Cisco 1751 Bedienungsanleitung

Page 1 of 16

SOLUTION OVERVIEW

CONFIGURING DYNAMIC MULTIPOINT VPN

WITH ON-DEMAND ROUTING

OVERVIEW

This document provides a sample configuration for configuring On-Demand Routing (ODR) with Dynamic Multipoint VPN (DMVPN) in hub to

spoke configuration. The DMVPN feature simplifies the hub router IPsec configuration and supports dynamic IP addresses at the spoke router.

DMVPN combines Generic Routing Encapsulation (GRE) tunnels, IPsec encryption, and Next Hop Resolution Protocol (NHRP). It provides IP

routing for remote sites, while minimizing the overhead on the network devices. This sample configuration also allows load balancing with dual

ODR hub routers, failover to a single hub when a hub router fails, and the recovery from a hub router failure when it is recovered.

Figure 1. Network Diagram

PREREQUISITES

The sample configuration is based on the following assumptions:

•Public IP addresses for the hub routers (10.0.149.221 and 10.0.149.220)

•DMVPN network for tunnel interface on both hubs are 192.168.1.0/24 and 192.168.2.0/24

•Spoke router can use static IP or dynamic IP addresses

•Example uses Enhanced Interior Gateway Routing Protocol (EIGRP) as its dynamic routing protocol

•Example uses pre-shared keys for authentication

•Disabled split tunneling for the spoke router; this allows the Internet traffic to go through the hub only

LIMITATIONS

This guide provides the DMPVN configuration, but does not cover the following configuration:

•Full router security audit: run a Security Device Manager (SDM) security audit in the wizard mode to lock down and secure the router.

•Initial router configuration step: full configuration is shown in the following section.

Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.

Page 2 of 16

•This configuration guide uses private addresses only. When using private addresses and connecting to the Internet, an appropriate Network

Address Translation (NAT) or Port Address Translation (PAT) configuration is required to provide connectivity over the Internet.

•The ODR provides a default route only to the spoke, the configuration support hub and spoke topology; no split tunneling

PRECAUTIONS

Before configurations are made to any router, confirm the following:

•The spoke router can reach the DMVPN hub directly over the Internet.

•The DMVPN hub is configured and operational.

COMPONENTS

•Cisco IOS Software Release 12.3(11)T3(fc2)

•Cisco 831, 1751, 3725 and 3745 Routers

Figure 1 illustrates the network for the sample configuration.

The information presented in this document was created from devices in a specific lab environment. All devices started with a cleared (default)

configuration. It is imperative to understand the potential impact of any command before implementing it in a live network.

This configuration uses two DMVPN hub routers. Each hub router is configured with a separate DMVPN tunnel network (192.168.1.0/24 and

192.168.2.0/24). The first tunnel on the spokes is used for direct connectivity through the first DMVPN hub and the second tunnel on the spokes

is used for the second DMVPN hub. During normal operations with dual hubs, the spoke router load-balances the traffic between both hubs.

Connectivity between the spoke routers is provided through the hub routers in hub and spoke topology. During a failure, the ODR protocol will time

out the failed path, and it will use one active path to the active hub router.

Using ODR, the hub router learns about the remote networks using the CDP protocol. By default, CDP is disabled on the tunnel interface. To allow

the hub and spoke routers to exchange routes, CDP must be enabled on the tunnel interface. ODR allows for push of the default route from the hub

router to the spoke router. The hub router configuration only accepts spoke routers network ranges defined with the “distribute-list 101 in”in order

to prevent the risk of learning the DHCP public network of spoke router from the tunnel interface with ODR. All routing protocols should be

disabled on the spoke routers to activate ODR on the spoke routers.

By default, CDP sends updates every sixty seconds. This update interval may not be frequent enough to provide faster re-convergence of IP routes on

the hub router side of the network. A quicker re-convergence rate may be necessary if the spoke connects to one of several hub routers via

asynchronous interfaces such as modem lines.

