:56

        LDP discovery sources:

          Tunnel11, Src IP addr: 192.168.100.2

        Addresses bound to peer LDP Ident:

          10.57.1.2       10.67.1.2       5.5.5.5         192.168.100.2

          192.168.200.2

    Peer LDP Ident: 6.6.6.6:0; Local LDP Ident 3.3.3.3:0        ! Br12a-PE Router over Tunnel 11

        TCP connection: 6.6.6.6.60925 - 3.3.3.3.646

        State: Oper; Msgs sent/rcvd: 26/26; Downstream

        Up time: 00:01:19

        LDP discovery sources:

          Tunnel11, Src IP addr: 192.168.100.3

        Addresses bound to peer LDP Ident:

          10.68.1.2       6.6.6.6         192.168.100.3

P2-Hub# show mpls ldp neighbor

    Peer LDP Ident: 3.3.3.3:0; Local LDP Ident 4.4.4.4:0        ! P1-Hub Router over LAN Interface

        TCP connection: 3.3.3.3.646 - 4.4.4.4.20096

        State: Oper; Msgs sent/rcvd: 31/32; Downstream

        Up time: 00:06:32

        LDP discovery sources:

          FastEthernet0/0, Src IP addr: 10.234.1.2

        Addresses bound to peer LDP Ident:

          10.234.1.2      3.3.3.3         10.35.1.1       192.168.100.1

    Peer LDP Ident: 2.2.2.2:0; Local LDP Ident 4.4.4.4:0        ! RR Router

        TCP connection: 2.2.2.2.646 - 4.4.4.4.30422

        State: Oper; Msgs sent/rcvd: 31/25; Downstream

        Up time: 00:06:17

        LDP discovery sources:

          FastEthernet0/0, Src IP addr: 10.234.1.1

        Addresses bound to peer LDP Ident:

          10.12.1.2       2.2.2.2         10.234.1.1

    Peer LDP Ident: 5.5.5.5:0; Local LDP Ident 4.4.4.4:0        ! Br11-PE Router over Tunnel 22

        TCP connection: 5.5.5.5.25406 - 4.4.4.4.646

        State: Oper; Msgs sent/rcvd: 29/29; Downstream

        Up time: 00:04:25

        LDP discovery sources:

          Tunnel22, Src IP addr: 192.168.200.2

        Addresses bound to peer LDP Ident:

          10.57.1.2       10.67.1.2       5.5.5.5         192.168.100.2

          192.168.200.2

    Peer LDP Ident: 7.7.7.7:0; Local LDP Ident 4.4.4.4:0        ! Br12b-PE Router over Tunnel 22

        TCP connection: 7.7.7.7.11262 - 4.4.4.4.646

        State: Oper; Msgs sent/rcvd: 29/29; Downstream

        Up time: 00:04:28

        LDP discovery sources:

          Tunnel22, Src IP addr: 192.168.200.3

        Addresses bound to peer LDP Ident:

          10.69.1.2       7.7.7.7         192.168.200.3

Also, as OSPF adjacency is formed over Tunnel interfaces, BGP neighbor relationship is formed between Branch routers and Route-Reflector router. The below output shows VRF prefixes learnt via MP-BGP on Br12a-PE router. Notice the RR forwards the updates without changing the next-hop.

VRF Prefixes on Br12a-PE

Br12a-PE# show ip bgp vpnv4 all

BGP table version is 13, local router ID is 6.6.6.6

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path

Route Distinguisher: 1:1 (default for vrf IT_DEPT)

*>i192.168.11.0     1.1.1.1                  0    100      0 ?

*>i192.168.21.0     5.5.5.5                  0    100      0 ?

*> 192.168.31.0     0.0.0.0                  0         32768 ?

Route Distinguisher: 1:2 (default for vrf ENGG_DEPT)

*>i192.168.12.0     1.1.1.1                  0    100      0 ?

*>i192.168.22.0     5.5.5.5                  0    100      0 ?

