<

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x

IPsec VPN Configuration On Cisco IOS XE - Part 8 - Single Tier Phase 3 Dynamic Multipoint VPN (DMVPN) Cloud

Published on
3,280 Points
280 Views
Last Modified:
Editors:
This article is about building Dynamic Multipoint VPN tunnels in Cisco CSR1000V router with IOS XE.
There are two spoke routers connected to single tier Phase 3 DMVPN Cloud hosted on CSR1000V router.

This is the eighth article in series about configuring VPN tunnels in IOS XE. [ Link to Part 1 ] [ Link to Part 2 ] [ Link to Part 3 ] [ Link to Part 4 ]  [Link to Part 5 ] [ Link to Part 6 ] [ Link to Part 7 ]


In the previous part, I configured Phase 1 DMVPN Cloud. In this article, I will show how to build a Phase 3 Dynamic Multipoint VPN (DMVPN) cloud with dynamic routing protocol OSPF.

This is an imaginary setup of a company which has Data Centre (DC) with Application and Storage servers. And two sites (a and b) connect to DC via IPSEC VPN tunnels with the Internet as an underlay. Details of IP addresses, device connections, and OSPF area are as shown in the diagram.


Goals of this scenario are -
1) Create DMVPN network cloud on "dc-gw1" and connect routers "site-a-gw1" and "site-b-gw1" in this cloud.

2) This setup will be Phase 3 DMVPN, with hub and spoke architecture, with spoke-to-spoke tunnels.
3) Configure dynamic routing between DC and Site routers.




Router IOS version used for this setup are -
dc-gw1 = Cisco IOS Software, CSR1000V Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.4(2)S, RELEASE SOFTWARE (fc2)
site-a-gw1 and site-b-gw1 = Cisco IOS Software, 7200 Software (C7200-ADVENTERPRISEK9-M), Version 12.4(24)T, RELEASE SOFTWARE (fc1)




I had configured Interface IP's on DC router and site routers and implemented default route towards Internet router. This simulates underlay Internet links for DC and sites.


Interface And Route Configuration On DC Router = "dc-gw1"


interface GigabitEthernet1
platform ring rx 256
ip address 10.0.0.2 255.255.255.248
negotiation auto

interface GigabitEthernet2
platform ring rx 256
ip address 100.0.10.1 255.255.255.0
ipmtu 1400
negotiation auto

interface GigabitEthernet3
platform ring rx 256
ip address 100.0.20.1 255.255.255.0
ipmtu 1400
negotiation auto

ip route 0.0.0.0 0.0.0.0 10.0.0.1


Interface And Route Configuration On-site A Router = "site-a-gw1"


interface GigabitEthernet0/0
ip address 20.0.0.2 255.255.255.252
duplex full
speed 1000
media-type gbic
negotiation auto

interface GigabitEthernet1/0
ip address 192.168.10.1 255.255.255.0
negotiation auto

ip route 0.0.0.0 0.0.0.0 20.0.0.1


Interface And Route Configuration On-site B Router = "site-b-gw1"


interface GigabitEthernet0/0
ip address 30.0.0.2 255.255.255.252
duplex full
speed 1000
media-type gbic
negotiation auto

interface GigabitEthernet1/0
ip address 192.168.20.1 255.255.255.0
negotiation auto

ip route 0.0.0.0 0.0.0.0 30.0.0.1


Next is creating DMVPN Cloud on DC router and connect site routers to this cloud.

