2547oDMVPN
2547oDMVPN
2547oDMVPN is the second name for MPLS VPN over DMVPN. This solution is to extend MPLS VPN to the branches. In this solution, MPLS VPN is implemented in the enterprise network, while the Service Provider core network still runs on pure IP network.
Cisco recommends that to seamlessly extend MPLS VPN network to branches (spokes), the DMVPN Hub must be a P-device to label switch packets between Hub and Spokes. The P-device (DMVPN Hub) establishes an LDP neighbor relationship with Branch routers which act as MPLS VPN PE routers.
This article will demonstrate a scenario which consists of Dual DMVPN Hubs (for resiliency) acting as P-routers (P1-Hub and P2-Hub). Although DMVPN provides an ability to dynamically create Branch-to-Branch tunnel, that wont be available in MPLV VPN over DMVPN. The reason being MPLS network requires packets to be label switched all the way to PE routers. All the Branch routers in this solution becomes PE routers, and they perform label imposition and label switching. When a dynamic tunnel is setup between Branch-to-Branch, label imposition for this tunnel is not available. Hence, all Branch-to-Branch label switching is easily implemented through the Hub.
Since two hub routers (P1-Hub as Primary DMVPN Hub and P2-Hub as Backup DMVPN Hub) are implemented, two different tunnels will be configured on Br11-PE, Br12a-PE and Br12b-PE Branch routers for redundancy. When the Primary tunnel fails, after routing protocol convergence, the traffic can pass through the Backup tunnel.
The Route-Reflector (RR) router forms BGP adjacency with all PE devices in the enterprise network. This RR is responsible for distributing VPN routes between PE devices.
At a Branch location, Br12a-PE and Br12b-PE routers implement HSRP for high availability. The MPLS network supports two VRFs- IT_DEPT and ENGG_DEPT.
The following table provides the NBMA address to Tunnel IP address mapping for relevant routers.
MPLS VPN Configuration
All PE routers will have two VRFs configured as follows:
VRF Configuration
ip vrf IT_DEPT
rd 1:1
route-target both 1:1
!
ip vrf ENGG_DEPT
rd 1:2
route-target both 1:2
The Campus-PE and Br11-PE routers have similar configuration as below:
Campus-PE MPLS VPN Configuration
interface Loopback 0
ip address 1.1.1.1 255.255.255.255
ip ospf 1 area 0
!
interface fastethernet 0/1
no shutdown
!
interface fastethernet 0/1.100
ip vrf forwarding IT_DEPT
encapsulation dot1q 100
ip address 192.168.11.1 255.255.255.0
!
interface fastethernet 0/1.200
ip vrf forwarding ENGG_DEPT
encapsulation dot1q 200
ip address 192.168.12.1 255.255.255.0
!
router bgp 100
neighbor 2.2.2.2 remote-as 100
neighbor 2.2.2.2 update-source Loopback 0
!
address-family vpnv4
neighbor 2.2.2.2 activate
exit-address-family
!
address-family ipv4 vrf IT_DEPT
redistribute connected
exit-address-family
!
address-family ipv4 vrf ENGG_DEPT
redistribute connected
exit-address-family
!
Br11-PE MPLS VPN Configuration
interface Loopback 0
ip address 5.5.5.5 255.255.255.255
ip ospf 1 area 0
!
interface fastethernet 1/0
no shutdown
!
interface fastethernet 1/0.100
ip vrf forwarding IT_DEPT
encapsulation dot1q 100
ip address 192.168.21.1 255.255.255.0
!
interface fastethernet 1/0.200
ip vrf forwarding ENGG_DEPT
encapsulation dot1q 200
ip address 192.168.22.1 255.255.255.0
!
router bgp 100
neighbor 2.2.2.2 remote-as 100
neighbor 2.2.2.2 update-source Loopback 0
!
address-family vpnv4
neighbor 2.2.2.2 activate
exit-address-family
!
address-family ipv4 vrf IT_DEPT
redistribute connected
exit-address-family
!
address-family ipv4 vrf ENGG_DEPT
redistribute connected
exit-address-family
!
