The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The Dynamic Multipoint VPN feature allows users to better scale large and small IP Security (IPsec) Virtual Private Networks (VPNs) by combining generic routing encapsulation (GRE) tunnels, IPsec encryption, and Next Hop Resolution Protocol (NHRP).
 Note |
Security threats, as well as the cryptographic technologies to help protect against them, are constantly changing. For more information about the latest Cisco cryptographic recommendations, see the Next Generation Encryption (NGE) white paper. |
Before a multipoint GRE (mGRE) and IPsec tunnel can be established, you must define an Internet Key Exchange (IKE) policy by using the crypto isakmp policy command.
To use the 2547oDMPVN--Traffic Segmentation Within DMVPN feature you must configure Multiprotocol Label Switching (MPLS) by using the mpls ip command.
Bidirectional protocol-independent mulitcast (PIM) is not supported over DMVPN. Therefore, you must use PIM Sparse mode (ASM) over DMVPN.
Protocol-independent mulitcast (PIM) dense mode is not supported over DMVPN on IOS-XE devices.
From Cisco IOS XE Release 17.5.1, you can use the following DMVPN commands without a security license because DMVPN can be configured without using encryption:
show dmvpn
show dmvpn detail
debug dmvpn
logging dmvpn
If you use the benefit of this feature, you must use IKE certificates or wildcard preshared keys for Internet Security Association Key Management Protocol (ISAKMP) authentication.
Note |
It is highly recommended that you do not use wildcard preshared keys because an attacker will have access to the VPN if one spoke router is compromised. |
GRE tunnel keepalives (that is, the keepalive command under a GRE interface) are not supported on point-to-point or multipoint GRE tunnels in a DMVPN network.
The device running Cisco IOS XE 16.12.4 or 17.3.1a image is unable to establish CDP neighborship with peers through a mGRE tunnel.
If one spoke is behind one Network Address Translation (NAT) device and a different spoke is behind another NAT device, and Port Address Translation (PAT) is the type of NAT used on both NAT devices, then a session initiated between the two spokes cannot be established.
ip nat inside source list nat_acl interface FastEthernet0/0/1 overload
router ospf <#>
...
distribute-list prefix-list Block-32 out //block OSPF/32 connected routes//
ip prefix-list Block-32 deny <tunnel-subnet> <mask> ge 32
ip prefix-list Block-32 permit any le 32When a CA has a duplicate DN, the router checks all the certificate and stops the check on finding a match. In this scenario, the other certificates on the device are not checked. To overcome this issue, configure the IKEv2 profile with one trust point only.
SSO Restrictions
For an ESP reload (no standby ESP), the SA sequence number restarts from 0. The peer router drops packets that do not have the expected sequence number. You may need to explicitly reestablish IPSec sessions to work around this issue for systems that have a single ESP after an ESP reload. Traffic disruption might happen over the IPSec sessions in such cases for the duration of the reload.
For each spoke router, there is a separate block of configuration lines on the hub router that define the crypto map characteristics, the crypto access list, and the GRE tunnel interface. This feature allows users to configure a single mGRE tunnel interface, a single IPsec profile, and no crypto access lists on the hub router to handle all spoke routers. Thus, the size of the configuration on the hub router remains constant even if spoke routers are added to the network.
DMVPN architecture can group many spokes into a single multipoint GRE interface, removing the need for a distinct physical or logical interface for each spoke in a native IPsec installation.
GRE has the peer source and destination address configured or resolved with NHRP. Thus, this feature allows IPsec to be immediately triggered for the point-to-point GRE tunneling or when the GRE peer address is resolved via NHRP for the multipoint GRE tunnel.
When using point-to-point GRE and IPsec hub-and-spoke VPN networks, the physical interface IP address of the spoke routers must be known when configuring the hub router because the IP address must be configured as the GRE tunnel destination address. This feature allows spoke routers to have dynamic physical interface IP addresses (common for cable and DSL connections). When the spoke router comes online, it will send registration packets to the hub router: within these registration packets is the current physical interface IP address of this spoke.
This feature eliminates the need for spoke-to-spoke configuration for direct tunnels. When a spoke router wants to transmit a packet to another spoke router, it can now use NHRP to dynamically determine the required destination address of the target spoke router. (The hub router acts as the NHRP server, handling the request for the source spoke router.) The two spoke routers dynamically create an IPsec tunnel between them so data can be directly transferred.
The Dynamic Multipoint VPN feature combines GRE tunnels, IPsec encryption, and NHRP routing to provide users an ease of configuration via crypto profiles--which override the requirement for defining static crypto maps--and dynamic discovery of tunnel endpoints.
This feature relies on the following two Cisco enhanced standard technologies:
NHRP--A client and server protocol where the hub is the server and the spokes are the clients. The hub maintains an NHRP database of the public interface addresses of each spoke. Each spoke registers its real address when it boots and queries the NHRP database for real addresses of the destination spokes to build direct tunnels.
mGRE tunnel interface --Allows a single GRE interface to support multiple IPsec tunnels and simplifies the size and complexity of the configuration.
The topology shown in the figure below and the corresponding bullets explain how this feature works.
Each spoke has a permanent IPsec tunnel to the hub, not to the other spokes within the network. Each spoke registers as clients of the NHRP server.
When a spoke needs to send a packet to a destination (private) subnet on another spoke, it queries the NHRP server for the real (outside) address of the destination (target) spoke.
After the originating spoke “learns” the peer address of the target spoke, it can initiate a dynamic IPsec tunnel to the target spoke.
The spoke-to-spoke tunnel is built over the multipoint GRE interface.
The spoke-to-spoke links are established on demand whenever there is traffic between the spokes. Thereafter, packets can bypass the hub and use the spoke-to-spoke tunnel.
Note |
After a preconfigured amount of inactivity on the spoke-to-spoke tunnels, the router will tear down those tunnels to save resources (IPsec security associations [SAs]). |
IPsec profiles abstract IPsec policy information into a single configuration entity, which can be referenced by name from other parts of the configuration. Therefore, users can configure functionality such as GRE tunnel protection with a single line of configuration. By referencing an IPsec profile, the user need not configure an entire crypto map configuration. An IPsec profile contains only IPsec information; that is, it does not contain any access list information or peering information.
Cisco IOS XE Release 2.5 provides an enhancement that allows you to segment VPN traffic within a DMVPN tunnel by using a PE-PE mGRE tunnel. This secured mGRE tunnel can be used to transport all (or a set of) VPN traffic.
The diagram below and the corresponding bullets explain how traffic segmentation within DMVPN works.
The hub shown in the diagram is a WAN-PE and a Route Reflector, and the spokes (PE routers) are clients.
There are three VRFs, designated “red,” “green,” and “blue.”
Each spoke has both a neighbor relationship with the hub (multiprotocol internal Border Gateway Protocol [MP-iBGP] peering) and a GRE tunnel to the hub.
Each spoke advertises its routes and VPN-IPv4 (VPNv4) prefixes to the hub.
The hub sets its own IP address as the next-hop route for all the VPNv4 addresses it learns from the spokes and assigns a local MPLS label for each VPN when it advertises routes back to the spokes. As a result, traffic from Spoke A to Spoke B is routed via the hub.