DMVPN Configuration On DC Router = "dc-gw1"


crypto isakmp policy 10
encr aes 256
authentication pre-share
group 14

crypto isakmp key acme address 0.0.0.0

crypto ipsec transform-set AES-256-SHA esp-aes 256 esp-sha-hmac
mode tunnel

crypto ipsec profile tunnel-to-site
set transform-set AES-256-SHA

interface Tunnel1
description DMVPN Tunnel to Sites
ip address 172.20.10.1 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication acme
ip nhrp map multicast dynamic
ip nhrp network-id 1
ip nhrp redirect
ip ospf network point-to-multipoint
tunnel source GigabitEthernet1
tunnel mode gre multipoint
tunnel key 10
tunnel protection ipsec profile tunnel-to-site


DMVPN Configuration On-site A Router = "site-a-gw1"


crypto isakmp policy 10
encr aes 256
authentication pre-share
group 14
crypto isakmp key acme address 0.0.0.0 0.0.0.0

crypto ipsec transform-set AES-256-SHA esp-aes 256 esp-sha-hmac

crypto ipsec profile tunnel-to-dc
set transform-set AES-256-SHA

interface Tunnel1
description DMVPN Tunnel to DC
ip address 172.20.10.2 255.255.255.0
no ip redirects
ipmtu 1400
ipnhrp authentication acme
ipnhrp map 172.20.10.1 10.0.0.2
ipnhrp map multicast 10.0.0.2
ipnhrp network-id 1
ip nhrp nhs 172.20.10.1
ip nhrp shortcut
ip ospf network point-to-multipoint
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 10
tunnel protection ipsec profile tunnel-to-dc


DMVPN Configuration On-site B Router = "site-b-gw1"


crypto isakmp policy 10
encraes 256
authentication pre-share
group 14

crypto isakmp key acme address 0.0.0.0 0.0.0.0

crypto ipsec transform-set AES-256-SHA esp-aes 256 esp-sha-hmac

crypto ipsec profile tunnel-to-dc
set transform-set AES-256-SHA

interface Tunnel1
description DMVPN Tunnel to DC
ip address 172.20.10.3 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication acme
ip nhrp map multicast 10.0.0.2
ip nhrp map 172.20.10.1 10.0.0.2
ip nhrp network-id 2
ip nhrp nhs 172.20.10.1
ip nhrp shortcut
ip ospf network point-to-multipoint
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 10
tunnel protection ipsec profile tunnel-to-dc


DMVPN Status On DC Router = "dc-gw1"


dc-gw1#sh dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
N - NATed, L - Local, X - No Socket
# Ent --> Number of NHRP entries with same NBMA peer
NHS Status: E --> Expecting Replies, R --> Responding, W --> Waiting
UpDn Time --> Up or Down Time for a Tunnel
==========================================================================

Interface: Tunnel1, IPv4 NHRP Details
Type:Hub, NHRP Peers:2,

# Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
----- --------------- --------------- ----- -------- -----
1 20.0.0.2            172.20.10.2    UP 00:47:50     D
1 30.0.0.2            172.20.10.3    UP 00:50:25     D

dc-gw1#sh ip nhrp
172.20.10.2/32 via 172.20.10.2
Tunnel1 created 00:50:04, expire 01:51:55
Type: dynamic, Flags: unique registered used nhop
NBMA address: 20.0.0.2
172.20.10.3/32 via 172.20.10.3
Tunnel1 created 00:50:32, expire 01:49:18
Type: dynamic, Flags: unique registered used nhop
NBMA address: 30.0.0.2
dc-gw1#


DMVPN Status On-Site A Router = "site-a-gw1"


site-a-gw1#sh dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
N - NATed, L - Local, X - No Socket
# Ent --> Number of NHRP entries with same NBMA peer
NHS Status: E --> Expecting Replies, R --> Responding
UpDn Time --> Up or Down Time for a Tunnel
==========================================================================

Interface: Tunnel1, IPv4 NHRP Details
Type:Spoke, NHRP Peers:2,

# Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
----- --------------- --------------- ----- -------- -----
1        10.0.0.2     172.20.10.1    UP 00:55:05     S
2        30.0.0.2     172.20.10.3    UP 00:03:42     D
172.20.10.3    UP 00:03:42     D

site-a-gw1#sh ip nhrp
172.20.10.1/32 via 172.20.10.1
Tunnel1 created 00:55:12, never expire
Type: static, Flags: used
NBMA address: 10.0.0.2
172.20.10.3/32 via 172.20.10.3
Tunnel1 created 00:03:47, expire 01:56:12
Type: dynamic, Flags: router implicit
NBMA address: 30.0.0.2
192.168.10.0/24 via 172.20.10.2
Tunnel1 created 00:03:47, expire 01:56:12
Type: dynamic, Flags: router unique local
NBMA address: 20.0.0.2
(no-socket)
192.168.20.0/24 via 172.20.10.3
Tunnel1 created 00:03:48, expire 01:56:11
Type: dynamic, Flags: router
NBMA address: 30.0.0.2
site-a-gw1#