The Br12a-PE and Br12b-PE routers have HSRP configuration as well for better resiliency. Br12a-PE will be configured to the Active HSRP router for both VRFs by making the priority higher than default of 100. The configuration is as follows:
Br12a-PE MPLS VPN Configuration
interface Loopback 0
ip address 6.6.6.6 255.255.255.255
ip ospf 1 area 0
!
interface fastethernet 0/1
no shutdown
!
interface fastethernet 0/1.100
encapsulation dot1q 100
ip vrf forwarding IT_DEPT
ip address 192.168.31.2 255.255.255.0
standby 1 ip 192.168.31.1 ! HSRP for IT_DEPT VRF
standby 1 preempt
standby 1 priority 105
standby 1 track 10 decrement 10
standby 1 track 20 decrement 10
!
interface fastethernet 0/1.200
encapsulation dot1q 200
ip vrf forwarding ENGG_DEPT
ip address 192.168.32.2 255.255.255.0
standby 2 ip 192.168.32.1 ! HSRP for ENGG_DEPT VRF
standby 2 preempt
standby 2 priority 105
standby 2 track 10 decrement 10
standby 2 track 20 decrement 10
!
track 10 interface Tunnel 11 line-protocol ! Tracking Primary Tunnel line-protocol and reachability
track 20 ip route 192.168.100.1 255.255.255.0 reachability
!
router bgp 100
neighbor 2.2.2.2 remote-as 100
neighbor 2.2.2.2 update-source Loopback 0
!
address-family vpnv4
neighbor 2.2.2.2 activate
exit-address-family
!
address-family ipv4 vrf IT_DEPT
redistribute connected
exit-address-family
!
address-family ipv4 vrf ENGG_DEPT
redistribute connected
exit-address-family
!
Br12b-PE MPLS VPN Configuration
interface Loopback 0
ip address 7.7.7.7 255.255.255.255
ip ospf 1 area 0
!
interface fastethernet 0/1
no shutdown
!
interface fastethernet 0/1.100
encapsulation dot1q 100
ip vrf forwarding IT_DEPT
ip address 192.168.31.3 255.255.255.0
standby 1 ip 192.168.31.1 ! HSRP for IT_DEPT VRF
standby 1 preempt
standby 1 track 10 decrement 10
standby 1 track 20 decrement 10
!
interface fastethernet 0/1.200
encapsulation dot1q 200
ip vrf forwarding ENGG_DEPT
ip address 192.168.32.3 255.255.255.0
standby 2 ip 192.168.32.1 ! HSRP for ENGG_DEPT VRF
standby 2 preempt
standby 2 track 10 decrement 10
standby 2 track 20 decrement 10
!
track 10 interface Tunnel 22 line-protocol ! Tracking Backup Tunnel line-protocol and reachability
delay up 20 ! Delay bringing the Tunnel UP for 20 seconds
track 20 ip route 192.168.200.1 255.255.255.0 reachability
delay up 20
!
router bgp 100
neighbor 2.2.2.2 remote-as 100
neighbor 2.2.2.2 update-source Loopback 0
!
address-family vpnv4
neighbor 2.2.2.2 activate
exit-address-family
!
address-family ipv4 vrf IT_DEPT
redistribute connected
exit-address-family
!
address-family ipv4 vrf ENGG_DEPT
redistribute connected
exit-address-family
!
MP-BGP Configuration
The Route-reflector (RR) will be responsible for distributing VRF prefixes between PE routers. All PE routers will be the Clients for RR.