An example illustrates the process:
Spoke A advertises a VPNv4 route to the hub, and applies the label x to the VPN.
The hub changes the label to y when the hub advertises the route to Spoke B.
When Spoke B has traffic to send to Spoke A, it applies the y label, and the traffic goes to the hub.
The hub swaps the VPN label, by removing the y label and applying an x label, and sends the traffic to Spoke A.
DMVPN spokes are often situated behind a NAT router (which is often controlled by the Internet Service Provider [ISP] for the spoke site) with the outside interface address of the spoke router being dynamically assigned by the ISP using a private IP address (per Internet Engineering Task Force [IETF] RFC 1918).
With the NAT-Transparency Aware DMVPN enhancement, NHRP can learn and use the NAT public address for its mappings as long as IPsec transport mode is used (which is the recommended IPsec mode for DMVPN networks). It is recommended that all DMVPN routers be upgraded to the new code before you try to use the NAT-Transparency Aware DMVPN functionality even though spoke routers that are not behind NAT need not be upgraded. In addition, you cannot convert upgraded spoke routers that are behind NAT to the new configuration (IPsec transport mode) until the hub routers have been upgraded.
With this NAT Transparency enhancement, the hub DMVPN router can be behind the static NAT. For this functionality to be used, all the DMVPN spoke routers and hub routers must be upgraded, and IPsec must use transport mode.
For these NAT-Transparency Aware enhancements to work, you must use IPsec transport mode on the transform set. Also, even though NAT-Transparency (IKE and IPsec) can support two peers (IKE and IPsec) being translated to the same IP address (using the UDP ports to differentiate them), this functionality is not supported for DMVPN. All DMVPN spokes must have a unique IP address after they have been NAT translated. They can have the same IP address before they are NAT translated.
The figure below illustrates a NAT-Transparency Aware DMVPN scenario.
Note |
DMVPN spokes behind NAT will participate in dynamic direct spoke-to-spoke tunnels. The spokes must be behind NAT boxes that are preforming NAT, not PAT. The NAT box must translate the spoke to the same outside NAT IP address for the spoke-to-spoke connections as the NAT box does for the spoke-to-hub connection. If there is more than one DMVPN spoke behind the same NAT box, the NAT box must translate the DMVPN spokes to different outside NAT IP addresses. It is also likely that you may not be able to build a direct spoke-to-spoke tunnel between these spokes. If a spoke-to-spoke tunnel fails to form, the spoke-to-spoke packets will continue to be forwarded via the spoke-to-hub-spoke path. |
In a DMVPN network, it is easy for a DMVPN router to become “overwhelmed” with the number of tunnels it is trying to build. Call Admission Control can be used to limit the number of tunnels that can be built at any one time, thus protecting the memory of the router and CPU resources.
It is most likely that Call Admission Control will be used on a DMVPN spoke to limit the total number of ISAKMP sessions (DMVPN tunnels) that a spoke router will attempt to initiate or accept. This limiting is accomplished by configuring an IKE SA limit under Call Admission Control, which configures the router to drop new ISAKMP session requests (inbound and outbound) if the current number of ISAKMP SAs exceeds the limit.
It is most likely that Call Admission Control will be used on a DMVPN hub to rate limit the number of DMVPN tunnels that are attempting to be built at the same time. The rate limiting is accomplished by configuring a system resource limit under Call Admission Control, which configures the router to drop new ISAKMP session requests (new DMVPN tunnels) when the system utilization is above a specified percentage. The dropped session requests allow the DMVPN hub router to complete the current ISAKMP session requests, and when the system utilization drops, it can process the previously dropped sessions when they are reattempted.
No special configuration is required to use Call Admission Control with DMVPN. For information about configuring Call Admission Control, see the “ Call Admission Control for IKE ” module in the Cisco IOS XE Security Configuration Guide: Secure Connectivity .
NHRP has a rate-limiting mechanism that restricts the total number of NHRP packets from any given interface. The default values, which are set using the ip nhrp max-send command, are 10,000 packets every 10 seconds per interface. If the limit is exceeded, you will get the following system message:
%NHRP-4-QUOTA: Max-send quota of [int]pkts/[int]Sec. exceeded on [chars]
For more information about this system message, see the document System Messages for Cisco IOS XE Software .
To enable mGRE and IPsec tunneling for hub and spoke routers, you must configure an IPsec profile that uses a global IPsec policy template and configure your mGRE tunnel for IPsec encryption. This section contains the following procedures:
The IPsec profile shares most of the same commands with the crypto map configuration, but only a subset of the commands are valid in an IPsec profile. Only commands that pertain to an IPsec policy can be issued under an IPsec profile; you cannot specify the IPsec peer address or the Access Control List (ACL) to match the packets that are to be encrypted.
Note |
Security threats, as well as the cryptographic technologies to help protect against them, are constantly changing. For more information about the latest Cisco cryptographic recommendations, see the Next Generation Encryption (NGE) white paper. |
Before configuring an IPsec profile, you must define a transform set by using the crypto ipsec transform-set command.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 3 |
crypto ipsec profile name Example: |
Defines the IPsec parameters that are to be used for IPsec encryption between “spoke and hub” and “spoke and spoke” routers.
|
|
Step 4 |
set transform-set transform-set-name Example: |
Specifies which transform sets can be used with the IPsec profile.
|
|
Step 5 |
set identity Example: |
(Optional) Specifies identity restrictions to be used with the IPsec profile. |
|
Step 6 |
set security association lifetime {seconds seconds | kilobytes kilobytes } Example: |
(Optional) Overrides the global lifetime value for the IPsec profile.
|
|
Step 7 |
set pfs [group1 | group2 ] Example: |
(Optional) Specifies that IPsec should ask for perfect forward secrecy (PFS) when requesting new security associations for this IPsec profile.
|
To configure the hub router for mGRE and IPsec integration (that is, associate the tunnel with the IPsec profile configured in the previous procedure), use the following commands.
Note |
NHRP network IDs are locally significant and can be different. It makes sense from a deployment and maintenance perspective to use unique network ID numbers (using the ip nhrp network-id command) across all routers in a DMVPN network, but it is not necessary that they be the same. |
| Command or Action | Purpose | |||
|---|---|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
||
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
||
|
Step 3 |
interface tunnel number Example: |
Configures a tunnel interface and enters interface configuration mode
|
||
|
Step 4 |
ip address ip-address mask secondary Example: |
Sets a primary or secondary IP address for the tunnel interface.
|
||
|
Step 5 |
ip mtu bytes Example: |
Sets the maximum transmission unit (MTU) size, in bytes, of IP packets sent on an interface. |
||
|
Step 6 |
ip nhrp authentication string Example: |
Configures the authentication string for an interface using NHRP.
|
||
|
Step 7 |
ip nhrp map multicast dynamic Example: |
Allows NHRP to automatically add spoke routers to the multicast NHRP mappings.
|
||
|
Step 8 |
ip nhrp network-id number Example: |
Enables NHRP on an interface.
|
||
|
Step 9 |
tunnel source {ip-address | type number } Example: |
Sets the source address for a tunnel interface. |
||
|
Step 10 |
tunnel key key-number Example: |
(Optional) Enables an ID key for a tunnel interface.
|
||
|
Step 11 |
tunnel mode gre multipoint Example: |
Sets the encapsulation mode to mGRE for the tunnel interface. |
||
|
Step 12 |
Do one of the following:
Example:Example: |
Associates a tunnel interface with an IPsec profile.
or Simplifies the tunnel protection configuration for pre-shared key (PSK) by creating a default IPsec profile. |
||
|
Step 13 |
bandwidth kbps Example: |
Sets the current bandwidth value for an interface to higher-level protocols.
|
||
|
Step 14 |
ip tcp adjust-mss max-segment-size Example: |
Adjusts the maximum segment size (MSS) value of TCP packets going through a router.
|
||
|
Step 15 |
ip nhrp holdtime seconds Example: |
Changes the number of seconds that NHRP NBMA addresses are advertised as valid in authoritative NHRP responses.
|
||
|
Step 16 |
delay number Example: |
(Optional) Changes the EIGRP routing metric for routes learned over the tunnel interface.
|
To configure spoke routers for mGRE and IPsec integration, use the following commands.