DMVPN Status On-Site B Router = "site-b-gw1"


site-b-gw1#sh dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
N - NATed, L - Local, X - No Socket
# Ent --> Number of NHRP entries with same NBMA peer
NHS Status: E --> Expecting Replies, R --> Responding
UpDn Time --> Up or Down Time for a Tunnel
==========================================================================

Interface: Tunnel1, IPv4 NHRP Details
Type:Spoke, NHRP Peers:2,

# Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
----- --------------- --------------- ----- -------- -----
1        10.0.0.2     172.20.10.1    UP 00:56:10     S
2        20.0.0.2     172.20.10.2    UP 00:02:11     D
172.20.10.2    UP 00:02:11     D

site-b-gw1#sh ip nhrp
172.20.10.1/32 via 172.20.10.1
Tunnel1 created 00:56:19, never expire
Type: static, Flags: used
NBMA address: 10.0.0.2
172.20.10.2/32 via 172.20.10.2
Tunnel1 created 00:02:19, expire 01:57:41
Type: dynamic, Flags: router implicit
NBMA address: 20.0.0.2
192.168.10.0/24 via 172.20.10.2
Tunnel1 created 00:02:17, expire 01:57:42
Type: dynamic, Flags: router
NBMA address: 20.0.0.2
192.168.20.0/24 via 172.20.10.3
Tunnel1 created 00:02:18, expire 01:57:41
Type: dynamic, Flags: router unique local
NBMA address: 30.0.0.2
(no-socket)
site-b-gw1#


This completes our goal 1 and 2, we have DMVPN cloud in DC router and site routers are connected to this cloud. There is a "spoke-to-spoke" tunnel between routers at site A and site B, Which means this setup is Phase 3 DMVPN implementation. Next part is about implementing dynamic routing using OSPF.

OSPF Configuration On DC Router = "dc-gw1"


router ospf 100
redistribute connected subnets route-map ospf-redistribute
network 172.20.10.0 0.0.0.255 area 0

route-map ospf-redistribute permit 10
match interface GigabitEthernet2

route-map ospf-redistribute permit 20
match interface GigabitEthernet3


OSPF Configuration On-Site A Router = "site-a-gw1"


router ospf 100
log-adjacency-changes
redistribute connected subnets route-map ospf-redistribute
network 172.20.10.0 0.0.0.255 area 0

route-map ospf-redistribute permit 10
match interface GigabitEthernet1/0


OSPF Configuration On-Site B Router = "site-b-gw1"


router ospf 100
log-adjacency-changes
redistribute connected subnets route-map ospf-redistribute
network 172.20.10.0 0.0.0.255 area 0

route-map ospf-redistribute permit 10
match interface GigabitEthernet1/0


This OSPF configuration is basic and has a single area, it distributes routes between DC router and site routers.


I had configured a route map with interfaces connecting DC servers and site LAN, and these route maps are used for redistribution of connected subnets in OSPF.  This also avoids distribution of subnets configured on Internet side interfaces.


