DMVPN consists of a hub and spokes creating a VPN based on IPSec # Phase 1 NHRP and mGRE create the spoke-to-hub setup ## Hub ``` int tunnel 1 tunnel mode multipoint tunnel source g0/0/0 tunnel key 999 ip address 10.100.100.1 255.255.255.0 ip nhrp network-id 1 ip nhrp authentication nhrppass ip nhrp map multicast dynamic bandwith 4000 ip mtu 1400 ip tcp adjust-mss 1360 ``` ## Spoke ``` int tunnel 1 tunnel mode gre ip tunnel source loopback 0 tunnel destination 10.0.0.5 tunnel key 999 ip address 10.100.100.2 255.255.255.0 ip nhrp network-id 1 ip nhrp authentication nhrppass ip nhrp nhs 10.100.100.1 ip nhrp map multicast ip nhrp map 10.100.100.1 ip mtu 1400 ip tcp adjust-mss 1360 ``` Verify with: show dmvpn detail ## Add EIGRP Hub: ``` router eigrp DMVPN address-family ipv4 unicast autonomous-system 100 eigrp router-id 1.1.1.1 network 10.100.100.0 255.255.255.0 af-interface tunnel 1 no split-horizon ``` Spoke: ``` router eigrp DMVPN address-family ipv4 unicast autonomous-system 100 eigrp router-id 2.2.2.2 network 10.100.100.0 255.255.255.0 network ... eigrp stub connected ``` # Phase 2 Dynamic establishment and teardown of spoke-to-spoke tunnels (mGRE on spokes too) No specific configuration, Phase 3 is advanced Phase 2 # Phase 3 Allow regional hubs and inter-spoke connection between spokes of different regions (hierachical VPN) Change mode to multipoint to allow spoke-spoke tunnels Spoke: ``` int tunnel 1 no tunnel destination tunnel mode gre multipoint ``` (results in a Phase 2) Setup NHRP routing shortcuts Spoke: ``` int tunnel 1 ip nhrp shortcut ``` Hub: ``` int tunnel 1 ip nhrp redirect ``` # Setup for IPv6 - IPv4 over IPv6 - IPv6 over IPv4 - IPv6 over IPv6 You can add IPv6 addresses to tunnel interfaces (normal and link-local) Setup nhrp for IPv6 Hub: ``` int tunnel 1 ipv6 address 2001:db8:acad::1/64 ipv6 address fe80::1 link-local tunnel mode gre multipoint ipv6 tunnel source g0/0/0 tunnel key 999 ipv6 nhrp network-id 1 ipv6 nhrp authentication nhrppass ipv6 nhrp map multicast dynamic ipv6 nhrp redirect bandwith 4000 ipv6 mtu 1380 ipv6 tcp adjust-mss 1360 ``` Spokes: ``` int tunnel 1 ipv6 address 2001:db8:acad::2/64 ipv6 address fe80::2 link-local tunnel mode gre multipoint ipv6 tunnel source lo0 tunnel key 999 ipv6 nhrp network-id 1 ipv6 nhrp authentication nhrppass ipv6 nhrp nhs 2001:db8:acad::1 nbma multicast ipv6 nhrp map multicast dynamic ipv6 nhrp shortcut bandiwth 4000 ipv6 mtu 1380 ipv6 tcp adjust-mss 1360 ``` EIGRP: Hubs and Spokes (in Phase 3) need the no split-horizon on the tunnel interface ``` ipv6 router eigrp 100 eigrp router-id 1.1.1.1 int tunnel 1 ipv6 eigrp 100 no ipv6 split-horizon eigrp 100 ``` # Secure DMVPN with IKE (isakmp) Hub and Spokes: ``` crypto isakmp policy 99 hash sha384 encryption aes 256 group 14 authentication pre-share exit crypto isakmp key mypass address 0.0.0.0 crypto ipsec transform-set DMVPN_TRANS esp-aes 256 esp-sha384-hamc mode transport exit crypto ipsec profile DMVPN_PROFILE set transform-set DMVPN_TRANS exit int tunnel 1 tunnel protection ipsec profile DMVPN_PROFILE ``` # IKEv2 Certificate based DMVPN CA-Server and Hub: ``` crypto pki server CA-SERVER database level complete no database archive grant auto lifetime certificate 3650 lifetime ca-certificate 3650 crypto pki trustpoint CA-SERVER revocation-check crl rsakeypair CA-SERVER crypto pki trustpoint CA-TRUSTPOINT enrollment url http://:80 serial-number revocation-check none rsakeypair CA-KEY crypto ikev2 proposal IKEv2-PROPOSAL encryption aes-cbc-256 integrity sha256 group 14 crypto ikev2 policy IKEv2-POLICY proposal IKEv2-PROPOSAL crypto ikev2 keyring IKEv2-KEYRING peer address identity address ... crypto ikev2 profile IKEv2-PROFILE match identity remote address authentication remote rsa-sig authentication local rsa-sig keyring local IKEv2-KEYRING pki trustpoint CA-TRUSTPOINT crypto ipsec transform-set TRANSFORM-SET esp-aes 256 esp-sha256-hmac mode transport crypto ipsec IPSEC-PROFILE set transform-set TRANSFORM-SET set ikev2-profile IKEv2-PROFILE int tunnel 1 ip address 10.100.0.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication password ip nhrp network-id 1 ip nhrp redirect ip tcp adjust-mss 1360 tunnel source tunnel mode gre multipoint tunnel key 999 tunnel protection ipsec profile IPSEC-PROFILE ``` Run 2 commands to get the hub up and running ``` crypto pki server CA-SERVER no shut ``` and ``` crypto pki enroll CA-TRUSTPOINT ``` Spoke: ``` crypto pki trustpoint CA-TRUSTPOINT enrollment url http://:80 serial-number revocation-check none rsakeypair CA-KEY crypto ikev2 proposal IKEv2-PROPOSAL encryption aes-cbc-256 integrity sha256 group 14 crypto ikev2 policy IKEv2-POLICY proposal IKEv2-PROPOSAL crypto ikev2 keyring IKEv2-KEYRING peer address identity address crypto ikev2 profile IKEv2-PROFILE match identity remote address authentication remote rsa-sig authentication local rsa-sig keyring local IKEv2-KEYRING pki trustpoint CA-TRUSTPOINT crypto ipsec transform-set TRANSFORM-SET esp-aes 256 esp-sha256-hmac mode transport crypto ipsec IPSEC-PROFILE set transform-set TRANSFORM-SET set ikev2-profile IKEv2-PROFILE int tunnel 1 ip address 10.100.0.2 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication password ip nhrp map multicast ip nhrp map ip nhrp network-id 1 ip nhrp nhs ip tcp adjust-mss 1360 tunnel source tunnel mode gre multipoint tunnel key 999 tunnel protection ipsec profile IPSEC-PROFILE ``` Get it up and running with enrolling the certificate: ``` crypto pki enroll CA-TRUSTPOINT ```