dmvpn verification
show crypto engine connection active —Displays the total encrypts and decrypts per SA.
show crypto ipsec sa —Displays the stats on the active tunnels.
show crypto isakmp sa —Displays the state for the the ISAKMP SA.
sh crypto session
sh dmvpn on client router
sh ip eigrp nei
sh ip route eigrp
sh ip eigrp topology
Basic GRE config:
R1:
config t
int tunnel 0
ip address 192.168.0.1 255.255.255.0 <assign itself internal IP facing to public>
tunnel source <pub IP of itself>
tunnel destination <pub IP of R2>
tunnel key xxxx <optional for authentication>
R2:
config t
int tunnel 0
ip address 192.168.0.2 255.255.255.0 <assign itself internal IP facing to public>
tunnel source <pub IP of itself or interface name>
tunnel destination <pub IP of R1>
tunnel key xxxx <optional for authentication>
Basic mGRE (DMVPN) config:
R1 (HUB):
config t
int tunnel 0
ip address 192.168.0.1 255.255.255.0
tunnel source <pub IP of itself or interface name>
tunnel mode gre multipoint
tunnel key xxxx <!-- must be matched with all routers -->
ip nhrp network-id 1 <!-- network id just like AS number, must be matched with all Routers -->
ip nhrp authentication <password> <!-- must be matched with all routers -->
ip nhrp map multicast dynamic
ip mtu 1400 <! -- lower the mtu value if you experience tunnel to hub is flapping -->
ip tcp adjust-mss 1360 <! -- mtu & tcp adjust are best practice settings -->
no ip next-hop-self eigrp 100 <! -- this is required if we configure EIGRP routing for DMVPN, this help to spoke-spoke communication instead of spoke-hub-spoke communitcation -->
no ip split-horizon eigrp 100 <! -- this is required if we configure EIGRP routing for DMVPN -->
R2 & R3 (SPOKE):
config t
int tunnel 0
ip address 192.168.0.2 255.255.255.0
tunnel source <pub IP of itself or interface name>
tunnel mode gre multipoint
tunnel key xxxx
ip nhrp network-id 1 <!-- network id just like AS number, must be matched with all Routers -->
ip nhrp authentication <password>
ip nhrp map multicast dynamic
ip nhrp nhs 192.168.0.1
ip nhrp map 192.168.0.1 <pub IP of R1>
ip nhrp map multicast <pub IP of R1>
ip mtu 1400
ip tcp adjust-mss 1360
Adding IPSec on top of mGRE:
apply these settings on both HUB & SPOKE routers
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
lifetime 86400
crypto isakmp key cisco address 0.0.0.0
crypto ipsec transform-set mGRE-TS esp-3des esp-md5-hmac
crypto ipsec profile IPSec-mGRE
set security-association lifetime seconds 86400
set transform-set mGRE-TS
interface Tunnel 0
tunnel protection ipsec profile IPSec-mGRE
Sample script template:
crypto isakmp policy 10
encr aes 256
authentication pre-share
crypto isakmp key cisco address 100.100.15.1
!
!
crypto ipsec transform-set TS-DMVPN esp-3des esp-sha-hmac
mode tunnel
!
crypto ipsec profile IPSEC-DMVPN-PROFILE
set transform-set TS-DMVPN
!
interface tunnel0
tunnel mode ipsec ipv4
tunnel protection ipsec profile IPSEC-DMVPN-PROFILE
tunnel mode gre multipoint
Sample script template:
crypto isakmp policy 10
encr aes 256
authentication pre-share
crypto isakmp key cisco address 100.100.15.1
!
!
crypto ipsec transform-set TS-DMVPN esp-3des esp-sha-hmac
mode tunnel
!
crypto ipsec profile IPSEC-DMVPN-PROFILE
set transform-set TS-DMVPN
!
interface tunnel0
tunnel mode ipsec ipv4
tunnel protection ipsec profile IPSEC-DMVPN-PROFILE
tunnel mode gre multipoint