RR Configuration
router bgp 100
no bgp default route-target filter ! This causes the RR to accept all VRF prefixes i.e. ignore Route-Target
neighbor 1.1.1.1 remote-as 100
neighbor 1.1.1.1 update-source Loopback 0
neighbor 5.5.5.5 remote-as 100
neighbor 5.5.5.5 update-source Loopback 0
neighbor 6.6.6.6 remote-as 100
neighbor 6.6.6.6 update-source Loopback 0
neighbor 7.7.7.7 remote-as 100
neighbor 7.7.7.7 update-source Loopback 0
!
address-family vpnv4
neighbor 1.1.1.1 activate
neighbor 1.1.1.1 route-reflector-client ! Campus-PE router
neighbor 5.5.5.5 activate
neighbor 5.5.5.5 route-reflector-client ! Br11-PE router
neighbor 6.6.6.6 activate
neighbor 6.6.6.6 route-reflector-client ! Br12a-PE router
neighbor 7.7.7.7 activate
neighbor 7.7.7.7 route-reflector-client ! Br12b-PE router
!
DMVPN Configuration
P1-Hub router is the Primary DMVPN Hub. It is also a P-router for MPLS VPN network.
P1-Hub Tunnel Configuration
interface Tunnel 11
ip address 192.168.100.1 255.255.255.0
tunnel mode gre multipoint
tunnel source Fastethernet 0/1
tunnel key 123
mpls ip ! Enables LDP on this tunnel interface
ip nhrp map multicast dynamic
ip nhrp network-id 123
ip nhrp holdtime 240
ip ospf 1 area 0
ip ospf network point-to-multipoint ! This will cause all the traffic to pass through the Hub
ip ospf cost 10 ! This causes this tunnel interface to be preferred
P2-Hub is a Backup NHS for the DMVPN cloud. Again, this router is also a P-router for MPLS VPN network.
P2-Hub Tunnel Configuration
interface Tunnel 22
ip address 192.168.200.1 255.255.255.0
tunnel mode gre multipoint
tunnel source Fastethernet 0/1
tunnel key 456
mpls ip
ip nhrp map multicast dynamic
ip nhrp network-id 456
ip nhrp holdtime 240
ip ospf 1 area 0
ip ospf network point-to-multipoint
ip ospf cost 100
!
Br11-PE router has two tunnel interfaces. Primary tunnel is preferred over backup tunnel.
Br11-PE Tunnel Configuration
interface Tunnel 11
ip address 192.168.100.2 255.255.255.0
tunnel mode gre multipoint
tunnel source Fastethernet 0/0
tunnel key 123
mpls ip
ip nhrp nhs 192.168.100.1
ip nhrp map 192.168.100.1 10.35.1.1
ip nhrp map multicast 10.35.1.1
ip nhrp network-id 123
ip nhrp holdtime 240
ip ospf 1 area 0
ip ospf network point-to-multipoint
ip ospf cost 10
!
interface Tunnel 22
ip address 192.168.200.2 255.255.255.0
tunnel mode gre multipoint
tunnel source Fastethernet 0/1
tunnel key 456
mpls ip
ip nhrp nhs 192.168.200.1
ip nhrp map 192.168.200.1 10.46.1.1
ip nhrp map multicast 10.46.1.1
ip nhrp network-id 456
ip nhrp holdtime 240
ip ospf 1 area 0
ip ospf network point-to-multipoint
ip ospf cost 100
!
Br12a-PE router has the Primary Tunnel while Br12b-PE router has the Backup tunnel.
Br12a-PE Tunnel Configuration
interface Tunnel 11
ip address 192.168.100.3 255.255.255.0
tunnel mode gre multipoint
tunnel source Fastethernet 0/0
tunnel key 123
mpls ip
ip nhrp nhs 192.168.100.1
ip nhrp map 192.168.100.1 10.35.1.1
ip nhrp map multicast 10.35.1.1
ip nhrp network-id 123
ip nhrp holdtime 240
ip ospf 1 area 0
ip ospf network point-to-multipoint
ip ospf cost 10
!