*> 192.168.32.0     0.0.0.0                  0         32768 ?

Br12a-PE# show ip cef vrf IT_DEPT 192.168.21.0

192.168.21.0/24, version 13, epoch 0

0 packets, 0 bytes

  tag information set

    local tag: VPN-route-head

    fast tag rewrite with Tu11, 192.168.100.1, tags imposed: {28 29}

  via 5.5.5.5, 0 dependencies, recursive

    next hop 192.168.100.1, Tunnel11 via 5.5.5.5/32

    valid adjacency

    tag rewrite with Tu11, 192.168.100.1, tags imposed: {28 29}

Br12a-PE# show ip cef vrf ENGG_DEPT 192.168.22.0

192.168.22.0/24, version 13, epoch 0

0 packets, 0 bytes

  tag information set

    local tag: VPN-route-head

    fast tag rewrite with Tu11, 192.168.100.1, tags imposed: {28 30}

  via 5.5.5.5, 0 dependencies, recursive

    next hop 192.168.100.1, Tunnel11 via 5.5.5.5/32

    valid adjacency

    tag rewrite with Tu11, 192.168.100.1, tags imposed: {28 30}

Currently, Br12a-PE router is set to be the Active HSRP router. The show standby command shows that Br12b-PE router is the Standby router.

show standby

Br12a-PE# show standby

FastEthernet0/1.100 - Group 1

  State is Active

    5 state changes, last state change 00:02:40

  Virtual IP address is 192.168.31.1

  Active virtual MAC address is 0000.0c07.ac01

    Local virtual MAC address is 0000.0c07.ac01 (v1 default)

  Hello time 3 sec, hold time 10 sec

    Next hello sent in 1.044 secs

  Preemption enabled

  Active router is local

  Standby router is 192.168.31.3, priority 100 (expires in 9.140 sec)

  Priority 105 (configured 105)

    Track object 10 state Up decrement 10

    Track object 20 state Up decrement 10

  Group name is "hsrp-Fa0/1.100-1" (default)

FastEthernet0/1.200 - Group 2

  State is Active

    2 state changes, last state change 00:32:57

  Virtual IP address is 192.168.32.1

  Active virtual MAC address is 0000.0c07.ac02

    Local virtual MAC address is 0000.0c07.ac02 (v1 default)

  Hello time 3 sec, hold time 10 sec

    Next hello sent in 1.272 secs

  Preemption enabled

  Active router is local

  Standby router is 192.168.32.3, priority 100 (expires in 8.768 sec)

  Priority 105 (configured 105)

    Track object 10 state Up decrement 10

    Track object 20 state Up decrement 10

  Group name is "hsrp-Fa0/1.200-2" (default)

DMVPN Hub Failover

When Primary Hub fails (P1-Hub), all Branch routers learn about VRF Prefixes over backup tunnel. On Br12a-PE router, the tracking object (20) fails to reach the Primary Hub. Hence, HSRP Standby router (Br12b-PE) now becomes the Active router.

Br12a-PE realizes Primary Hub is down

Br12a-PE#

*Mar  1 00:36:34.527: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Tunnel11 from FULL to DOWN, Neighbor Down: Dead timer expired

Br12a-PE#

*Mar  1 00:36:53.287: %TRACKING-5-STATE: 20 ip route 192.168.100.1/32 reachability Up->Down

Br12a-PE#

*Mar  1 00:36:55.415: %HSRP-5-STATECHANGE: FastEthernet0/1.100 Grp 1 state Active -> Speak

*Mar  1 00:36:55.615: %HSRP-5-STATECHANGE: FastEthernet0/1.200 Grp 2 state Active -> Speak

Br12a-PE#

*Mar  1 00:37:05.411: %HSRP-5-STATECHANGE: FastEthernet0/1.100 Grp 1 state Speak -> Standby

*Mar  1 00:37:05.611: %HSRP-5-STATECHANGE: FastEthernet0/1.200 Grp 2 state Speak -> Standby

