154
edits
Changes
DMVPN with IPsec Phase 3 (view source)
Revision as of 11:28, 26 January 2023
, 11:28, 26 January 2023no edit summary
<b>Step 1</b>: create a new DMVPN instance:
<b>Step 1</b>: create a new DMVPN instance:
1. Add HUB address (this is the public IP address of the previously configured hub device)
2. Select Tunnel source (this is the egress interface, which will be able to reach the hub device's public IP address over the internet)
3. Add Local GRE interface IP address (this is the GRE IP address of "Spoke 1". It should be unique in the entire VPN network)
4. Add Remote GRE interface IP address (this is the GRE IP address of the previously configured hub device)
5. Set GRE MTU to 1420 (this value should be set to the same value that was configured on the hub device. In our case, it is "1420")
6. Set Local identifier (For setups behind NAT), Remote identifier as %any and input the same Pre-shared key (This will determine how other devices will be identified for authentication)
<br>[[File:DMVPN phase3 example4.png|alt=|border]]
<br>[[File:Spoke dmvpn.png|alt=|border]]
----
----
<b>Step 2</b>: configure DMVPN Phase 1 parameters:
<b>Step 2</b>: configure DMVPN Phase 1 parameters:
1. Select the Encryption algorithm - AES 128
2. Select Authentication SHA256
3. Select DH group MODP3072
<br>[[File:DMVPN phase3 example2.png|alt=|border]]
<br>[[File:Hub phase1.png|alt=spoke phase1|border]]
----
----
<b>Step 3</b>: configure DMVPN Phase 2 parameters:
<b>Step 3</b>: configure DMVPN Phase 2 parameters:
1. Select the Encryption algorithm AES 128
2. Select Hash algorithm SHA256
3. Select PFS group MODP3072
<br>[[File:DMVPN phase3 example3.png|alt=|border]]
<br>[[File:Hub phase2 fix.png|alt=spoke phase2|border]]
----
----
- Leave everything by default
- Leave everything by default
<br>[[File:DMVPN HUB Phase3 spoke example4.png|border|class=tlt-border]]
<br>[[File:Redirect.png|alt=Redirect|border]]
----
----
<b>Step 5</b>: save changes
<b>Step 5</b>: save changes