Br12b-PE Tunnel Configuration
interface Tunnel 22
ip address 192.168.200.3 255.255.255.0
tunnel mode gre multipoint
tunnel source Fastethernet 0/1
tunnel key 456
mpls ip
ip nhrp nhs 192.168.200.1
ip nhrp map 192.168.200.1 10.46.1.1
ip nhrp map multicast 10.46.1.1
ip nhrp network-id 456
ip nhrp holdtime 240
ip ospf 1 area 0
ip ospf network point-to-multipoint
ip ospf cost 100
!
Verification
All Branch routers send Registration Request messages with NBMA-to-Tunnel IP address mapping to the NHS. Both, P1-Hub (Primary) and P2-Hub (Backup) NHS will learn about these mapping and respond with a Registration Reply message.
NHRP Mapping on Hub routers
P1-Hub# show ip nhrp
192.168.100.2/32 via 192.168.100.2, Tunnel11 created 00:04:14, expire 00:03:24
Type: dynamic, Flags: unique registered used
NBMA address: 10.57.1.2
192.168.100.3/32 via 192.168.100.3, Tunnel11 created 00:03:37, expire 00:02:41
Type: dynamic, Flags: unique registered
NBMA address: 10.68.1.2
P2-Hub# show ip nhrp
192.168.200.2/32 via 192.168.200.2, Tunnel22 created 00:04:51, expire 00:02:48
Type: dynamic, Flags: unique registered
NBMA address: 10.67.1.2
192.168.200.3/32 via 192.168.200.3, Tunnel22 created 00:04:08, expire 00:03:31
Type: dynamic, Flags: unique registered used
NBMA address: 10.69.1.2
Once NHRP mapping is completed, OSPF forms adjacency between Hub routers and Branch routers over Tunnel interfaces. Also, since the Tunnels are enabled for LDP, even LDP adjacency is formed between Hub routers and Branch routers over Tunnel interfaces.
LDP Adjacencies over Tunnel Interfaces
P1-Hub# show mpls ldp neighbor
Peer LDP Ident: 2.2.2.2:0; Local LDP Ident 3.3.3.3:0 ! Route-Reflector Router
TCP connection: 2.2.2.2.646 - 3.3.3.3.53238
State: Oper; Msgs sent/rcvd: 29/22; Downstream
Up time: 00:03:32
LDP discovery sources:
FastEthernet0/0, Src IP addr: 10.234.1.1
Addresses bound to peer LDP Ident:
10.12.1.2 2.2.2.2 10.234.1.1
Peer LDP Ident: 4.4.4.4:0; Local LDP Ident 3.3.3.3:0 ! P2-Hub over LAN interface
TCP connection: 4.4.4.4.20096 - 3.3.3.3.646
State: Oper; Msgs sent/rcvd: 29/27; Downstream
Up time: 00:03:20
LDP discovery sources:
FastEthernet0/0, Src IP addr: 10.234.1.3
Addresses bound to peer LDP Ident:
10.234.1.3 4.4.4.4 10.46.1.1 192.168.200.1
Peer LDP Ident: 5.5.5.5:0; Local LDP Ident 3.3.3.3:0 ! Br11-PE Router over Tunnel 11
TCP connection: 5.5.5.5.50517 - 3.3.3.3.646
State: Oper; Msgs sent/rcvd: 27/27; Downstream
Up time: 00:01:56
LDP discovery sources:
Tunnel11, Src IP addr: 192.168.100.2
Addresses bound to peer LDP Ident:
10.57.1.2 10.67.1.2 5.5.5.5 192.168.100.2
192.168.200.2
Peer LDP Ident: 6.6.6.6:0; Local LDP Ident 3.3.3.3:0 ! Br12a-PE Router over Tunnel 11
TCP connection: 6.6.6.6.60925 - 3.3.3.3.646
State: Oper; Msgs sent/rcvd: 26/26; Downstream
Up time: 00:01:19
LDP discovery sources:
Tunnel11, Src IP addr: 192.168.100.3
Addresses bound to peer LDP Ident:
10.68.1.2 6.6.6.6 192.168.100.3
P2-Hub# show mpls ldp neighbor