Routes Learned By DC Router = "dc-gw1"


dc-gw1#sh ipospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.10.1      0   FULL/  -        00:01:45    172.20.10.2     Tunnel1
192.168.20.1      0   FULL/  -        00:01:41    172.20.10.3     Tunnel1
dc-gw1#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override

Gateway of last resort is 10.0.0.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 10.0.0.1
10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.0.0/29 is directly connected, GigabitEthernet1
L        10.0.0.2/32 is directly connected, GigabitEthernet1
100.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C        100.0.10.0/24 is directly connected, GigabitEthernet2
L        100.0.10.1/32 is directly connected, GigabitEthernet2
C        100.0.20.0/24 is directly connected, GigabitEthernet3
L        100.0.20.1/32 is directly connected, GigabitEthernet3
172.20.0.0/16 is variably subnetted, 4 subnets, 2 masks
C        172.20.10.0/24 is directly connected, Tunnel1
L        172.20.10.1/32 is directly connected, Tunnel1
O        172.20.10.2/32 [110/1000] via 172.20.10.2, 00:48:12, Tunnel1
O        172.20.10.3/32 [110/1000] via 172.20.10.3, 00:49:34, Tunnel1
O E2  192.168.10.0/24 [110/20] via 172.20.10.2, 00:48:12, Tunnel1
O E2  192.168.20.0/24 [110/20] via 172.20.10.3, 00:49:34, Tunnel1
dc-gw1#


Routes Learned By Site A Router = "site-a-gw1"


site-a-gw1#sh ipospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.20.10.1       0   FULL/  -        00:01:54    172.20.10.1     Tunnel1
site-a-gw1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is 20.0.0.1 to network 0.0.0.0

100.0.0.0/24 is subnetted, 2 subnets
O E2    100.0.10.0 [110/20] via 172.20.10.1, 00:50:18, Tunnel1
O E2    100.0.20.0 [110/20] via 172.20.10.1, 00:50:18, Tunnel1
20.0.0.0/30 is subnetted, 1 subnets
C       20.0.0.0 is directly connected, GigabitEthernet0/0
C    192.168.10.0/24 is directly connected, GigabitEthernet1/0
172.20.0.0/16 is variably subnetted, 3 subnets, 2 masks
O       172.20.10.3/32 [110/2000] via 172.20.10.1, 00:50:18, Tunnel1
C       172.20.10.0/24 is directly connected, Tunnel1
O       172.20.10.1/32 [110/1000] via 172.20.10.1, 00:50:18, Tunnel1
O E2 192.168.20.0/24 [110/20] via 172.20.10.1, 00:50:18, Tunnel1
S*   0.0.0.0/0 [1/0] via 20.0.0.1
site-a-gw1#


Routes Learned By Site B Router = "site-b-gw1"


site-b-gw1#sh ipospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.20.10.1       0   FULL/  -        00:01:37    172.20.10.1     Tunnel1
site-b-gw1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is 30.0.0.1 to network 0.0.0.0

100.0.0.0/24 is subnetted, 2 subnets
O E2    100.0.10.0 [110/20] via 172.20.10.1, 00:55:15, Tunnel1
O E2    100.0.20.0 [110/20] via 172.20.10.1, 00:55:14, Tunnel1
O E2 192.168.10.0/24 [110/20] via 172.20.10.1, 00:53:42, Tunnel1
172.20.0.0/16 is variably subnetted, 3 subnets, 2 masks
O       172.20.10.2/32 [110/2000] via 172.20.10.1, 00:53:42, Tunnel1
C       172.20.10.0/24 is directly connected, Tunnel1
O       172.20.10.1/32 [110/1000] via 172.20.10.1, 00:56:03, Tunnel1
C    192.168.20.0/24 is directly connected, GigabitEthernet1/0
30.0.0.0/30 is subnetted, 1 subnets
C       30.0.0.0 is directly connected, GigabitEthernet0/0
S*   0.0.0.0/0 [1/0] via 30.0.0.1
site-b-gw1#


Here are ping results show connections between app server in DC and user computer in the branch site.