*Mar  1 00:37:17.207: %BGP-5-ADJCHANGE: neighbor 2.2.2.2 Down BGP Notification sent

Br12a-PE#

*Mar  1 00:37:17.207: %BGP-3-NOTIFICATION: sent to neighbor 2.2.2.2 4/0 (hold time expired) 0 bytes

Br12a-PE# show track

Track 10

  Interface Tunnel11 line-protocol

  Line protocol is Up

    1 change, last change 00:09:12

  Tracked by:

    HSRP FastEthernet0/1.100 1

    HSRP FastEthernet0/1.200 2

Track 20

  IP route 192.168.100.1 255.255.255.255 reachability

  Reachability is Down (no route)

    3 changes, last change 00:00:24

  First-hop interface is unknown

  Tracked by:

    HSRP FastEthernet0/1.100 1

    HSRP FastEthernet0/1.200 2

Br12a-PE# show standby

FastEthernet0/1.100 - Group 1

  State is Standby

    7 state changes, last state change 00:00:17

  Virtual IP address is 192.168.31.1

  Active virtual MAC address is 0000.0c07.ac01

    Local virtual MAC address is 0000.0c07.ac01 (v1 default)

  Hello time 3 sec, hold time 10 sec

    Next hello sent in 0.516 secs

  Preemption enabled

  Active router is 192.168.31.3, priority 100 (expires in 9.492 sec)

  Standby router is local

  Priority 95 (configured 105)

    Track object 10 state Up decrement 10

    Track object 20 state Down decrement 10

  Group name is "hsrp-Fa0/1.100-1" (default)

FastEthernet0/1.200 - Group 2

  State is Standby

    4 state changes, last state change 00:00:17

  Virtual IP address is 192.168.32.1

  Active virtual MAC address is 0000.0c07.ac02

    Local virtual MAC address is 0000.0c07.ac02 (v1 default)

  Hello time 3 sec, hold time 10 sec

    Next hello sent in 0.712 secs

  Preemption enabled

  Active router is 192.168.32.3, priority 100 (expires in 9.776 sec)

  Standby router is local

  Priority 95 (configured 105)

    Track object 10 state Up decrement 10

    Track object 20 state Down decrement 10

  Group name is "hsrp-Fa0/1.200-2" (default)

All VRF prefixes at this branch location are learnt by Br12b-PE router.

VRF Prefixes on Br12b-PE

Br12b-PE# show ip bgp vpnv4 all

BGP table version is 19, local router ID is 7.7.7.7

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path

Route Distinguisher: 1:1 (default for vrf IT_DEPT)

*>i192.168.11.0     1.1.1.1                  0    100      0 ?

*>i192.168.21.0     5.5.5.5                  0    100      0 ?

*> 192.168.31.0     0.0.0.0                  0         32768 ?

Route Distinguisher: 1:2 (default for vrf ENGG_DEPT)

*>i192.168.12.0     1.1.1.1                  0    100      0 ?

*>i192.168.22.0     5.5.5.5                  0    100      0 ?

*> 192.168.32.0     0.0.0.0                  0         32768 ?

Br12b-PE# show ip cef vrf IT_DEPT 192.168.21.0

192.168.21.0/24, version 16, epoch 0

0 packets, 0 bytes

  tag information set

    local tag: VPN-route-head

    fast tag rewrite with Tu22, 192.168.200.1, tags imposed: {28 29}

  via 5.5.5.5, 0 dependencies, recursive

    next hop 192.168.200.1, Tunnel22 via 5.5.5.5/32

    valid adjacency

    tag rewrite with Tu22, 192.168.200.1, tags imposed: {28 29}

Br12b-PE# show ip cef vrf ENGG_DEPT 192.168.22.0

192.168.22.0/24, version 15, epoch 0

0 packets, 0 bytes

  tag information set

    local tag: VPN-route-head

    fast tag rewrite with Tu22, 192.168.200.1, tags imposed: {28 30}

  via 5.5.5.5, 0 dependencies, recursive

    next hop 192.168.200.1, Tunnel22 via 5.5.5.5/32

    valid adjacency

    tag rewrite with Tu22, 192.168.200.1, tags imposed: {28 30}

IPSec Configuration

No DMVPN configuration is complete without IPSec. A common IPSec configuration applies to all DMVPN routers. All traffic flowing through Tunnel interfaces is encrypted by IPSec.

