Configuring Dynamic Multipoint VPN (DMVPN)

The Dynamic Multipoint VPN (DMVPN) feature allows users to better scale large and small IPSec VPNs by combining generic routing encapsulation (GRE) tunnels, IPSec encryption, and Next Hop Resolution Protocol (NHRP) to provide users with easy configuration through crypto profiles, which override the requirement for defining static crypto maps, and dynamic discovery of tunnel endpoints.

dmvpn

HUB Router configuration

Step:1

!--- Create an Internet Security Association and Key Management 
!--- Protocol (ISAKMP) policy for Phase 1 negotiations.
crypto isakmp policy 10
hash md5
authentication pre-share

 Step:2

!--- Add dynamic pre-shared keys for all the remote VPN 
!--- routers.

crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
Step :3

!--- Create the Phase 2 policy for actual data encryption.


crypto ipsec transform-set strong esp-3des esp-md5-hmac 

Step:4

!--- Create an IPSec profile to be applied dynamically to the 
!--- GRE over IPSec tunnels.
crypto ipsec profile cisco
set security-association lifetime seconds 120
set transform-set strong 
!


Step:5

!--- Create a GRE tunnel template which will be applied to 
!--- all the dynamically created GRE tunnels.
interface Tunnel0
ip address 192.168.1.1 255.255.255.0
no ip redirects
ip mtu 1440
ip nhrp authentication cisco123
ip nhrp map multicast dynamic
ip nhrp network-id 1
no ip split-horizon eigrp 90
no ip next-hop-self eigrp 90
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 0
tunnel protection ipsec profile cisco
Step:6

!--- This is the outbound interface.
interface FastEthernet0/0
ip address 209.168.202.225 255.255.255.0
duplex auto
speed auto

Step:7

!--- This is the inbound interface

interface FastEthernet0/1
ip address 1.1.1.1 255.255.255.0
duplex auto
speed auto


Step:8

!--- Enable a routing protocol to send and receive 
!--- dynamic updates about the private networks.

router eigrp 90
network 1.1.1.0 0.0.0.255
network 192.168.1.0
no auto-summary
!
ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 209.168.202.226
SPOKE 1   Configuration

!--- Create an ISAKMP policy for Phase 1 negotiations.

crypto isakmp policy 10
hash md5
authentication pre-share

!--- Add dynamic pre-shared keys for all the remote VPN 
!--- routers and the hub router.

crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
!
!

!--- Create the Phase 2 policy for actual data encryption.

crypto ipsec transform-set strong esp-3des esp-md5-hmac 
!

!--- Create an IPSec profile to be applied dynamically to 
!--- the GRE over IPSec tunnels.

crypto ipsec profile cisco
set security-association lifetime seconds 120
set transform-set strong
!--- Create a GRE tunnel template to be applied to 
!--- all the dynamically created GRE tunnels.

interface Tunnel0
ip address 192.168.1.2 255.255.255.0
no ip redirects
ip mtu 1440
ip nhrp authentication cisco123
ip nhrp map multicast dynamic
ip nhrp map 192.168.1.1 209.168.202.225
ip nhrp map multicast 209.168.202.225
ip nhrp network-id 1
ip nhrp nhs 192.168.1.1
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 0
tunnel protection ipsec profile cisco
!

!--- This is the outbound interface.

interface FastEthernet0/0
ip address 209.168.202.131 255.255.255.0
duplex auto
speed auto
!

!--- This is the inbound interface.

interface FastEthernet0/1
ip address 2.2.2.2 255.255.255.0
duplex auto
speed auto
!

!--- Enable a routing protocol to send and receive 
!--- dynamic updates about the private networks.

router eigrp 90
network 2.2.2.0 0.0.0.255
network 192.168.1.0
no auto-summary
!
ip http server
no ip http secure-server
ip classless
ip route 0.0.0.0 0.0.0.0 209.168.202.225
ip route 3.3.3.0 255.255.255.0 Tunnel0
!
SPOKE 2 Configuration

!--- Create an ISAKMP policy for Phase 1 negotiations.

crypto isakmp policy 10
hash md5
authentication pre-share

!--- Add dynamic pre-shared keys for all the remote VPN 
!--- routers and the hub router.

crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
!
!

!--- Create the Phase 2 policy for actual data encryption.

crypto ipsec transform-set strong esp-3des esp-md5-hmac 
!

!--- Create an IPSec profile to be applied dynamically to 
!--- the GRE over IPSec tunnels.

crypto ipsec profile cisco
set security-association lifetime seconds 120
set transform-set strong 
!
!
!--- Create a GRE tunnel template to be applied to 
!--- all the dynamically created GRE tunnels.

interface Tunnel0
ip address 192.168.1.3 255.255.255.0
no ip redirects
ip mtu 1440
ip nhrp authentication cisco123
ip nhrp map multicast dynamic
ip nhrp map 192.168.1.1 209.168.202.225
ip nhrp map multicast 209.168.202.225
ip nhrp network-id 1
ip nhrp nhs 192.168.1.1
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 0
tunnel protection ipsec profile cisco
!

!--- This is the outbound interface.

interface FastEthernet0/0
ip address 209.168.202.130 255.255.255.0
duplex auto
speed auto
!
interface Serial0/0
no ip address
shutdown
clockrate 2000000
no fair-queue
!
!--- This is the inbound interface.

interface FastEthernet0/1
ip address 3.3.3.3 255.255.255.0
duplex auto
speed auto
!
interface Serial0/1
no ip address
shutdown 
clockrate 2000000
!
interface ATM1/0
no ip address
shutdown
no atm ilmi-keepalive
!

!--- Enable a routing protocol to send and receive 
!--- dynamic updates about the private networks.

router eigrp 90
network 3.3.3.0 0.0.0.255
network 192.168.1.0
no auto-summary
!
ip http server
no ip http secure-server
ip classless
ip route 2.2.2.0 255.255.255.0 Tunnel0
ip route 0.0.0.0 0.0.0.0 209.168.202.225
!

Verification
  • show crypto engine connection active—Displays the total encrypts and decrypts per SA.
  • show crypto ipsec sa—Displays the stats on the active tunnels.
  • show crypto isakmp sa—Displays the state for the the ISAKMP SA.
 
 
Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s