ODR expects to receive periodic CDP updates, which contain IP prefix information. When ODR fails to receive updates for routes that it has

installed in the routing table, these ODR routes are first marked invalid and eventually removed from the routing table (by default, ODR routes are

marked invalid after 180 seconds and are removed from the routing table after 240 seconds). These defaults are based on the default CDP update

interval. Configuration changes made to either the CDP or ODR timers should be reflected through changes made to both.

For additional information about configuring ODR timers, refer to:

http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800ca75f.html#1000989

Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.

Page 3 of 16

CONFIGURATION OF THE CISCO 3725 ROUTER

Following are the configurations on the Hub router:

Current configuration:

version 12.3

hostname c3725-21

no aaa new-model

ip subnet-zero

ip cef

crypto isakmp policy 1

encr 3des

authentication pre-share

group 2

crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0

crypto isakmp keepalive 10

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

mode transport

crypto ipsec profile SDM_Profile1

set transform-set ESP-3DES-SHA

interface Tunnel0

bandwidth 1000

ip address 192.168.1.1 255.255.255.0

no ip redirects

ip mtu 1400

ip nhrp authentication DMVPN_NW

ip nhrp map multicast dynamic

ip nhrp network-id 100000

ip nhrp holdtime 360

ip tcp adjust-mss 1360

no ip split-horizon eigrp 1

delay 1000

cdp enable

Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.

Page 4 of 16

tunnel source FastEthernet0/0

tunnel mode gre multipoint

tunnel key 100000

tunnel protection ipsec profile SDM_Profile1

interface FastEthernet0/0

ip address 10.0.149.221 255.255.255.0

duplex auto

speed auto

interface FastEthernet0/1

ip address 192.168.20.21 255.255.255.0

duplex auto

speed 100

router odr

distribute-list 101 in

router eigrp 1

redistribute odr metric 2000 100 255 255 1400

network 192.168.1.0

network 192.168.2.0

network 192.168.20.0

no auto-summary

ip classless

ip route 0.0.0.0 0.0.0.0 10.0.149.207

access-list 101 permit ip any 192.168.0.0 0.0.255.255

end

Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.

Page 5 of 16

VERIFYING THE CISCO 3725 ROUTER RESULTS

Normal Operation

This section provides information that can be used to confirm that the configuration is working properly.

c3725-21#show ip route

Codes: C-connected, S-static, R-RIP, M-mobile, B-BGP

D-EIGRP, EX-EIGRP external, O-OSPF, IA-OSPF inter area

N1-OSPF NSSA external type 1, N2-OSPF NSSA external type 2

E1-OSPF external type 1, E2-OSPF external type 2

i-IS-IS, su-IS-IS summary, L1-IS-IS level-1, L2-IS-IS level-2

ia-IS-IS inter area, *-candidate default, U-per-user static route

o-ODR, P-periodic downloaded static route

Gateway of last resort is 10.0.149.207 to network 0.0.0.0

o 192.168.27.0/24 [160/1] via 192.168.1.11, 00:00:52, Tunnel0

C 192.168.20.0/24 is directly connected, FastEthernet0/1

10.0.0.0/24 is subnetted, 1 subnets

C 10.0.149.0 is directly connected, FastEthernet0/0

o 192.168.16.0/24 [160/1] via 192.168.1.10, 00:00:21, Tunnel0

C 192.168.1.0/24 is directly connected, Tunnel0

D 192.168.2.0/24 [90/2818560] via 192.168.20.20, 06:03:24, FastEthernet0/1

S* 0.0.0.0/0 [1/0] via 10.0.149.207

c3725-21#show crypto session detail

Crypto session current status

Code: C-IKE Configuration mode, D-Dead Peer Detection

K-Keepalives, N-NAT-traversal, X-IKE Extended Authentication

Interface: Tunnel0

Session status: UP-ACTIVE

Peer: 10.0.150.1 port 500 fvrf: (none) ivrf: (none)

Phase1_id: 10.0.150.1

Desc: (none)

IKE SA: local 10.0.149.221/500 remote 10.0.150.1/500 Active

Capabilities:D connid:10 lifetime:20:55:47

IPSEC FLOW: permit 47 host 10.0.149.221 host 10.0.150.1

Active SAs: 2, origin: crypto map

Inbound: #pkts dec’ed 6829 drop 0 life (KB/Sec) 4503324/3143

Outbound: #pkts enc’ed 65167 drop 1 life (KB/Sec) 4503313/3143

Interface: Tunnel0

Session status: UP-ACTIVE

Peer: 10.0.150.2 port 500 fvrf: (none) ivrf: (none)

Phase1_id: 10.0.150.2

Desc: (none)

IKE SA: local 10.0.149.221/500 remote 10.0.150.2/500 Active

Capabilities:D connid:11 lifetime:20:56:02

Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.