IPSec Configuration

crypto isakmp policy 10

 authentication pre-share

crypto isakmp key 0 cisco address 0.0.0.0 0.0.0.0

crypto ipsec transform-set TS esp-3des esp-md5-hmac

 mode transport

crypto ipsec profile DMVPN

 set transform-set TS

interface Tunnel 11 or 22

 ....

 tunnel protection ipsec profile DMVPN [shared]

The below output shows successful IKE Phase 1 and 2 completed between Hub and Branch routers.

IPSec on Hubs

P1-Hub# show crypto isakmp sa

IPv4 Crypto ISAKMP SA

dst             src             state          conn-id slot status

10.35.1.1       10.68.1.2       QM_IDLE           1002    0 ACTIVE

10.35.1.1       10.67.1.2       QM_IDLE           1001    0 ACTIVE

IPv6 Crypto ISAKMP SA

P2-Hub# show crypto isakmp sa

IPv4 Crypto ISAKMP SA

dst             src             state          conn-id slot status

10.46.1.1       10.69.1.2       QM_IDLE           1005    0 ACTIVE

10.46.1.1       10.67.1.2       QM_IDLE           1006    0 ACTIVE

IPv6 Crypto ISAKMP SA

Br11-PE router negotiates IKE over Tunnel 11 and Tunnel 22 due to LDP and OSPF messages flowing over both tunnels.

Successful IKE Phase 1 & 2 on Br11-PE

Br11-PE# show crypto isakmp sa

IPv4 Crypto ISAKMP SA

dst             src             state          conn-id slot status

10.46.1.1       10.67.1.2       QM_IDLE           1005    0 ACTIVE

10.35.1.1       10.67.1.2       QM_IDLE           1003    0 ACTIVE

IPv6 Crypto ISAKMP SA

Br11-PE# show crypto ipsec sa

interface: Tunnel11

    Crypto map tag: DMVPN-head-1, local addr 10.67.1.2

   protected vrf: (none)

   local  ident (addr/mask/prot/port): (10.57.1.2/255.255.255.255/47/0)

   remote ident (addr/mask/prot/port): (10.35.1.1/255.255.255.255/47/0)

   current_peer 10.35.1.1 port 500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 447, #pkts encrypt: 447, #pkts digest: 447

    #pkts decaps: 471, #pkts decrypt: 471, #pkts verify: 471

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0

    #pkts not decompressed: 0, #pkts decompress failed: 0

    #send errors 42, #recv errors 0

     local crypto endpt.: 10.67.1.2, remote crypto endpt.: 10.35.1.1

     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0

     current outbound spi: 0xB568463F(3043509823)

     inbound esp sas:

      spi: 0xDA9D0B33(3667725107)

        transform: esp-3des esp-md5-hmac ,

        in use settings ={Tunnel, }

        conn id: 7, flow_id: SW:7, crypto map: DMVPN-head-1

        sa timing: remaining key lifetime (k/sec): (4487455/2441)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

      spi: 0xB568463F(3043509823)

        transform: esp-3des esp-md5-hmac ,

        in use settings ={Tunnel, }

        conn id: 8, flow_id: SW:8, crypto map: DMVPN-head-1

        sa timing: remaining key lifetime (k/sec): (4487458/2441)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

   protected vrf: (none)

   local  ident (addr/mask/prot/port): (10.67.1.2/255.255.255.255/47/0)

   remote ident (addr/mask/prot/port): (10.46.1.1/255.255.255.255/47/0)

   current_peer 10.46.1.1 port 500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 38, #pkts encrypt: 38, #pkts digest: 38