Peer LDP Ident: 3.3.3.3:0; Local LDP Ident 4.4.4.4:0 ! P1-Hub Router over LAN Interface
TCP connection: 3.3.3.3.646 - 4.4.4.4.20096
State: Oper; Msgs sent/rcvd: 31/32; Downstream
Up time: 00:06:32
LDP discovery sources:
FastEthernet0/0, Src IP addr: 10.234.1.2
Addresses bound to peer LDP Ident:
10.234.1.2 3.3.3.3 10.35.1.1 192.168.100.1
Peer LDP Ident: 2.2.2.2:0; Local LDP Ident 4.4.4.4:0 ! RR Router
TCP connection: 2.2.2.2.646 - 4.4.4.4.30422
State: Oper; Msgs sent/rcvd: 31/25; Downstream
Up time: 00:06:17
LDP discovery sources:
FastEthernet0/0, Src IP addr: 10.234.1.1
Addresses bound to peer LDP Ident:
10.12.1.2 2.2.2.2 10.234.1.1
Peer LDP Ident: 5.5.5.5:0; Local LDP Ident 4.4.4.4:0 ! Br11-PE Router over Tunnel 22
TCP connection: 5.5.5.5.25406 - 4.4.4.4.646
State: Oper; Msgs sent/rcvd: 29/29; Downstream
Up time: 00:04:25
LDP discovery sources:
Tunnel22, Src IP addr: 192.168.200.2
Addresses bound to peer LDP Ident:
10.57.1.2 10.67.1.2 5.5.5.5 192.168.100.2
192.168.200.2
Peer LDP Ident: 7.7.7.7:0; Local LDP Ident 4.4.4.4:0 ! Br12b-PE Router over Tunnel 22
TCP connection: 7.7.7.7.11262 - 4.4.4.4.646
State: Oper; Msgs sent/rcvd: 29/29; Downstream
Up time: 00:04:28
LDP discovery sources:
Tunnel22, Src IP addr: 192.168.200.3
Addresses bound to peer LDP Ident:
10.69.1.2 7.7.7.7 192.168.200.3
Also, as OSPF adjacency is formed over Tunnel interfaces, BGP neighbor relationship is formed between Branch routers and Route-Reflector router. The below output shows VRF prefixes learnt via MP-BGP on Br12a-PE router. Notice the RR forwards the updates without changing the next-hop.
VRF Prefixes on Br12a-PE
Br12a-PE# show ip bgp vpnv4 all
BGP table version is 13, local router ID is 6.6.6.6
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 1:1 (default for vrf IT_DEPT)
*>i192.168.11.0 1.1.1.1 0 100 0 ?
*>i192.168.21.0 5.5.5.5 0 100 0 ?
*> 192.168.31.0 0.0.0.0 0 32768 ?
Route Distinguisher: 1:2 (default for vrf ENGG_DEPT)
*>i192.168.12.0 1.1.1.1 0 100 0 ?
*>i192.168.22.0 5.5.5.5 0 100 0 ?
*> 192.168.32.0 0.0.0.0 0 32768 ?
Br12a-PE# show ip cef vrf IT_DEPT 192.168.21.0
192.168.21.0/24, version 13, epoch 0
0 packets, 0 bytes
tag information set
local tag: VPN-route-head
fast tag rewrite with Tu11, 192.168.100.1, tags imposed: {28 29}
via 5.5.5.5, 0 dependencies, recursive
next hop 192.168.100.1, Tunnel11 via 5.5.5.5/32
valid adjacency
tag rewrite with Tu11, 192.168.100.1, tags imposed: {28 29}
Br12a-PE# show ip cef vrf ENGG_DEPT 192.168.22.0
192.168.22.0/24, version 13, epoch 0
0 packets, 0 bytes
tag information set
local tag: VPN-route-head
fast tag rewrite with Tu11, 192.168.100.1, tags imposed: {28 30}
via 5.5.5.5, 0 dependencies, recursive
next hop 192.168.100.1, Tunnel11 via 5.5.5.5/32
valid adjacency
tag rewrite with Tu11, 192.168.100.1, tags imposed: {28 30}
Currently, Br12a-PE router is set to be the Active HSRP router. The show standby command shows that Br12b-PE router is the Standby router.
