In this specific use case, I will show you how to enable dual DMVPN clouds going over ASA firewalls as well as IPSec encryption. We will also take it up a notch and demonstrate DMVPN Phase 3 (Spoke to Spoke Communication), VRF configuration (We will be placing the source of the tunnels into their own VRFs), NAT (We will be natting the source of the tunnels to an unused public IP), PAT (We will translate Spoke 1 tunnel source to the outside IP address of the ASA).
DMVPN stands for Dynamic Multipoint VPN and it is a dynamic tunneling form of a virtual private network (VPN). At this point, if you are unfamiliar with DMVPN, I would suggest to revisit the following post first: DMVPN
Below is the high level diagram referencing our network to be built.
Here, we have distinct geophysical Data Centers, Hub1 located in Houston and Hub 2 located in Sydney, Australia. One remote site in Seville Spain (Spoke 1) and another in Venice, Italy.
Note that in a DMVPN network, the geophysical location here does not matter as it is agnostic to the solution. We will use EIGRP to advertise our networks across and BGP to receive a default route from the ISPs. We will try and deploy the entire solution without the use of any static routes.
Let me show you the physical diagram I’m working with today.
I’ll use a single router to mimic the ISPs and each eBGP uplink will go through a switch at each location to peer with the ASAs. We’ll VLAN off the outside and inside traffic at the switch level and we will use sub-interfaces at the ASA level to stitch out networks together.
Let’s dive right in…
Here, all IPs have been preconfigured and I have reachability on all connected networks. I also have the following VLANs defined in every switch:
VLAN 100: ASA to ISP
VLAN 200: DMVPN Router to ASA
Ethernet0/2 on every switch is trunked up because it points to the firewall which house our sub-interface pointing to the WAN as well as the one pointing to the LAN.
This is what it looks like on every switch:
Hello I'm Pape. My friends call me Pop. I'm CCIE #48357. I enjoy my field and love to share it with others. I love to write so I'm sharing my blog with you.
Hello, i test your LAB at home and i cant see where the 1.1.1.100, 2.2.2.100, 3.3.3.100 and 4.4.4.100 are configured. Can you share all configs?
best regards
damian
Hello Damian. Those are the mapped addresses for the source of the tunnels. Those are configured on the ASAs. It is actually written in the blog. Look for the section where I referenced the following:
HUB1-ASA# sh run object
object network DMVPN-IN
host 10.100.10.1
object network DMVPN-OUT
host 1.1.1.100
HUB1-ASA#
HUB1-ASA# sh run nat
nat (DMVPN,OUTSIDE) source static DMVPN-IN DMVPN-OUT
That’s the same approach for the other sites. Please let me know if it works for you.
Hello,
i make your lab only with 1 router. From hub-rtr i cant reach via icmp the ip address 1.1.1.100. From isp-rtr i cant reach 1.1.1.100 and 3.3.3.100.
here are spoke1-rtr config (cisco 1841)
ip vrf DMVPN
rd 65103:30
interface Tunnel100
description **** DMVPN SPOKE1 – HUB1 ****
ip address 172.16.100.2 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication RT-L3AK
ip nhrp map 172.16.100.1 1.1.1.100
ip nhrp map multicast 1.1.1.100
ip nhrp network-id 100
ip nhrp holdtime 600
ip nhrp nhs 172.16.100.1
ip tcp adjust-mss 1360
tunnel source FastEthernet0/1/0
tunnel mode gre multipoint
tunnel key 100
tunnel vrf DMVPN
interface FastEthernet0/1/0
description WAN
ip vrf forwarding DMVPN
ip address 10.100.30.1 255.255.255.0
duplex auto
speed auto
!
!
router eigrp 1001
network 30.30.30.30 0.0.0.0
network 172.16.100.2 0.0.0.0
!
router bgp 65103
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 10.100.30.254 remote-as 65103
!
address-family ipv4
exit-address-family
!
address-family ipv4 vrf DMVPN
neighbor 10.100.30.254 remote-as 65103
neighbor 10.100.30.254 activate
exit-address-family
here the hub-rtr (Cisco 887VG-W)
ip vrf DMVPN
rd 65101:10
interface Loopback0
ip address 10.10.10.10 255.255.255.255
!
interface Tunnel100
description ***** HUB1 *****
ip address 172.16.100.1 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication RT-L3AK
ip nhrp map multicast dynamic
ip nhrp network-id 100
ip nhrp holdtime 600
ip nhrp redirect
ip tcp adjust-mss 1360
tunnel source Vlan1
tunnel mode gre multipoint
tunnel key 100
tunnel vrf DMVPN
interface Vlan1
description DMVPN OUT
ip vrf forwarding DMVPN
ip address 10.100.10.1 255.255.255.0
no autostate
!
router bgp 65101
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 10.100.10.254 remote-as 65101
!