    #pkts decaps: 36, #pkts decrypt: 36, #pkts verify: 36

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0

    #pkts not decompressed: 0, #pkts decompress failed: 0

    #send errors 3, #recv errors 0

     local crypto endpt.: 10.67.1.2, remote crypto endpt.: 10.46.1.1

     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0

     current outbound spi: 0x49D6961C(1238799900)

     inbound esp sas:

      spi: 0x5F199AAD(1595513517)

        transform: esp-3des esp-md5-hmac ,

        in use settings ={Transport, }

        conn id: 11, flow_id: SW:11, crypto map: DMVPN-head-1

        sa timing: remaining key lifetime (k/sec): (4384071/3499)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

      spi: 0x49D6961C(1238799900)

        transform: esp-3des esp-md5-hmac ,

        in use settings ={Transport, }

        conn id: 12, flow_id: SW:12, crypto map: DMVPN-head-1

        sa timing: remaining key lifetime (k/sec): (4384070/3499)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

interface: Tunnel22

    Crypto map tag: DMVPN-head-1, local addr 10.67.1.2

   protected vrf: (none)

   local  ident (addr/mask/prot/port): (10.57.1.2/255.255.255.255/47/0)

   remote ident (addr/mask/prot/port): (10.35.1.1/255.255.255.255/47/0)

   current_peer 10.35.1.1 port 500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 447, #pkts encrypt: 447, #pkts digest: 447

    #pkts decaps: 471, #pkts decrypt: 471, #pkts verify: 471

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0

    #pkts not decompressed: 0, #pkts decompress failed: 0

    #send errors 42, #recv errors 0

     local crypto endpt.: 10.67.1.2, remote crypto endpt.: 10.35.1.1

     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0

     current outbound spi: 0xB568463F(3043509823)

     inbound esp sas:

      spi: 0xDA9D0B33(3667725107)

        transform: esp-3des esp-md5-hmac ,

        in use settings ={Tunnel, }

        conn id: 7, flow_id: SW:7, crypto map: DMVPN-head-1

        sa timing: remaining key lifetime (k/sec): (4487455/2441)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

      spi: 0xB568463F(3043509823)

        transform: esp-3des esp-md5-hmac ,

        in use settings ={Tunnel, }

        conn id: 8, flow_id: SW:8, crypto map: DMVPN-head-1

        sa timing: remaining key lifetime (k/sec): (4487458/2441)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

   protected vrf: (none)

   local  ident (addr/mask/prot/port): (10.67.1.2/255.255.255.255/47/0)

   remote ident (addr/mask/prot/port): (10.46.1.1/255.255.255.255/47/0)

   current_peer 10.46.1.1 port 500

     PERMIT, flags={origin_is_acl,}

    #pkts encaps: 38, #pkts encrypt: 38, #pkts digest: 38

    #pkts decaps: 36, #pkts decrypt: 36, #pkts verify: 36

    #pkts compressed: 0, #pkts decompressed: 0

    #pkts not compressed: 0, #pkts compr. failed: 0

    #pkts not decompressed: 0, #pkts decompress failed: 0

    #send errors 3, #recv errors 0

     local crypto endpt.: 10.67.1.2, remote crypto endpt.: 10.46.1.1

     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0

     current outbound spi: 0x49D6961C(1238799900)

     inbound esp sas:

      spi: 0x5F199AAD(1595513517)

        transform: esp-3des esp-md5-hmac ,

        in use settings ={Transport, }

        conn id: 11, flow_id: SW:11, crypto map: DMVPN-head-1

        sa timing: remaining key lifetime (k/sec): (4384071/3499)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:

      spi: 0x49D6961C(1238799900)

        transform: esp-3des esp-md5-hmac ,

        in use settings ={Transport, }

        conn id: 12, flow_id: SW:12, crypto map: DMVPN-head-1

        sa timing: remaining key lifetime (k/sec): (4384070/3499)

        IV size: 8 bytes

        replay detection support: Y

        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

Page updated

Google Sites

Report abuse