154
edits
Changes
DMVPN with IPsec Phase 3 (view source)
Revision as of 11:56, 26 January 2023
, 11:56, 26 January 2023no edit summary
<b>Step 1</b>: enable '''BGP''' and configure General section:
<b>Step 1</b>: enable '''BGP''' and configure General section:
1. Enable vty
2. Set AS to 65001
3. Set Network to 192.168.10.0/24
<br>[[File:Spoke bgp.png|alt=|border]]
<br>[[File:Spoke bgp.png|alt=|border]]
2. Select Tunnel source (this is the egress interface, which will be able to reach the hub device's public IP address over the internet)
2. Select Tunnel source (this is the egress interface, which will be able to reach the hub device's public IP address over the internet)
3. Add Local GRE interface IP address (this is the GRE IP address of "Spoke 2". It should be unique in the entire VPN network)
3. Add Local GRE interface IP address (this is the GRE IP address of "Spoke 2". It should be unique in the entire VPN network)
4. Add Remote GRE interface IP address (this is the GRE IP address of the previously configured hub device)
4. Add Remote GRE interface IP address (this is the GRE IP address of the previously configured hub device)
5. Set GRE MTU to 1420 (this value should be set to the same value that was configured on the hub device. In our case, it is "1420")
5. Set GRE MTU to 1420 (this value should be set to the same value that was configured on the hub device. In our case, it is "1420")
6. Set Local identifier (For setups behind NAT), Remote identifier as %any and input the same Pre-shared key (This will determine how other devices will be identified for authentication)
6. Set Local identifier (For setups behind NAT), Remote identifier as %any and input the same Pre-shared key (This will determine how other devices will be identified for authentication)
<b>Step 2</b>: configure '''DMVPN Phase 1''' parameters:
<b>Step 2</b>: configure '''DMVPN Phase 1''' parameters:
1. Select Encryption algorithm - AES 128
2. Select Authentication SHA256
3. Select DH group MODP3072
<br>[[File:Hub phase1.png|alt=spoke phase1|border]]
<br>[[File:Hub phase1.png|alt=spoke phase1|border]]
<b>Step 3</b>: configure '''DMVPN Phase 2''' parameters:
<b>Step 3</b>: configure '''DMVPN Phase 2''' parameters:
1. Select Encryption algorithm AES 128
2. Select Hash algorithm SHA256
3. Select PFS group MODP3072
<br>[[File:Hub phase2 fix.png|alt=spoke phase2|border]]
<br>[[File:Hub phase2 fix.png|alt=spoke phase2|border]]
<b>Step 1</b>: enable '''BGP''' and configure General section:
<b>Step 1</b>: enable '''BGP''' and configure General section:
1. Enable vty
2. Set AS to 65002
3. Set Network to 192.168.20.0/24
<br>[[File:Spoke2 bgp peer.png|alt=|border]]
<br>[[File:Spoke2 bgp peer.png|alt=|border]]