address-family ipv4
exit-address-family
!
address-family ipv4 vrf DMVPN
neighbor 10.100.10.254 remote-as 65101
neighbor 10.100.10.254 activate
exit-address-family
here the config from hub-asa (cisco asa5505)
interface Vlan1
description outside
nameif outside
security-level 0
ip address 1.1.1.254 255.255.255.0
!
interface Vlan2
description inside
nameif DMVPN
security-level 100
ip address 10.100.10.254 255.255.255.0
!
ftp mode passive
object network DMVPN-IN
host 10.100.10.1
object network DMVPN-OUT
host 1.1.1.100
access-list outside-access-in extended permit udp any object DMVPN-IN eq isakmp
access-list outside-access-in extended permit udp any object DMVPN-IN eq 4500
access-list outside-access-in extended permit esp any object DMVPN-IN
nat (DMVPN,outside) source static DMVPN-IN DMVPN-OUT
access-group outside-access-in in interface outside
router bgp 65101
bgp log-neighbor-changes
address-family ipv4 unicast
neighbor 1.1.1.1 remote-as 65100
neighbor 1.1.1.1 activate
neighbor 10.100.10.1 remote-as 65101
neighbor 10.100.10.1 activate
neighbor 10.100.10.1 next-hop-self
no auto-summary
no synchronization
exit-address-family
here the config from spoke1-asa (cisco asa5505)
interface Vlan1
description outside
nameif OUTSIDE
security-level 0
ip address 3.3.3.254 255.255.255.0
!
interface Vlan2
description DMVPN
nameif DMVPN
security-level 100
ip address 10.100.30.254 255.255.255.0
object network DMVPN-IN
host 10.100.30.1
object network HUB1
host 1.1.1.100
object network HUB2
host 2.2.2.100
object network DMVPN-OUT
host 3.3.3.100
access-list outside-access-in extended permit udp any object DMVPN-IN eq isakmp
access-list outside-access-in extended permit udp any object DMVPN-IN eq 4500
access-list outside-access-in extended permit esp any object DMVPN-IN
nat (DMVPN,OUTSIDE) source static DMVPN-IN DMVPN-OUT
access-group outside-access-in in interface OUTSIDE
router bgp 65103
bgp log-neighbor-changes
address-family ipv4 unicast
neighbor 3.3.3.1 remote-as 65100
neighbor 3.3.3.1 activate
neighbor 10.100.30.1 remote-as 65103
neighbor 10.100.30.1 activate
neighbor 10.100.30.1 next-hop-self
no auto-summary
no synchronization
exit-address-family
and at the last config from isp-rtr (cisco 1802)
interface FastEthernet1
description 1.1.1.1
no ip address
!
interface FastEthernet2
description 2.2.2.1
switchport access vlan 2
no ip address
!
interface FastEthernet3
description 3.3.3.1
switchport access vlan 3
no ip address
!
interface FastEthernet4
description 4.4.4.1
switchport access vlan 4
no ip address
interface Vlan1
ip address 1.1.1.1 255.255.255.0
no autostate
!
interface Vlan2
ip address 2.2.2.1 255.255.255.0
no autostate
!
interface Vlan3
ip address 3.3.3.1 255.255.255.0
no autostate
!
interface Vlan4
ip address 4.4.4.1 255.255.255.0
no autostate
router bgp 65100
bgp log-neighbor-changes
no bgp default ipv4-unicast
neighbor 1.1.1.254 remote-as 65101
neighbor 2.2.2.254 remote-as 65102
neighbor 3.3.3.254 remote-as 65103
neighbor 4.4.4.254 remote-as 65104
!
address-family ipv4
neighbor 1.1.1.254 activate
neighbor 1.1.1.254 default-originate
neighbor 2.2.2.254 activate
neighbor 2.2.2.254 default-originate
neighbor 3.3.3.254 activate
neighbor 3.3.3.254 default-originate
neighbor 4.4.4.254 activate
neighbor 4.4.4.254 default-originate
exit-address-family
why i cant connect from spoke1-rtr to hub-rtr ?
thanks for help
best regards
damian
Hello Damian,
From the looks of it, I’m not seeing that you have configured IPSec for the DMVPN tunnels. You have only enabled the following on the outside interfaces of the firewall:
access-list outside-access-in extended permit udp any object DMVPN-IN eq isakmp
access-list outside-access-in extended permit udp any object DMVPN-IN eq 4500
access-list outside-access-in extended permit esp any object DMVPN-IN
This essentially means that unless your ICMP packets are encapsulated in ESP, the firewall would drop them. You can allow ICMP and try again before you encrypt the tunnels. Also, you can run a packet capture on the firewall to ensure your packets are getting across.
Use this command on both sides:
access-list outside-access-in extended permit icmp any any echo-reply
Let me know how it goes.