Page 6 of 16

IPSEC FLOW: permit 47 host 10.0.149.221 host 10.0.150.2

Active SAs: 2, origin: crypto map

Inbound: #pkts dec’ed 6757 drop 0 life (KB/Sec) 4427309/2860

Outbound: #pkts enc’ed 65162 drop 1 life (KB/Sec) 4427290/2860

c3725-21#show ip protocols

Routing Protocol is “nhrp”

Maximum path: 0

Routing Information Sources:

Gateway Distance Last Update

Distance: (default is 0)

Routing Protocol is “eigrp 1”

Outgoing update filter list for all interfaces is not set

Incoming update filter list for all interfaces is not set

Default networks flagged in outgoing updates

Default networks accepted from incoming updates

EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0

EIGRP maximum hopcount 100

EIGRP maximum metric variance 1

Redistributing: eigrp 1, odr

EIGRP NSF-aware route hold timer is 240s

Automatic network summarization is not in effect

Maximum path: 4

Routing for Networks:

192.168.1.0

192.168.20.0

Routing Information Sources:

Gateway Distance Last Update

192.168.20.20 90 3d03h

Distance: internal 90 external 170

Routing Protocol is “odr”

Sending updates every 60 seconds, next due in 37 seconds

Invalid after 180 seconds, hold down 0, flushed after 240

Outgoing update filter list for all interfaces is not set

Incoming update filter list for all interfaces is 101

Maximum path: 4

Routing Information Sources:

Gateway Distance Last Update

192.168.1.11 160 00:00:27

192.168.1.10 160 00:00:41

Distance: (default is 160)

c3725-21#show interface tunnel 0

Tunnel0 is up, line protocol is up

Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.

Page 7 of 16

Hardware is Tunnel

Internet address is 192.168.1.1/24

MTU 1514 bytes, BW 1000 Kbit, DLY 10000 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation TUNNEL, loopback not set

Keepalive not set

Tunnel source 10.0.149.221 (FastEthernet0/0), destination UNKNOWN

Tunnel protocol/transport multi-GRE/IP

Key 0x186A0, sequencing disabled

Checksumming of packets disabled

Fast tunneling enabled

Tunnel transmit bandwidth 8000 (kbps)

Tunnel receive bandwidth 8000 (kbps)

Tunnel protection via IPSec (profile “SDM_Profile1”)

Last input 00:00:12, output 00:00:04, output hang never

Last clearing of “show interface” counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queuing strategy: fifo

Output queue: 0/0 (size/max)

5 minute input rate 0 bits/sec, 0 packets/sec

5 minute output rate 1000 bits/sec, 0 packets/sec

24158 packets input, 5290429 bytes, 0 no buffer

Received 0 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

217102 packets output, 55341094 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets

0 output buffer failures, 0 output buffers swapped out

c3725-21#sh cdp nei

Capability Codes: R-Router, T-Trans Bridge, B-Source Route Bridge

S-Switch, H-Host, I-IGMP, r-Repeater

Device ID Local Intrfce Holdtme Capability Platform Port ID

c2950-xl Fas 0/1 160 S I WS-C2950G-Fas 0/37

c1751-16.cisco.com

Tunnel0 132 R S 1751-V Tunnel0

c831-27 Tunnel0 146 R C831 Tunnel0

c2924.cisco.com Fas 0/0 123 T S WS-C2924-XFas 0/19

CONFIGURATION OF THE CISCO 1751 SPOKE ROUTER

Following are the configurations on the Cisco 1751 spoke router:

Current configuration :

version 12.3

Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.