show standby
Br12a-PE# show standby
FastEthernet0/1.100 - Group 1
State is Active
5 state changes, last state change 00:02:40
Virtual IP address is 192.168.31.1
Active virtual MAC address is 0000.0c07.ac01
Local virtual MAC address is 0000.0c07.ac01 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 1.044 secs
Preemption enabled
Active router is local
Standby router is 192.168.31.3, priority 100 (expires in 9.140 sec)
Priority 105 (configured 105)
Track object 10 state Up decrement 10
Track object 20 state Up decrement 10
Group name is "hsrp-Fa0/1.100-1" (default)
FastEthernet0/1.200 - Group 2
State is Active
2 state changes, last state change 00:32:57
Virtual IP address is 192.168.32.1
Active virtual MAC address is 0000.0c07.ac02
Local virtual MAC address is 0000.0c07.ac02 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 1.272 secs
Preemption enabled
Active router is local
Standby router is 192.168.32.3, priority 100 (expires in 8.768 sec)
Priority 105 (configured 105)
Track object 10 state Up decrement 10
Track object 20 state Up decrement 10
Group name is "hsrp-Fa0/1.200-2" (default)
DMVPN Hub Failover
When Primary Hub fails (P1-Hub), all Branch routers learn about VRF Prefixes over backup tunnel. On Br12a-PE router, the tracking object (20) fails to reach the Primary Hub. Hence, HSRP Standby router (Br12b-PE) now becomes the Active router.
Br12a-PE realizes Primary Hub is down
Br12a-PE#
*Mar 1 00:36:34.527: %OSPF-5-ADJCHG: Process 1, Nbr 3.3.3.3 on Tunnel11 from FULL to DOWN, Neighbor Down: Dead timer expired
Br12a-PE#
*Mar 1 00:36:53.287: %TRACKING-5-STATE: 20 ip route 192.168.100.1/32 reachability Up->Down
Br12a-PE#
*Mar 1 00:36:55.415: %HSRP-5-STATECHANGE: FastEthernet0/1.100 Grp 1 state Active -> Speak
*Mar 1 00:36:55.615: %HSRP-5-STATECHANGE: FastEthernet0/1.200 Grp 2 state Active -> Speak
Br12a-PE#
*Mar 1 00:37:05.411: %HSRP-5-STATECHANGE: FastEthernet0/1.100 Grp 1 state Speak -> Standby
*Mar 1 00:37:05.611: %HSRP-5-STATECHANGE: FastEthernet0/1.200 Grp 2 state Speak -> Standby
*Mar 1 00:37:17.207: %BGP-5-ADJCHANGE: neighbor 2.2.2.2 Down BGP Notification sent
Br12a-PE#
*Mar 1 00:37:17.207: %BGP-3-NOTIFICATION: sent to neighbor 2.2.2.2 4/0 (hold time expired) 0 bytes
Br12a-PE# show track
Track 10
Interface Tunnel11 line-protocol
Line protocol is Up
1 change, last change 00:09:12
Tracked by:
HSRP FastEthernet0/1.100 1
HSRP FastEthernet0/1.200 2
Track 20
IP route 192.168.100.1 255.255.255.255 reachability
Reachability is Down (no route)
3 changes, last change 00:00:24
First-hop interface is unknown
Tracked by:
HSRP FastEthernet0/1.100 1
HSRP FastEthernet0/1.200 2
Br12a-PE# show standby
FastEthernet0/1.100 - Group 1
State is Standby
7 state changes, last state change 00:00:17
Virtual IP address is 192.168.31.1
Active virtual MAC address is 0000.0c07.ac01
