154
edits
Changes
DMVPN with IPsec Phase 3 (view source)
Revision as of 11:53, 26 January 2023
, 11:53, 26 January 2023no edit summary
<ul>
<ul>
<li>2 Teltonika Routers for SPOKES</li>
<li>2 Teltonika Routers for '''SPOKES'''</li>
<li>1 Teltonika Router for HUB with a public IP address</li>
<li>1 Teltonika Router for '''HUB''' with a public IP address</li>
<li>A PC to configure the routers</li>
<li>A PC to configure the routers</li>
</ul>
</ul>
<br>[[File:HUB main.png|alt=|border]]
<br>[[File:HUB main.png|alt=|border]]
----
----
<b>Step 2</b>: configure DMVPN Phase 1 parameters:
<b>Step 2</b>: configure '''DMVPN Phase 1''' parameters:
1. Encryption algorithm - AES 128
1. Encryption algorithm - AES 128
<br>[[File:Hub phase1.png|alt=|border]]
<br>[[File:Hub phase1.png|alt=|border]]
----
----
<b>Step 3</b>: configure DMVPN Phase 2 parameters:
<b>Step 3</b>: configure '''DMVPN Phase 2''' parameters:
1. Encryption algorithm - AES 128
1. Encryption algorithm - AES 128
<br>[[File:Hub phase2 fix.png|alt=|border]]
<br>[[File:Hub phase2 fix.png|alt=|border]]
----
----
<b>Step 4</b>: configure DMVPN NHRP parameters:
<b>Step 4</b>: configure '''DMVPN NHRP''' parameters:
In the NHRP parameters section, it is important to enable '''REDIRECT''' option, which is essential to our Phase 3 configuration.
In the NHRP parameters section, it is important to enable '''REDIRECT''' option, which is essential to our Phase 3 configuration.
Navigate to the <b>Network → Routing → Dynamic Routes → BGP Protocol</b> page and follow the instructions provided below.
Navigate to the <b>Network → Routing → Dynamic Routes → BGP Protocol</b> page and follow the instructions provided below.
<b>Step 1</b>: enable BGP and configure General section:
<b>Step 1</b>: enable '''BGP''' and configure General section:
1. Enable vty
1. Enable vty
<b>Step 2</b>: Create BGP Peer Group:
<b>Step 2</b>: Create '''BGP''' Peer Group:
- Add a Neighbor address for SPOKE 1 and SPOKE 2 (We used 10.0.0.1 and 10.0.0.2 which will be in the same subnet as our hub 10.0.0.254)
- Add a Neighbor address for SPOKE 1 and SPOKE 2 (We used 10.0.0.1 and 10.0.0.2 which will be in the same subnet as our hub 10.0.0.254)
<b>Step 3</b>: Add two BGP peers for each spoke:
<b>Step 3</b>: Add two '''BGP''' peers for each spoke:
Now let's create BGP peers for Spokes on the same page. Add two new BGP peers with the following parameters:
Now let's create BGP peers for Spokes on the same page. Add two new BGP peers with the following parameters:
<b>Step 2</b>: configure DMVPN Phase 1 parameters:
<b>Step 2</b>: configure '''DMVPN''' '''Phase 1''' parameters:
1. Select the Encryption algorithm - AES 128
1. Select the Encryption algorithm - AES 128
<b>Step 3</b>: configure DMVPN Phase 2 parameters:
<b>Step 3</b>: configure '''DMVPN Phase 2''' parameters:
1. Select the Encryption algorithm AES 128
1. Select the Encryption algorithm AES 128
<b>Step 4</b>: configure DMVPN NHRP parameters:
<b>Step 4</b>: configure '''DMVPN NHRP''' parameters:
- In the NHRP parameters section, it is important to enable REDIRECT option, which is essential to our Phase 3 configuration.
- In the NHRP parameters section, it is important to enable REDIRECT option, which is essential to our Phase 3 configuration.
Navigate to the <b>Network → Routing → Dynamic Routes → BGP Protocol</b> page and follow the instructions provided below.
Navigate to the <b>Network → Routing → Dynamic Routes → BGP Protocol</b> page and follow the instructions provided below.
<b>Step 1</b>: enable BGP and configure General section:
<b>Step 1</b>: enable '''BGP''' and configure General section:
- Enable vty
- Enable vty
<b>Step 2</b>: Create BGP Peer:
<b>Step 2</b>: Create '''BGP''' Peer:
- Set Remote AS to 65000
- Set Remote AS to 65000
<b>Step 2</b>: configure DMVPN Phase 1 parameters:
<b>Step 2</b>: configure '''DMVPN Phase 1''' parameters:
- Select Encryption algorithm - AES 128
- Select Encryption algorithm - AES 128
<br>[[File:Hub phase1.png|alt=spoke phase1|border]]
<br>[[File:Hub phase1.png|alt=spoke phase1|border]]
----
----
<b>Step 3</b>: configure DMVPN Phase 2 parameters:
<b>Step 3</b>: configure '''DMVPN Phase 2''' parameters:
- Select Encryption algorithm AES 128
- Select Encryption algorithm AES 128
<b>Step 4</b>: configure DMVPN NHRP parameters:
<b>Step 4</b>: configure '''DMVPN NHRP''' parameters:
- In the NHRP parameters section, it is important to enable REDIRECT option, which is essential to our Phase 3 configuration.
- In the NHRP parameters section, it is important to enable REDIRECT option, which is essential to our Phase 3 configuration.
Navigate to the <b>Network → Routing → Dynamic Routes → BGP Protocol</b> page and follow the instructions provided below.
Navigate to the <b>Network → Routing → Dynamic Routes → BGP Protocol</b> page and follow the instructions provided below.
<b>Step 1</b>: enable BGP and configure General section:
<b>Step 1</b>: enable '''BGP''' and configure General section:
- Enable vty
- Enable vty
<b>Step 2</b>: Create BGP Peer:
<b>Step 2</b>: Create '''BGP''' Peer:
- Set Remote AS to 65000
- Set Remote AS to 65000
For HUB in Network > Firewall GRE zone change from REJECT to ACCEPT on FORWARD.
For H'''UB''' in Network -> Firewall GRE zone change from '''REJECT''' to '''ACCEPT''' on '''FORWARD.'''
[[File:Firewall.png|alt=|border]]
[[File:Firewall.png|alt=|border]]