Page 8 of 16

hostname c1751-16

no aaa new-model

ip subnet-zero

ip cef

crypto isakmp policy 1

encr 3des

authentication pre-share

group 2

crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0

crypto isakmp keepalive 10

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

mode transport

crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac

mode transport

crypto ipsec profile SDM_Profile1

set transform-set ESP-3DES-SHA1

crypto ipsec profile SDM_Profile2

set transform-set ESP-3DES-SHA

interface Tunnel0

bandwidth 1000

ip address 192.168.1.10 255.255.255.0

ip mtu 1400

ip nhrp authentication DMVPN_NW

ip nhrp map 192.168.1.1 10.0.149.221

ip nhrp network-id 100000

ip nhrp holdtime 360

ip nhrp nhs 192.168.1.1

ip nhrp server-only

ip tcp adjust-mss 1360

delay 1000

cdp enable

Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.

Page 9 of 16

tunnel source FastEthernet0/0

tunnel destination 10.0.149.221

tunnel key 100000

tunnel protection ipsec profile SDM_Profile1

interface Tunnel1

bandwidth 1000

ip address 192.168.2.10 255.255.255.0

ip mtu 1400

ip nhrp authentication DMPVN_BU

ip nhrp map 192.168.2.1 10.0.149.220

ip nhrp network-id 100001

ip nhrp holdtime 360

ip nhrp nhs 192.168.2.1

ip nhrp server-only

ip tcp adjust-mss 1360

delay 1000

cdp enable

tunnel source FastEthernet0/0

tunnel destination 10.0.149.220

tunnel key 100001

tunnel protection ipsec profile SDM_Profile2

interface Ethernet0/0

ip address 192.168.16.1 255.255.255.0

half-duplex

interface FastEthernet0/0

description $ETH-LAN$$ETH-SW-LAUNCH$

ip address dhcp

speed 100

full-duplex

ip classless

ip route 10.0.149.0 255.255.255.0 dhcp

end

Verifying the Cisco 1751 Spoke Router Results

This section provides information that can be used to confirm that the configuration is working properly.

c1751-16#show ip route

Codes: C-connected, S-static, R-RIP, M-mobile, B-BGP

D-EIGRP, EX-EIGRP external, O-OSPF, IA-OSPF inter area

Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.

Page 10 of 16

N1-OSPF NSSA external type 1, N2-OSPF NSSA external type 2

E1-OSPF external type 1, E2-OSPF external type 2

i-IS-IS, su-IS-IS summary, L1-IS-IS level-1, L2-IS-IS level-2

ia-IS-IS inter area, *-candidate default, U-per-user static route

o-ODR, P-periodic downloaded static route

Gateway of last resort is 192.168.2.1 to network 0.0.0.0

10.0.0.0/24 is subnetted, 2 subnets

C 10.0.150.0 is directly connected, FastEthernet0/0

S 10.0.149.0 [1/0] via 10.0.150.207

C 192.168.16.0/24 is directly connected, Ethernet0/0

C 192.168.1.0/24 is directly connected, Tunnel0

C 192.168.2.0/24 is directly connected, Tunnel1

o* 0.0.0.0/0 [160/1] via 192.168.2.1, 00:00:25, Tunnel1

[160/1] via 192.168.1.1, 00:00:56, Tunnel0

c1751-16#show crypto session detail

Crypto session current status

Code: C-IKE Configuration mode, D-Dead Peer Detection

K-Keepalives, N-NAT-traversal, X-IKE Extended Authentication

Interface: Tunnel0

Session status: UP-ACTIVE

Peer: 10.0.149.221 port 500 fvrf: (none) ivrf: (none)

Phase1_id: 10.0.149.221

Desc: (none)

IKE SA: local 10.0.150.1/500 remote 10.0.149.221/500 Active

Capabilities:D connid:268435501 lifetime:20:51:40

IPSEC FLOW: permit 47 host 10.0.150.1 host 10.0.149.221

Active SAs: 2, origin: crypto map

Inbound: #pkts dec’ed 7179 drop 0 life (KB/Sec) 4607231/2896

Outbound: #pkts enc’ed 65223 drop 1 life (KB/Sec) 4607249/2896

Interface: Tunnel1

Session status: UP-ACTIVE

Peer: 10.0.149.220 port 500 fvrf: (none) ivrf: (none)