Local virtual MAC address is 0000.0c07.ac01 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.516 secs
Preemption enabled
Active router is 192.168.31.3, priority 100 (expires in 9.492 sec)
Standby router is local
Priority 95 (configured 105)
Track object 10 state Up decrement 10
Track object 20 state Down decrement 10
Group name is "hsrp-Fa0/1.100-1" (default)
FastEthernet0/1.200 - Group 2
State is Standby
4 state changes, last state change 00:00:17
Virtual IP address is 192.168.32.1
Active virtual MAC address is 0000.0c07.ac02
Local virtual MAC address is 0000.0c07.ac02 (v1 default)
Hello time 3 sec, hold time 10 sec
Next hello sent in 0.712 secs
Preemption enabled
Active router is 192.168.32.3, priority 100 (expires in 9.776 sec)
Standby router is local
Priority 95 (configured 105)
Track object 10 state Up decrement 10
Track object 20 state Down decrement 10
Group name is "hsrp-Fa0/1.200-2" (default)
All VRF prefixes at this branch location are learnt by Br12b-PE router.
VRF Prefixes on Br12b-PE
Br12b-PE# show ip bgp vpnv4 all
BGP table version is 19, local router ID is 7.7.7.7
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 1:1 (default for vrf IT_DEPT)
*>i192.168.11.0 1.1.1.1 0 100 0 ?
*>i192.168.21.0 5.5.5.5 0 100 0 ?
*> 192.168.31.0 0.0.0.0 0 32768 ?
Route Distinguisher: 1:2 (default for vrf ENGG_DEPT)
*>i192.168.12.0 1.1.1.1 0 100 0 ?
*>i192.168.22.0 5.5.5.5 0 100 0 ?
*> 192.168.32.0 0.0.0.0 0 32768 ?
Br12b-PE# show ip cef vrf IT_DEPT 192.168.21.0
192.168.21.0/24, version 16, epoch 0
0 packets, 0 bytes
tag information set
local tag: VPN-route-head
fast tag rewrite with Tu22, 192.168.200.1, tags imposed: {28 29}
via 5.5.5.5, 0 dependencies, recursive
next hop 192.168.200.1, Tunnel22 via 5.5.5.5/32
valid adjacency
tag rewrite with Tu22, 192.168.200.1, tags imposed: {28 29}
Br12b-PE# show ip cef vrf ENGG_DEPT 192.168.22.0
192.168.22.0/24, version 15, epoch 0
0 packets, 0 bytes
tag information set
local tag: VPN-route-head
fast tag rewrite with Tu22, 192.168.200.1, tags imposed: {28 30}
via 5.5.5.5, 0 dependencies, recursive
next hop 192.168.200.1, Tunnel22 via 5.5.5.5/32
valid adjacency
tag rewrite with Tu22, 192.168.200.1, tags imposed: {28 30}
IPSec Configuration
No DMVPN configuration is complete without IPSec. A common IPSec configuration applies to all DMVPN routers. All traffic flowing through Tunnel interfaces is encrypted by IPSec.
IPSec Configuration
crypto isakmp policy 10
authentication pre-share
!
crypto isakmp key 0 cisco address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set TS esp-3des esp-md5-hmac
mode transport
!
crypto ipsec profile DMVPN
set transform-set TS
!
interface Tunnel 11 or 22
....
tunnel protection ipsec profile DMVPN [shared]
!
The below output shows successful IKE Phase 1 and 2 completed between Hub and Branch routers.