Note |
NHRP network IDs are locally significant and can be different. It makes sense from a deployment and maintenance perspective to use unique network ID numbers (using the ip nhrp network-id command) across all routers in a DMVPN network, but it is not necessary that they be the same. |
| Command or Action | Purpose | |||
|---|---|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
||
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
||
|
Step 3 |
interface tunnel number Example: |
Configures a tunnel interface and enters interface configuration mode.
|
||
|
Step 4 |
ip address ip-address mask secondary Example: |
Sets a primary or secondary IP address for the tunnel interface.
|
||
|
Step 5 |
ip mtu bytes Example: |
Sets the MTU size, in bytes, of IP packets sent on an interface. |
||
|
Step 6 |
ip nhrp authentication string Example: |
Configures the authentication string for an interface using NHRP.
|
||
|
Step 7 |
ip nhrp map hub-tunnel-ip-address hub-physical-ip-address Example: |
Statically configures the IP-to-NBMA address mapping of IP destinations connected to an NBMA network.
|
||
|
Step 8 |
ip nhrp map multicast hub-physical-ip-address Example: |
Enables the use of a dynamic routing protocol between the spoke and hub, and sends multicast packets to the hub router. |
||
|
Step 9 |
ip nhrp nhs hub-tunnel-ip-address Example: |
Configures the hub router as the NHRP next-hop server. |
||
|
Step 10 |
ip nhrp network-id number Example: |
Enables NHRP on an interface.
|
||
|
Step 11 |
tunnel source {ip-address | type number } Example: |
Sets the source address for a tunnel interface. |
||
|
Step 12 |
tunnel key key-number Example: |
(Optional) Enables an ID key for a tunnel interface.
|
||
|
Step 13 |
Do one of the following:
Example:Example: |
Sets the encapsulation mode to mGRE for the tunnel interface.
Specifies the destination for a tunnel interface.
|
||
|
Step 14 |
Do one of the following:
Example:Example: |
Associates a tunnel interface with an IPsec profile.
or Simplifies the tunnel protection configuration for pre-shared key (PSK) by creating a default IPsec profile. |
||
|
Step 15 |
bandwidth kbps Example: |
Sets the current bandwidth value for an interface to higher-level protocols.
|
||
|
Step 16 |
ip tcp adjust-mss max-segment-size Example: |
Adjusts the MSS value of TCP packets going through a router.
|
||
|
Step 17 |
ip nhrp holdtime seconds Example: |
Changes the number of seconds that NHRP NBMA addresses are advertised as valid in authoritative NHRP responses.
|
||
|
Step 18 |
delay number Example: |
(Optional) Changes the EIGRP routing metric for routes learned over the tunnel interface.
|
To configure the forwarding of clear-text data IP packets into a VRF, perform the following steps. This configuration assumes that the VRF Blue has already been configured.
Note |
To configure VRF Blue, use the ip vrf vrf-name command in global configuration mode. |
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 3 |
interface type number Example: |
Configures an interface type and enters interface configuration mode. |
|
Step 4 |
ip vrf forwarding vrf-name Example: |
Allows the forwarding of clear-text data IP packets into a VRF. |
To configure the forwarding of encrypted tunnel packets into a VRF, perform the following steps. This configuration assumes that the VRF Red has already been configured.
Note |
To configure VRF Red, use the ip vrf vrf-name command in global configuration mode. |
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 3 |
interface type number Example: |
Configures an interface type and enters interface configuration mode. |
|
Step 4 |
tunnel vrf vrf-name Example: |
Associates a VPN VRF instance with a specific tunnel destination, interface, or subinterface and allows the forwarding of encrypted tunnel packets into a VRF. |
Cisco IOS XE Release 2.5 introduces no new commands to use when configuring traffic segmentation, but you must complete the tasks described in the following sections in order to segment traffic within a DMVPN tunnel:
The tasks that follow assume that the DMVPN tunnel and the VRFs Red and Blue have already been configured.
To configure VRF Red or Blue, use the ip vrf vrf-name command in global configuration mode.
For information on configuring a DMVPN tunnel, see the Configuring the Spoke for DMVPN. For details about VRF configuration, see the Configuring the Forwarding of Clear-Text Data IP Packets into a VRF and the Configuring the Forwarding of Encrypted Tunnel Packets into a VRF.
Because traffic segmentation within a DMVPN tunnel depends upon MPLS, you must configure MPLS for each VRF instance in which traffic will be segmented.
Note |
On the Cisco ASR 1000 Series Aggregation Services Routers, only distributed switching is supported. Use the following commands for distributed switching: ip multicast-routing [vrf vrf-name ] [distributed ], debug ip bgp vpnv4 unicast , and ip cef distributed. |
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 3 |
interface type number Example: |
Configures an interface type and enters interface configuration mode. |
|
Step 4 |
mpls ip Example: |
Enables MPLS tagging of packets on the specified tunnel interface. |
You must configure multiprotocol iBGP (MP-iBGP) to enable advertisement of VPNv4 prefixes and labels to be applied to the VPN traffic. Use BGP to configure the hub as a Route Reflector. To force all traffic to be routed via the hub, configure the BGP Route Reflector to change the next hop to itself when it advertises VPNv4 prefixes to the route reflector clients (spokes).
For more information about the BGP routing protocol, see the “ Cisco BGP Overview ” module in the Cisco IOS XE IP Routing: BGP Configuration Guide.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 3 |
router bgp autonomous-system-number Example: |
Enables configuration of the BGP routing process. |
|
Step 4 |
neighbor ipaddress remote-as as - number Example: |
Adds an entry to the BGP or multiprotocol BGP neighbor table. |
|
Step 5 |
neighbor ipaddress update-source interface Example: |
Configures the Cisco IOS XE software to allow BGP sessions to use any operational interface for TCP connections. |
|
Step 6 |
address-family vpnv4 Example: |
Enters address family configuration mode to configure a routing session using VPNv4 address prefixes. |
|
Step 7 |
neighbor ipaddress activate Example: |
Enables the exchange of information with a BGP neighbor. |
|
Step 8 |
neighbor ipaddress send-community extended Example: |
Specifies that extended community attributes should be sent to a BGP neighbor. |
|
Step 9 |
neighbor ipaddress route-reflector-client Example: |
Configures the router as a BGP Route Reflector and configures the specified neighbor as its client. |
|
Step 10 |
neighbor ipaddress route-map nexthop out Example: |
Forces all traffic to be routed via the hub. |
|
Step 11 |
exit Example: |
Exits the address family configuration mode for VPNv4. |
|
Step 12 |
address-family ipv4 vrf-name Example: |
Enters address family configuration mode to configure a routing session using standard IPv4 address prefixes. |
|
Step 13 |
redistribute connected Example: |
Redistributes routes that are established automatically by virtue of having enabled IP on an interface from one routing domain into another routing domain. |
|
Step 14 |
route-map map-tag [permit | deny ] [sequence-number ] Example: |
Enters route map configuration mode to configure the next-hop that will be advertised to the spokes. |
|
Step 15 |
set ip next-hop ipaddress Example: |
Sets the next hop to be the hub. |
In order to segment traffic within a DMVPN tunnel, Multiprotocol-iBGP (MP-iBGP) must be configured on both the spoke routers and the hub. Perform the following task for each spoke router in the DMVPN.
| Command or Action | Purpose | |||
|---|---|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
||
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
||
|
Step 3 |
router bgp autonomous-system-number Example: |
Enters BGP configuration mode. |
||
|
Step 4 |
neighbor ipaddress remote-as as - number Example: |
Adds an entry to the BGP or multiprotocol BGP neighbor table. |
||
|
Step 5 |
neighbor ipaddress update-source interface Example: |
Configures the Cisco IOS XE software to allow BGP sessions to use any operational interface for TCP connections. |
||
|
Step 6 |
address-family vpnv4 Example: |
Enters address family configuration mode to configure a routing session using VPNv4 address prefixes. |
||
|
Step 7 |
neighbor ipaddress activate Example: |
Enables the exchange of information with a BGP neighbor. |
||
|
Step 8 |
neighbor ipaddress send-community extended Example: |
Specifies that extended community attributes should be sent to a BGP neighbor. |
||
|
Step 9 |
exit Example: |
Exits address family configuration mode. |
||
|
Step 10 |
address-family ipv4 vrf-name Example: |
Enters address family configuration mode to configure a routing session using standard IPv4 address prefixes. |
||
|
Step 11 |
redistribute connected Example: |
Redistributes routes that are established automatically by virtue of having enabled IP on an interface from one routing domain into another routing domain. |
||
|
Step 12 |
exit Example: |
Exits address family configuration mode.
|
After configuring DMVPN, perform the following optional steps in this task to verify that DMVPN is operating correctly, to clear DMVPN statistics or sessions, or to debug DMVPN. These commands may be used in any order.
From Cisco IOS XE 17.11.1a, a new command nhrp debug-trace is introduced to enable or disable btrace logs. This command provides improved debugging capability, by logging NHRP logs as files. This command is enabled by default, and only debugs with level NOTICE and higher are logged in btrace.
This command can be disabled by using the no form of the command:
no nhrp debug-trace
Note |
Security threats, as well as the cryptographic technologies to help protect against them, are constantly changing. For more information about the latest Cisco cryptographic recommendations, see the Next Generation Encryption (NGE) white paper. |
|
Step 1 |
clear dmvpn session This command clears DMVPN sessions. The following example clears only dynamic DMVPN sessions, for the specified tunnel: Example:The following example clears all DMVPN sessions, both static and dynamic, for the specified tunnel: Example: |
|
Step 2 |
clear dmvpn statistics This command is used to clear DMVPN-related counters. The following example shows how to clear DMVPN-related session counters for the specified tunnel interface: Example: |
|
Step 3 |
debug dmvpn This command is used to debug DMVPN sessions. You can enable or disable DMVPN debugging based on a specific condition. There are three levels of DMVPN debugging, listed in the order of details from lowest to highest:
The following example shows how to enable conditional DMVPN debugging that displays all error debugs for NHRP, sockets, tunnel protection, and crypto information: Example: |
|
Step 4 |
debug dmvpn condition This command displays conditional debug DMVPN session information. The following example shows how to enable conditional debugging for a specific tunnel interface: Example: |
|
Step 5 |
debug nhrp condition This command enables or disables debugging based on a specific condition. The following example shows how to enable conditional NHRP debugging: Example: |
|
Step 6 |
debug nhrp error This command displays information about NHRP error activity. The following example shows how to enable debugging for NHRP error messages: Example: |
|
Step 7 |
nhrp debug-trace This command is used to enable or disable NHRP btrace logs. The following example shows how to enable btrace logging: Example: |
|
Step 8 |
logging dmvpn This command is used to enable DMVPN system logging. The following example shows how to enable DMVPN system logging at the rate of 1 message every 20 seconds: Example:The following example shows a sample system log with DMVPN messages: Example: |
|
Step 9 |
show crypto ipsec sa This command displays the settings used by the current SAs. The following example output shows the IPsec SA status of only the active device: Example: |
|
Step 10 |
show crypto isakmp sa This command displays all current IKE SAs at a peer. For example, the following sample output is displayed after IKE negotiations have successfully completed between two peers: Example: |
|
Step 11 |
show crypto map This command displays the crypto map configuration. The following sample output is displayed after a crypto map has been configured: Example:Tunnel5 |
|
Step 12 |
show dmvpn This command displays DMVPN-specific session information. The following sample shows example summary output: Example: |
|
Step 13 |
show ip nhrp traffic This command displays NHRP statistics. The following example shows output for a specific tunnel (tunnel7): Example: |
Proceed to the following sections Configuring the Hub for DMVPN and Configuring the Spoke for DMVPN.
In the following example, which configures the hub router for multipoint GRE and IPsec integration, no explicit configuration lines are needed for each spoke; that is, the hub is configured with a global IPsec policy template that all spoke routers can talk to. In this example, EIGRP is configured to run over the private physical interface and the tunnel interface.
crypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco47 address 0.0.0.0
!
crypto ipsec transform-set trans2 esp-des esp-md5-hmac
mode transport
!
crypto ipsec profile vpnprof
set transform-set trans2
!
interface Tunnel0
bandwidth 1000
ip address 10.0.0.1 255.255.255.0
! Ensures longer packets are fragmented before they are encrypted; otherwise, the receiving router would have to do the reassembly.
ip mtu 1400
! The following line must match on all nodes that “want to use” this mGRE tunnel:
ip nhrp authentication donttell
! Note that the next line is required only on the hub.
ip nhrp map multicast dynamic
! The following line must match on all nodes that want to use this mGRE tunnel:
ip nhrp network-id 99
ip nhrp holdtime 300
! Turns off split horizon on the mGRE tunnel interface; otherwise, EIGRP will not advertise routes that are learned via the mGRE interface back out that interface.
no ip split-horizon eigrp 1
! Enables dynamic, direct spoke-to-spoke tunnels when using EIGRP.
no ip next-hop-self eigrp 1
ip tcp adjust-mss 1360
delay 1000
! Sets IPsec peer address to Ethernet interface’s public address.
tunnel source Gigabitethernet 0/0/0
tunnel mode gre multipoint
! The following line must match on all nodes that want to use this mGRE tunnel.
tunnel key 100000
tunnel protection ipsec profile vpnprof
!
interface FastEthernet0/0/0
ip address 172.17.0.1 255.255.255.0
!
interface FastEthernet0/0/1
ip address 192.168.0.1 255.255.255.0
!
router eigrp 1
network 10.0.0.0 0.0.0.255
network 192.168.0.0 0.0.0.255
!For information about defining and configuring ISAKMP profiles, see the “ Certificate to ISAKMP Profile Mapping ” module in the Cisco IOS XE Security Configuration Guide: Secure Connectivity .
In the following example, all spokes are configured the same except for tunnel and local interface address, thereby reducing necessary configurations for the user:
crypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco47 address 0.0.0.0
!
crypto ipsec transform-set trans2 esp-des esp-md5-hmac
mode transport
!
crypto ipsec profile vpnprof
set transform-set trans2
!
interface Tunnel0
bandwidth 1000
ip address 10.0.0.2 255.255.255.0
ip mtu 1400
! The following line must match on all nodes that want to use this mGRE tunnel:
ip nhrp authentication donttell
! Definition of NHRP server at the hub (10.0.0.1), which is permanently mapped to the static public address of the hub (172.17.0.1).
ip nhrp map 10.0.0.1 172.17.0.1
! Sends multicast packets to the hub router, and enables the use of a dynamic routing protocol between the spoke and the hub.
ip nhrp map multicast 172.17.0.1
! The following line must match on all nodes that want to use this mGRE tunnel:
ip nhrp network-id 99
ip nhrp holdtime 300
! Configures the hub router as the NHRP next-hop server.
ip nhrp nhs 10.0.0.1
ip tcp adjust-mss 1360
delay 1000
tunnel source Gigabitethernet 0/0/0
tunnel mode gre multipoint
! The following line must match on all nodes that want to use this mGRE tunnel:
tunnel key 100000
tunnel protection ipsec profile vpnprof
!
! This is a spoke, so the public address might be dynamically assigned via DHCP.
interface FastEthernet0/0/0
ip address dhcp hostname Spoke1
!
interface FastEthernet0/0/1
ip address 192.168.1.1 255.255.255.0
!
! EIGRP is configured to run over the inside physical interface and the tunnel.
router eigrp 1
network 10.0.0.0 0.0.0.255
network 192.168.1.0 0.0.0.255The following example show a traffic segmentation configuration in which traffic is segmented between two spokes that serve as PE devices:
hostname hub-pe1
boot-start-marker
boot-end-marker
no aaa new-model
resource policy
clock timezone EST 0
ip cef
no ip domain lookup
!This section refers to the forwarding table for VRF blue:
ip vrf blue
rd 2:2
route-target export 2:2
route-target import 2:2
!This section refers to the forwarding table for VRF red:
ip vrf red
rd 1:1
route-target export 1:1
route-target import 1:1
mpls label protocol ldp
crypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
crypto ipsec transform-set t1 esp-des
mode transport
crypto ipsec profile prof
set transform-set t1
interface Tunnel1
ip address 10.9.9.1 255.255.255.0
no ip redirects
ip nhrp authentication cisco
ip nhrp map multicast dynamic
ip nhrp network-id 1
!The command below enables MPLS on the DMVPN network:
mpls ip
tunnel source Gigabitethernet 0/0/0
tunnel mode gre multipoint
tunnel protection ipsec profile prof
interface Loopback0
ip address 10.0.0.1 255.255.255.255
interface Ethernet0/0/0
ip address 172.0.0.1 255.255.255.0
!The multiprotocol BGP route reflector (the hub) configuration changes the next-hop information to set itself as the next-hop and assigns a new VPN label for the prefixes learned from the spokes and advertises the VPN prefix:
router bgp 1
no synchronization
bgp log-neighbor-changes
neighbor 10.0.0.11 remote-as 1
neighbor 10.0.0.11 update-source Tunnel1
neighbor 10.0.0.12 remote-as 1
neighbor 10.0.0.12 update-source Tunnel1
no auto-summary
address-family vpnv4
neighbor 10.0.0.11 activate
neighbor 10.0.0.11 send-community extended
neighbor 10.0.0.11 route-reflector-client
neighbor 10.0.0.11 route-map nexthop out
neighbor 10.0.0.12 activate
neighbor 10.0.0.12 send-community extended
neighbor 10.0.0.12 route-reflector-client
neighbor 10.0.0.12 route-map nexthop out
exit
address-family ipv4 vrf red
redistribute connected
no synchronization
exit
address-family ipv4 vrf blue
redistribute connected
no synchronization
exit
no ip http server
no ip http secure-server
!In this route map information, the hub sets the next hop to itself, and the VPN prefixes are advertised:
route-map cisco permit 10
set ip next-hop 10.0.0.1
control-plane
line con 0
logging synchronous
line aux 0
line vty 0 4
no login
end
hostname spoke-pe2
boot-start-marker
boot-end-marker
no aaa new-model
resource policy
clock timezone EST 0
ip cef
no ip domain lookup
!This section refers to the forwarding table for VRF blue:
ip vrf blue
rd 2:2
route-target export 2:2
route-target import 2:2
!This section refers to the forwarding table for VRF red:
ip vrf red
rd 1:1
route-target export 1:1
route-target import 1:1
mpls label protocol ldp
crypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
crypto ipsec transform-set t1 esp-des
mode transport
crypto ipsec profile prof
set transform-set t1
interface Tunnel1
ip address 10.0.0.11 255.255.255.0
no ip redirects
ip nhrp authentication cisco
ip nhrp map multicast dynamic
ip nhrp map 10.0.0.1 172.0.0.1
ip nhrp map multicast 172.0.0.1
ip nhrp network-id 1
ip nhrp nhs 10.0.0.1
!The command below enables MPLS on the DMVPN network:
mpls ip
tunnel source Gigabitethernet 0/0/0
tunnel mode gre multipoint
tunnel protection ipsec profile prof
interface Loopback0
ip address 10.9.9.11 255.255.255.255
interface FastEthernet0/0/0
ip address 172.0.0.11 255.255.255.0
!
!
interface FastEthernet1/0/0
ip vrf forwarding red
ip address 192.168.11.2 255.255.255.0
interface FastEthernet2/0/0
ip vrf forwarding blue
ip address 192.168.11.2 255.255.255.0
!The multiprotocol BGP route reflector (the hub) configuration changes the next-hop information to set itself as the next-hop and assigns a new VPN label for the prefixes learned from the spokes and advertises the VPN prefix:
router bgp 1
no synchronization
bgp log-neighbor-changes
neighbor 10.0.0.1 remote-as 1
neighbor 10.0.0.1 update-source Tunnel1
no auto-summary
address-family vpnv4
neighbor 10.0.0.1 activate
neighbor 10.0.0.1 send-community extended
exit
!
address-family ipv4 vrf red
redistribute connected
no synchronization
exit
!
address-family ipv4 vrf blue
redistribute connected
no synchronization
exit
no ip http server
no ip http secure-server
control-plane
line con 0
logging synchronous
line aux 0
line vty 0 4
no login
end
hostname spoke-PE3
boot-start-marker
boot-end-marker
no aaa new-model
resource policy
clock timezone EST 0
ip cef
no ip domain lookup
!This section refers to the forwarding table for VRF blue:
ip vrf blue
rd 2:2
route-target export 2:2
route-target import 2:2
!This section refers to the forwarding table for VRF red:
ip vrf red
rd 1:1
route-target export 1:1
route-target import 1:1
mpls label protocol ldp
crypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
crypto ipsec transform-set t1 esp-des
mode transport
crypto ipsec profile prof
set transform-set t1
interface Tunnel1
ip address 10.0.0.12 255.255.255.0
no ip redirects
ip nhrp authentication cisco
ip nhrp map multicast dynamic
ip nhrp map 10.0.0.1 172.0.0.1
ip nhrp map multicast 172.0.0.1
ip nhrp network-id 1
ip nhrp nhs 10.0.0.1
!The command below enables MPLS on the DMVPN network:
mpls ip
tunnel source Gigabitethernet 0/0/0
tunnel mode gre multipoint
tunnel protection ipsec profile prof
!
interface Loopback0
ip address 10.9.9.12 255.255.255.255
interface FastEthernet0/0/0
ip address 172.0.0.12 255.255.255.0
interface FastEthernet1/0/0
ip vrf forwarding red
ip address 192.168.12.2 255.255.255.0
interface FastEthernet2/0/0
ip vrf forwarding blue
ip address 192.168.12.2 255.255.255.0
!The multiprotocol BGP route reflector (the hub) configuration changes the next-hop information to set itself as the next-hop and assigns a new VPN label for the prefixes learned from the spokes and advertises the VPN prefix:
router bgp 1
no synchronization
bgp log-neighbor-changes
neighbor 10.0.0.1 remote-as 1
neighbor 10.0.0.1 update-source Tunnel1
no auto-summary
address-family vpnv4
neighbor 10.0.0.1 activate
neighbor 10.0.0.1 send-community extended
exit
address-family ipv4 vrf red
redistribute connected
no synchronization
exit
address-family ipv4 vrf blue
redistribute connected
no synchronization
exit
no ip http server
no ip http secure-server
control-plane
line con 0
logging synchronous
line aux 0
line vty 0 4
no login
endThe following example shows a configuration for segmenting traffic between two spokes located at branch offices of an enterprise. In this example, EIGRP is configured to learn routes to reach BGP neighbors within the DMVPN.
hostname HUB
boot-start-marker
boot-end-marker
no aaa new-model
resource policy
clock timezone EST 0
ip cef
no ip domain lookup
!This section refers to the forwarding table for VRF blue:
ip vrf blue
rd 2:2
route-target export 2:2
route-target import 2:2
!This refers to the forwarding table for VRF red:
ip vrf red
rd 1:1
route-target export 1:1
route-target import 1:1
mpls label protocol ldp
crypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
crypto ipsec transform-set t1 esp-des
mode transport
crypto ipsec profile prof
set transform-set t1
interface Tunnel1
ip address 10.0.0.1 255.255.255.0
no ip redirects
ip nhrp authentication cisco
ip nhrp map multicast dynamic
ip nhrp network-id 1
!EIGRP is enabled on the DMVPN network to learn the IGP prefixes:
no ip split-horizon eigrp 1
!The command below enables MPLS on the DMVPN network:
mpls ip
tunnel source Gigabitethernet 0/0/0
tunnel mode gre multipoint
tunnel protection ipsec profile prof
!This address is advertised by EIGRP and used as the BGP endpoint:
interface Loopback0
ip address 10.9.9.1 255.255.255.255
interface FastEthernet0/0/0
ip address 172.0.0.1 255.255.255.0
!EIGRP is configured to learn the BGP peer addresses (10.9.9.x networks)
router eigrp 1
network 10.9.9.1 0.0.0.0
network 10.0.0.0 0.0.0.255
no auto-summary
!The multiprotocol BGP route reflector (the hub) configuration changes the next-hop information to set itself as the next-hop and assigns a new VPN label for the prefixes learned from the spokes and advertises the VPN prefix:
router bgp 1
no synchronization
bgp router-id 10.9.9.1
bgp log-neighbor-changes
neighbor 10.9.9.11 remote-as 1
neighbor 10.9.9.11 update-source Loopback0
neighbor 10.9.9.12 remote-as 1
neighbor 10.9.9.12 update-source Loopback0
no auto-summary
address-family vpnv4
neighbor 10.9.9.11 activate
neighbor 10.9.9.11 send-community extended
neighbor 10.9.9.11 route-reflector-client
neighbor 10.9.9.12 activate
neighbor 10.9.9.12 send-community extended
neighbor 10.9.9.12 route-reflector-client
exit
address-family ipv4 vrf red
redistribute connected
no synchronization
exit
address-family ipv4 vrf blue
redistribute connected
no synchronization
exit
no ip http server
no ip http secure-server
control-plane
line con 0
logging synchronous
line aux 0
line vty 0 4
no login
end
hostname Spoke2
boot-start-marker
boot-end-marker
no aaa new-model
resource policy
clock timezone EST 0
ip cef
no ip domain lookup
!This section refers to the forwarding table for VRF blue:
ip vrf blue
rd 2:2
route-target export 2:2
route-target import 2:2
!This section refers to the forwarding table for VRF red:
ip vrf red
rd 1:1
route-target export 1:1
route-target import 1:1
mpls label protocol ldp
crypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
crypto ipsec transform-set t1 esp-des
mode transport
crypto ipsec profile prof
set transform-set t1
interface Tunnel1
ip address 10.0.0.11 255.255.255.0
no ip redirects
ip nhrp authentication cisco
ip nhrp map multicast dynamic
ip nhrp map 10.0.0.1 172.0.0.1
ip nhrp map multicast 172.0.0.1
ip nhrp network-id 1
ip nhrp nhs 10.0.0.1
!The command below enables MPLS on the DMVPN network:
mpls ip
tunnel source Gigabitethernet 0/0/0
tunnel mode gre multipoint
tunnel protection ipsec profile prof
!This address is advertised by EIGRP and used as the BGP endpoint:
interface Loopback0
ip address 10.9.9.11 255.255.255.255
interface FastEthernet0/0/0
ip address 172.0.0.11 255.255.255.0
interface FastEthernet1/0/0
ip vrf forwarding red
ip address 192.168.11.2 255.255.255.0
interface FastEthernet2/0/0
ip vrf forwarding blue
ip address 192.168.11.2 255.255.255.0
!EIGRP is enabled on the DMVPN network to learn the IGP prefixes:
router eigrp 1
network 10.9.9.11 0.0.0.0
network 10.0.0.0 0.0.0.255
no auto-summary
!The multiprotocol BGP route reflector (the hub) configuration changes the next-hop information to set itself as the next-hop and assigns a new VPN label for the prefixes learned from the spokes and advertises the VPN prefix:
router bgp 1
no synchronization
bgp router-id 10.9.9.11
bgp log-neighbor-changes
neighbor 10.9.9.1 remote-as 1
neighbor 10.9.9.1 update-source Loopback0
no auto-summary
address-family vpnv4
neighbor 10.9.9.1 activate
neighbor 10.9.9.1 send-community extended
exit
address-family ipv4 vrf red
redistribute connected
no synchronization
exit
address-family ipv4 vrf blue
redistribute connected
no synchronization
exit
no ip http server
no ip http secure-server
control-plane
line con 0
logging synchronous
line aux 0
line vty 0 4
no login
end
hostname Spoke3
boot-start-marker
boot-end-marker
no aaa new-model
resource policy
clock timezone EST 0
ip cef
no ip domain lookup
!This section refers to the forwarding table for VRF blue:
ip vrf blue
rd 2:2
route-target export 2:2
route-target import 2:2
!This section refers to the forwarding table for VRF red:
ip vrf red
rd 1:1
route-target export 1:1
route-target import 1:1
mpls label protocol ldp
crypto isakmp policy 1
authentication pre-share
crypto isakmp key cisco address 0.0.0.0 0.0.0.0
crypto ipsec transform-set t1 esp-des
mode transport
crypto ipsec profile prof
set transform-set t1
interface Tunnel1
ip address 10.0.0.12 255.255.255.0
no ip redirects
ip nhrp authentication cisco
ip nhrp map multicast dynamic
ip nhrp map 10.0.0.1 172.0.0.1
ip nhrp map multicast 172.0.0.1
ip nhrp network-id 1
ip nhrp nhs 10.0.0.1
!The command below enables MPLS on the DMVPN network:
mpls ip
tunnel source Gigabitethernet 0/0/0
tunnel mode gre multipoint
tunnel protection ipsec profile prof
!This address is advertised by EIGRP and used as the BGP endpoint:
interface Loopback0
ip address 10.9.9.12 255.255.255.255
interface FastEthernet0/0/0
ip address 172.0.0.12 255.255.255.0
interface FastEthernet1/0/0
ip vrf forwarding red
ip address 192.168.12.2 255.255.255.0
interface FastEthernet2/0/0
ip vrf forwarding blue
ip address 192.168.12.2 255.255.255.0
!EIGRP is enabled on the DMVPN network to learn the IGP prefixes:
router eigrp 1
network 10.9.9.12 0.0.0.0
network 10.0.0.0 0.0.0.255
no auto-summary
!The multiprotocol BGP route reflector (the hub) configuration changes the next-hop information to set itself as the next-hop and assigns a new VPN label for the prefixes learned from the spokes and advertises the VPN prefix:
router bgp 1
no synchronization
bgp router-id 10.9.9.12
bgp log-neighbor-changes
neighbor 10.9.9.1 remote-as 1
neighbor 10.9.9.1 update-source Loopback0
no auto-summary
address-family vpnv4
neighbor 10.9.9.1 activate
neighbor 10.9.9.1 send-community extended
exit
address-family ipv4 vrf red
redistribute connected
no synchronization
exit
address-family ipv4 vrf blue
redistribute connected
no synchronization
exit
no ip http server
no ip http secure-server
control-plane
line con 0
logging synchronous
line aux 0
line vty 0 4
no login
end
Spoke2# show mpls ldp bindings
tib entry: 10.9.9.1/32, rev 8
local binding: tag: 16
remote binding: tsr: 10.9.9.1:0, tag: imp-null
tib entry: 10.9.9.11/32, rev 4
local binding: tag: imp-null
remote binding: tsr: 10.9.9.1:0, tag: 16
tib entry: 10.9.9.12/32, rev 10
local binding: tag: 17
remote binding: tsr: 10.9.9.1:0, tag: 17
tib entry: 10.0.0.0/24, rev 6
local binding: tag: imp-null
remote binding: tsr: 10.9.9.1:0, tag: imp-null
tib entry: 172.0.0.0/24, rev 3
local binding: tag: imp-null
remote binding: tsr: 10.9.9.1:0, tag: imp-null
Spoke2#
Spoke2# show mpls forwarding-table
Local Outgoing Prefix Bytes tag Outgoing Next Hop
tag tag or VC or Tunnel Id switched interface
16 Pop tag 10.9.9.1/32 0 Tu1 10.0.0.1
17 17 10.9.9.12/32 0 Tu1 10.0.0.1
18 Aggregate 192.168.11.0/24[V] \
0
19 Aggregate 192.168.11.0/24[V] \
0
Spoke2#
Spoke2# show ip route vrf red
Routing Table: red
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
B 192.168.12.0/24 [200/0] via 10.9.9.12, 00:00:02
C 192.168.11.0/24 is directly connected, FastEthernet1/0/0
Spoke2#
Spoke2# show ip route vrf blue
Routing Table: blue
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
B 192.168.12.0/24 [200/0] via 10.9.9.12, 00:00:08
C 192.168.11.0/24 is directly connected, FastEthernet2/0/0
Spoke2#
Spoke2# show ip cef vrf red 192.168.12.0
192.168.12.0/24, version 5, epoch 0
0 packets, 0 bytes
tag information set
local tag: VPN-route-head
fast tag rewrite with Tu1, 10.0.0.1, tags imposed: {17 18}
via 10.9.9.12, 0 dependencies, recursive
next hop 10.0.0.1, Tunnel1 via 10.9.9.12/32
valid adjacency
tag rewrite with Tu1, 10.0.0.1, tags imposed: {17 18}
Spoke2#
Spoke2# show ip bgp neighbors
BGP neighbor is 10.9.9.1, remote AS 1, internal link
BGP version 4, remote router ID 10.9.9.1
BGP state = Established, up for 00:02:09
Last read 00:00:08, last write 00:00:08, hold time is 180, keepalive interval is 60 seconds
Neighbor capabilities:
Route refresh: advertised and received(old & new)
Address family IPv4 Unicast: advertised and received
Address family VPNv4 Unicast: advertised and received
Message statistics:
InQ depth is 0
OutQ depth is 0
Sent Rcvd
Opens: 1 1
Notifications: 0 0
Updates: 4 4
Keepalives: 4 4
Route Refresh: 0 0
Total: 9 9
Default minimum time between advertisement runs is 0 seconds
For address family: IPv4 Unicast
BGP table version 1, neighbor version 1/0
Output queue size : 0
Index 1, Offset 0, Mask 0x2
1 update-group member
Sent Rcvd
Prefix activity: ---- ----
Prefixes Current: 0 0
Prefixes Total: 0 0
Implicit Withdraw: 0 0
Explicit Withdraw: 0 0
Used as bestpath: n/a 0
Used as multipath: n/a 0
Outbound Inbound
Local Policy Denied Prefixes: -------- -------
Total: 0 0
Number of NLRIs in the update sent: max 0, min 0
For address family: VPNv4 Unicast
BGP table version 9, neighbor version 9/0
Output queue size : 0
Index 1, Offset 0, Mask 0x2
1 update-group member
Sent Rcvd
Prefix activity: ---- ----
Prefixes Current: 2 2 (Consumes 136 bytes)
Prefixes Total: 4 2
Implicit Withdraw: 2 0
Explicit Withdraw: 0 0
Used as bestpath: n/a 2
Used as multipath: n/a 0
Outbound Inbound
Local Policy Denied Prefixes: -------- -------
ORIGINATOR loop: n/a 2
Bestpath from this peer: 4 n/a
Total: 4 2
Number of NLRIs in the update sent: max 1, min 1
Connections established 1; dropped 0
Last reset never
Connection state is ESTAB, I/O status: 1, unread input bytes: 0
Connection is ECN Disabled
Local host: 10.9.9.11, Local port: 179
Foreign host: 10.9.9.1, Foreign port: 12365
Enqueued packets for retransmit: 0, input: 0 mis-ordered: 0 (0 bytes)
Event Timers (current time is 0x2D0F0):
Timer Starts Wakeups Next
Retrans 6 0 0x0
TimeWait 0 0 0x0
AckHold 7 3 0x0
SendWnd 0 0 0x0
KeepAlive 0 0 0x0
GiveUp 0 0 0x0
PmtuAger 0 0 0x0
DeadWait 0 0 0x0
iss: 3328307266 snduna: 3328307756 sndnxt: 3328307756 sndwnd: 15895
irs: 4023050141 rcvnxt: 4023050687 rcvwnd: 16384 delrcvwnd: 0
SRTT: 165 ms, RTTO: 1457 ms, RTV: 1292 ms, KRTT: 0 ms
minRTT: 0 ms, maxRTT: 300 ms, ACK hold: 200 ms
Flags: passive open, nagle, gen tcbs
IP Precedence value : 6
Datagrams (max data segment is 536 bytes):
Rcvd: 13 (out of order: 0), with data: 7, total data bytes: 545
