Thanks to these references, below. I followed the same steps to setup my lab. If you are looking for DMVPN, you should read them first. I also came across this information from 9tut.com which summaries DMVPN concept.
It is the combination of the following technologies:
+ Multipoint GRE (mGRE)
+ Next-Hop Resolution Protocol (NHRP)
+ Dynamic Routing Protocol (EIGRP, RIP, OSPF, BGP…) (optional)
+ Dynamic IPsec encryption (optional)
+ Cisco Express Forwarding (CEF)
That is the lab which I used. One client on the right side, namely docker, is able to access to the server side. I do not post all explanation of command, since references, below, have more details. We need to know some basic encryption algorithm, HMAC, symmetric/asymmetric encryption, 3DES (Data Encryption Standard), Authentication Method( pre-shared key), Hash Algorithm(MD5)
!!HUB Configuration
interface Tunnel0
ip address 10.1.1.1 255.255.255.0
ip nhrp map multicast dynamic
ip nhrp network-id 1
tunnel source 192.168.1.100
tunnel mode gre multipoint
ip mtu 1416
=======================================
!!R2 configuration
interface Tunnel0
ip address 10.1.1.2 255.255.255.0
ip nhrp map 10.1.1.1 192.168.1.100
ip nhrp map multicast 192.168.1.100
ip nhrp network-id 1
ip nhrp nhs 10.1.1.1
tunnel source 192.168.2.2
tunnel mode gre multipoint
ip mtu 1416
=======================================
!!R3 configuration
interface Tunnel0
ip address 10.1.1.3 255.255.255.0
ip nhrp map 10.1.1.1 192.168.1.100
ip nhrp map multicast 192.168.1.100
ip nhrp network-id 1
ip nhrp nhs 10.1.1.1
tunnel source 192.168.3.3
tunnel mode gre multipoint
ip mtu 1416
=======================================
!!R4 configuration
interface Tunnel0
ip address 10.1.1.4 255.255.255.0
ip nhrp map 10.1.1.1 192.168.1.100
ip nhrp map multicast 192.168.1.100
ip nhrp network-id 1
ip nhrp nhs 10.1.1.1
tunnel source 192.168.4.4
tunnel mode gre multipoint
ip mtu 1416
=======================================
!!IPSEC configuration
crypto isakmp policy 10
hash md5
encryption 3des
authentication pre-share
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
crypto ipsec transform MINE esp-3des
crypto ipsec profile DMVPN
set transform-set MINE
interface tunnel0
tunnel protection ipsec profile DMVPN
=======================================
!!Dynamic Route configuration, except R1
interface tunnel0
ip hold-time eigrp 1 35
no ip next-hop-self eigrp 1
no ip split-horizon eigrp 1
router eigrp 1
network 192.168.0.0
network 172.16.0.0
network 10.0.0.0
no auto-summary
=======================================
debug nhrp
debug nhrp packet
show dmvpn
show ip route
If we look at the packets on Wireshark, it is encrypted. IPsec configuration, including pre-shared key, above, supports encryption of all data.
Ping from client side to server. This is phase 2, so only HUB IP address is seen as a source.
SQL on Docker Containers I have tested different databases, namely MySQL, Microsoft SQL, and PostgreSQL,…
VMware ESXi 7.0 Upgrade It is time to upgrade VMware environment, but I have an…
HP ProLiant DL380 G7 It is time to troubleshooting. It can be challenge once you…
Cisco ASA and SNMP configuration SNMP is important to collect data from network devices. In…
FORTICLIENT In this lab, I will configure a Fortigate firewall for a remote connection from…
Fortigate site-to-site VPN As a network engineer, I may need to connect different branches to…
This website uses cookies.