Phase1_id: 10.0.149.220

Desc: (none)

IKE SA: local 10.0.150.1/500 remote 10.0.149.220/500 Active

Capabilities:D connid:268435500 lifetime:17:04:05

IPSEC FLOW: permit 47 host 10.0.150.1 host 10.0.149.220

Active SAs: 2, origin: crypto map

Inbound: #pkts dec’ed 6767 drop 0 life (KB/Sec) 4541812/2908

Outbound: #pkts enc’ed 65226 drop 4 life (KB/Sec) 4541830/2908

c1751-16#show ip protocols

Routing Protocol is “nhrp”

Maximum path: 0

Routing Information Sources:

Andere Handbücher für 1751

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Cisco Netzwerk-Router Handbücher

Cisco

Cisco CVR100W Bedienungsanleitung

Cisco

Cisco MWR 1941-DC - 1941 Mobile Wireless Router Handbuch

Cisco

Cisco LinkSys RTP300 Original Betriebsanleitung

Cisco

Cisco IR1101 Bedienungsanleitung

Cisco

Cisco IE 3000 Bedienungsanleitung

Cisco

Cisco 1801 Bedienungsanleitung

Cisco

Cisco XR 12000 Bedienungsanleitung

Cisco

Cisco uBR924 Installationshandbuch

Cisco

Cisco Broadband Access Center Bedienungsanleitung

Cisco

Cisco ASR 1013 Bedienungsanleitung

Cisco

Cisco 2851 - Integrated Services Router Bedienungsanleitung

Cisco

Cisco Linksys SE2800 Bedienungsanleitung

Cisco

Cisco OL-4387-02 Bedienungsanleitung

Cisco

Cisco 2821 - Integrated Services Router Unified Communications... Installationsanleitung

Cisco

Cisco 1760 - VPN Bundle Router Handbuch

Cisco

Cisco Network Convergence System 6000 Series Bedienungsanleitung

Cisco

Cisco 12406 series Bedienerhandbuch

Cisco

Cisco Universal Broadband Router Cisco uBR10012 Handbuch

Cisco

Cisco Profile Series Bedienungsanleitung

Cisco

Cisco Linksys E4200 Betriebsanleitung

Cisco

Cisco 860 Series Bedienungsanleitung

Cisco

Cisco ASR 5000 Series Bedienungsanleitung

Cisco

Cisco 3800 Series Bedienungsanleitung

Cisco

Cisco 4331 Bedienungsanleitung

Beliebte Netzwerk-Router Handbücher anderer Marken

Allnet

Allnet ALL0333AU Bedienungsanleitung

HomeSeer

HomeSeer HT-SEL Bedienungsanleitung

Sercomm

Sercomm Genesis OC3505D Bedienungsanleitung

Billion

Billion BIPAC 5102 Series Bedienungsanleitung

TP-Link

TP-Link TD-8817 Bedienungsanleitung

Motorola

Motorola MR1900 Bedienungsanleitung

Digi

Digi IX14 Bedienungsanleitung

XAVi

XAVi X8821e Bedienungsanleitung

BEC

BEC 6200WZL Bedienungsanleitung

MikroTik

MikroTik hAP ac3 Series Bedienungsanleitung

Korenix

Korenix JetNet 5428G Series Bedienungsanleitung

NETGEAR

NETGEAR FS526T - Switch Bedienungsanleitung

Korenix

Korenix JetNet 5710G Series Bedienungsanleitung

Automated Logic

Automated Logic ZN551 Betriebsanleitung

EnGenius

EnGenius ESR-9710 Bedienungsanleitung

LevelOne

LevelOne FBR-1416 Bedienungsanleitung

Dynacord

Dynacord Promatrix 6000 Bedienungsanleitung

Lorex

Lorex F5D8230-4 Bedienungsanleitung