app1> ping 192.168.10.10
84 bytes from 192.168.10.10 icmp_seq=1 ttl=62 time=92.018 ms
84 bytes from 192.168.10.10 icmp_seq=2 ttl=62 time=88.518 ms
84 bytes from 192.168.10.10 icmp_seq=3 ttl=62 time=58.012 ms
84 bytes from 192.168.10.10 icmp_seq=4 ttl=62 time=53.510 ms
84 bytes from 192.168.10.10 icmp_seq=5 ttl=62 time=208.042 ms

app1> ping 192.168.20.10
84 bytes from 192.168.20.10 icmp_seq=1 ttl=62 time=176.535 ms
84 bytes from 192.168.20.10 icmp_seq=2 ttl=62 time=134.026 ms
84 bytes from 192.168.20.10 icmp_seq=3 ttl=62 time=72.014 ms
84 bytes from 192.168.20.10 icmp_seq=4 ttl=62 time=117.024 ms
84 bytes from 192.168.20.10 icmp_seq=5 ttl=62 time=208.041 ms

app1>


Here are ping and trace-route results which show connections between user computer in site A to the user computer in site B. Traffic from Site A user computer is going to Site A router (192.168.10.1), then to site B router (172.20.10.3), this excludes DC router (172.20.10.1). This means there is a dynamic spoke-to-spoke tunnel between site routers and traffic between branch sites (spoke) is direct without passing through DC (hub).


VPCS> ping 192.168.20.10
84 bytes from 192.168.20.10 icmp_seq=1 ttl=62 time=155.031 ms
84 bytes from 192.168.20.10 icmp_seq=2 ttl=62 time=54.011 ms
84 bytes from 192.168.20.10 icmp_seq=3 ttl=62 time=126.525 ms
84 bytes from 192.168.20.10 icmp_seq=4 ttl=62 time=97.020 ms
84 bytes from 192.168.20.10 icmp_seq=5 ttl=62 time=188.037 ms

VPCS> trace 192.168.20.10
trace to 192.168.20.10, 8 hops max, press Ctrl+C to stop
1   192.168.10.1   68.514 ms  11.502 ms  9.502 ms
2   172.20.10.3   76.015 ms  111.022 ms  69.514 ms
3   *192.168.20.10   76.016 ms (ICMP type:3, code:3, Destination port unreachable)

VPCS>


And here are ping and trace-route results which show connections between user computer in site B to the user computer in site A. Traffic from Site B user computer is going to Site B router (192.168.20.1), then to site A router (172.20.10.2), this excludes DC router (172.20.10.1). This means there is a dynamic spoke-to-spoke tunnel between site routers and traffic between branch sites (spoke) is direct without passing through DC (hub).


VPCS> ping 192.168.10.10
84 bytes from 192.168.10.10 icmp_seq=1 ttl=62 time=109.522 ms
84 bytes from 192.168.10.10 icmp_seq=2 ttl=62 time=78.516 ms
84 bytes from 192.168.10.10 icmp_seq=3 ttl=62 time=90.018 ms
84 bytes from 192.168.10.10 icmp_seq=4 ttl=62 time=90.018 ms
84 bytes from 192.168.10.10 icmp_seq=5 ttl=62 time=59.512 ms

VPCS> trace 192.168.10.10
trace to 192.168.10.10, 8 hops max, press Ctrl+C to stop
1   192.168.20.1   40.508 ms  100.521 ms  66.513 ms
2   172.20.10.2   210.542 ms  81.516 ms  44.009 ms
3   *192.168.10.10   92.018 ms (ICMP type:3, code:3, Destination port unreachable)

VPCS>


These traceroute results show that this setup is Phase 3 DMVPN implementation. This completes our goal 3 and is the end of Part 8 of this series, we have seen DMVPN Phase 3 Cloud setup with dynamic routing protocol OSPF and its sample configuration. Anyone who is working on DMVPN setup using Cisco routers with IOS XE may use this configuration.

In the next article, we will be configuring two-tier DMVPN Phase 3 Cloud with a dynamic routing protocol under different VRF's.


Link to Part 9 of this series here: IPsec VPN Configuration On Cisco IOS XE - Part 9 - Dual Hub Phase 3 Dynamic Multipoint VPN (DMVPN) Cloud

I hope you find this helpful.

0
0 Comments

Featured Post

Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…

Keep in touch with Experts Exchange

Tech news and trends delivered to your inbox every month