Sent: 11 (retransmit: 0, fastretransmit: 0, partialack: 0, Second Congestion: 0), with data: 6, total data bytes: 489
Spoke2#
|
Related Topic |
Document Title |
|---|---|
|
Call Admission Control |
Call Admission Control for IKE |
|
IKE configuration tasks such as defining an IKE policy |
Configuring Internet Key Exchange for IPSec VPNs |
|
IPsec configuration tasks |
Configuring Security for VPNs with IPsec |
|
Configuring VRF-aware IPsec |
VRF-Aware IPsec |
|
Configuring MPLS |
Multiprotocol Label Switching (MPLS) on Cisco Routers |
|
Configuring BGP |
Cisco BGP Overview |
|
Defining and configuring ISAKMP profiles |
Certificate to ISAKMP Profile Mapping |
|
Security commands |
Cisco IOS Security Command Reference |
|
Recommended cryptographic algorithms |
|
RFCs |
Title |
|---|---|
|
RFC 2547 |
BGP/MPLS VPNs |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.|
Feature Name |
Releases |
Feature Information |
|---|---|---|
|
Dynamic Multipoint VPN (DMVPN) Phase 1 |
Cisco IOS XE Release 2.1 |
The Dynamic Multipoint VPN (DMVPN) feature allows users to better scale large and small IPsec Virtual Private Networks (VPNs) by combining generic routing encapsulation (GRE) tunnels, IP security (IPsec) encryption, and Next Hop Resolution Protocol (NHRP). |
|
DMVPN Phase 2 |
Cisco IOS XE Release 2.1 |
DMVPN Spoke-to-Spoke functionality was made more production ready. |
|
NAT-Transparency Aware DMVPN |
Cisco IOS XE Release 2.1 |
The Network Address Translation-Transparency (NAT-T) Aware DMVPN enhancement was added. In addition, DMVPN hub-to-spoke functionality was made more production ready. |
|
Manageability Enhancements for DMVPN |
Cisco IOS XE Release 2.5 |
DMVPN session manageability was expanded with DMVPN-specific commands for debugging, show output, session and counter control, and system log information. The following section provides information about this feature:
The following commands were introduced or modified by this feature: clear dmvpn session , clear dmvpn statistics , debug dmvpn , debug dmvpn condition , debug nhrp condition , debug nhrp error , logging dmvpn , show dmvpn , show ip nhrp traffic |
|
DMVPN--Enabling Traffic Segmentation Within DMVPN |
Cisco IOS XE Release 2.5 |
The 2547oDMVPN feature allows users to segment VPN traffic within a DMVPN tunnel by applying MPLS labels to VRF instances to indicate the source and destination of each VRF. |
AM --aggressive mode. A mode during IKE negotiation. Compared to MM, AM eliminates several steps, making it faster but less secure than MM. Cisco IOS XE software will respond in aggressive mode to an IKE peer that initiates aggressive mode.
GRE --generic routing encapsulation. Tunnels that provide a specific pathway across the shared WAN and encapsulate traffic with new packet headers to ensure delivery to specific destinations. The network is private because traffic can enter a tunnel only at an endpoint. Tunnels do not provide true confidentiality (encryption does) but can carry encrypted traffic.
GRE tunneling can also be used to encapsulate non-IP traffic into IP and send it over the Internet or IP network. The Internet Package Exchange (IPX) and AppleTalk protocols are examples of non-IP traffic.
IKE --Internet Key Exchange. A hybrid protocol that implements Oakley key exchange and Skeme key exchange inside the ISAKMP framework. Although IKE can be used with other protocols, its initial implementation is with IPsec. IKE provides authentication of the IPsec peers, negotiates IPsec keys, and negotiates IPsec security associations.
IPsec --IP security. A framework of open standards developed by the Internet Engineering Task Force (IETF). IPsec provides security for transmission of sensitive information over unprotected networks such as the Internet. IPsec acts at the network layer, protecting and authenticating IP packets between participating IPsec devices (“peers”), such as Cisco routers.
ISAKMP--Internet Security Association Key Management Protocol. A protocol framework that defines payload formats, the mechanics of implementing a key exchange protocol, and the negotiation of a security association.
MM--main mode. Mode that is slower than aggressive mode but more secure and more flexible than aggressive mode because it can offer an IKE peer more security proposals. The default action for IKE authentication (rsa-sig, rsa-encr, or preshared) is to initiate main mode.
NHRP --Next Hop Resolution Protocol. Routers, access servers, and hosts can use NHRP to discover the addresses of other routers and hosts connected to an NBMA network.
The Cisco implementation of NHRP supports the IETF draft version 11 of NBMA Next Hop Resolution Protocol (NHRP).
The Cisco implementation of NHRP supports IP Version 4, Internet Packet Exchange (IPX) network layers, and, at the link layer, ATM, FastEthernet, SMDS, and multipoint tunnel networks. Although NHRP is available on FastEthernet, NHRP need not be implemented over FastEthernet media because FastEthernet is capable of broadcasting. FastEthernet support is unnecessary (and not provided) for IPX.
PFS--perfect forward secrecy. A cryptographic characteristic associated with a derived shared secret value. With PFS, if one key is compromised, previous and subsequent keys are not compromised, because subsequent keys are not derived from previous keys.
SA--security association. Describes how two or more entities will utilize security services to communicate securely. For example, an IPsec SA defines the encryption algorithm (if used), the authentication algorithm, and the shared session key to be used during the IPsec connection.
Both IPsec and IKE require and use SAs to identify the parameters of their connections. IKE can negotiate and establish its own SA. The IPsec SA is established either by IKE or by manual user configuration.
transform--The list of operations done on a data flow to provide data authentication, data confidentiality, and data compression. For example, one transform is the ESP protocol with the HMAC-MD5 authentication algorithm; another transform is the AH protocol with the 56-bit DES encryption algorithm and the ESP protocol with the HMAC-SHA authentication algorithm.
VPN--Virtual Private Network. A framework that consists of multiple peers transmitting private data securely to one another over an otherwise public infrastructure. In this framework, inbound and outbound network traffic is protected using protocols that tunnel and encrypt all data. This framework permits networks to extend beyond their local topology, while remote users are provided with the appearance and functionality of a direct network connection.
Feedback