IPSec on Hubs
P1-Hub# show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
10.35.1.1 10.68.1.2 QM_IDLE 1002 0 ACTIVE
10.35.1.1 10.67.1.2 QM_IDLE 1001 0 ACTIVE
IPv6 Crypto ISAKMP SA
P2-Hub# show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
10.46.1.1 10.69.1.2 QM_IDLE 1005 0 ACTIVE
10.46.1.1 10.67.1.2 QM_IDLE 1006 0 ACTIVE
IPv6 Crypto ISAKMP SA
Br11-PE router negotiates IKE over Tunnel 11 and Tunnel 22 due to LDP and OSPF messages flowing over both tunnels.
Successful IKE Phase 1 & 2 on Br11-PE
Br11-PE# show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
10.46.1.1 10.67.1.2 QM_IDLE 1005 0 ACTIVE
10.35.1.1 10.67.1.2 QM_IDLE 1003 0 ACTIVE
IPv6 Crypto ISAKMP SA
Br11-PE# show crypto ipsec sa
interface: Tunnel11
Crypto map tag: DMVPN-head-1, local addr 10.67.1.2
protected vrf: (none)
local ident (addr/mask/prot/port): (10.57.1.2/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (10.35.1.1/255.255.255.255/47/0)
current_peer 10.35.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 447, #pkts encrypt: 447, #pkts digest: 447
#pkts decaps: 471, #pkts decrypt: 471, #pkts verify: 471
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 42, #recv errors 0
local crypto endpt.: 10.67.1.2, remote crypto endpt.: 10.35.1.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
current outbound spi: 0xB568463F(3043509823)
inbound esp sas:
spi: 0xDA9D0B33(3667725107)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 7, flow_id: SW:7, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4487455/2441)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xB568463F(3043509823)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 8, flow_id: SW:8, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4487458/2441)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (10.67.1.2/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (10.46.1.1/255.255.255.255/47/0)
current_peer 10.46.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 38, #pkts encrypt: 38, #pkts digest: 38
#pkts decaps: 36, #pkts decrypt: 36, #pkts verify: 36
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 3, #recv errors 0
local crypto endpt.: 10.67.1.2, remote crypto endpt.: 10.46.1.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
current outbound spi: 0x49D6961C(1238799900)
inbound esp sas:
spi: 0x5F199AAD(1595513517)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 11, flow_id: SW:11, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4384071/3499)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x49D6961C(1238799900)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 12, flow_id: SW:12, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4384070/3499)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
interface: Tunnel22
Crypto map tag: DMVPN-head-1, local addr 10.67.1.2
protected vrf: (none)
local ident (addr/mask/prot/port): (10.57.1.2/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (10.35.1.1/255.255.255.255/47/0)
current_peer 10.35.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 447, #pkts encrypt: 447, #pkts digest: 447
#pkts decaps: 471, #pkts decrypt: 471, #pkts verify: 471
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 42, #recv errors 0
local crypto endpt.: 10.67.1.2, remote crypto endpt.: 10.35.1.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
current outbound spi: 0xB568463F(3043509823)
inbound esp sas:
spi: 0xDA9D0B33(3667725107)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 7, flow_id: SW:7, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4487455/2441)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xB568463F(3043509823)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 8, flow_id: SW:8, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4487458/2441)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (10.67.1.2/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (10.46.1.1/255.255.255.255/47/0)
current_peer 10.46.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 38, #pkts encrypt: 38, #pkts digest: 38
#pkts decaps: 36, #pkts decrypt: 36, #pkts verify: 36
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 3, #recv errors 0
local crypto endpt.: 10.67.1.2, remote crypto endpt.: 10.46.1.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
current outbound spi: 0x49D6961C(1238799900)
inbound esp sas:
spi: 0x5F199AAD(1595513517)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 11, flow_id: SW:11, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4384071/3499)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x49D6961C(1238799900)
transform: esp-3des esp-md5-hmac ,
in use settings ={Transport, }
conn id: 12, flow_id: SW:12, crypto map: DMVPN-head-1
sa timing: remaining key lifetime (k/sec): (4384070/3499)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas: