DMVPN Over IPsec

ccnp-routing
Protects a DMVPN Phase 3 network with IPsec using an ISAKMP policy, a transport mode transform set, and a tunnel protection profile.
Published

Jan 28, 2018

To configure IPsec in this article, you should have already configured DMVPN Phase 3. I used iBGP for routing. (I preserved the last configuration from the DMVPN Phase 3 notes)

IPsec phase 1 (ISAKMP tunnel)

HQ & Branches(config)#crypto isakmp policy 10
HQ & Branches(config-isakmp)#authentication pre-share 
HQ & Branches(config-isakmp)#encryption aes 128
HQ & Branches(config-isakmp)#group 5
HQ & Branches(config-isakmp)#hash sha256
HQ & Branches(config)#crypto isakmp key DMVPN_KEY address 0.0.0.0

IPsec phase 2 (IPsec tunnel)

HQ & Branches(config)#crypto ipsec transform-set DMVPN_TRANSFORM esp-aes esp-sha-hmac
HQ & Branches(cfg-crypto-trans)#mode transport
HQ & Branches(config)#crypto ipsec profile DMVPN_PROFILE
HQ & Branches(ipsec-profile)#set transform-set DMVPN_TRANSFORM
HQ & Branches(config)#interface tunnel 0
HQ & Branches(config-if)#tunnel protection ipsec profile DMVPN_PROFILE

Verification

As IPsec occurs before DMVPN we should have a fresh start 
HQ & Branches(config)#interface tunnel 0
HQ(config-if)#no shutdown
Branches(config-if)#no shutdown
HQ#show dmvpn | begin Hub
Type:Hub, NHRP Peers:2, 

 # Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
 ----- --------------- --------------- ----- -------- -----
     1 201.1.1.1              10.0.1.1    UP 00:01:43     D
     1 202.2.2.2              10.0.1.2    UP 00:01:42     D

HQ#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
200.0.0.12      202.2.2.2       QM_IDLE           1008 ACTIVE
200.0.0.12      201.1.1.1       QM_IDLE           1007 ACTIVE

Branch1#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
201.1.1.1       202.2.2.2       QM_IDLE           1002 ACTIVE
200.0.0.12      201.1.1.1       QM_IDLE           1006 ACTIVE
202.2.2.2       201.1.1.1       QM_IDLE           1004 ACTIVE

Branch1#traceroute 192.168.2.2 source 192.168.1.1
Type escape sequence to abort.
Tracing the route to 192.168.2.2
VRF info: (vrf in name/id, vrf out name/id)
  1 10.0.1.2 15 msec 15 msec 16 msec

Branch1#show ip route 
Gateway of last resort is 10.0.1.12 to network 0.0.0.0

B*    0.0.0.0/0 [200/0] via 10.0.1.12, 00:46:53
      10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C        10.0.1.0/24 is directly connected, Tunnel0
L        10.0.1.1/32 is directly connected, Tunnel0
H        10.0.1.2/32 is directly connected, 00:44:35, Tunnel0
      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.1.0/24 is directly connected, GigabitEthernet0/3
L        192.168.1.1/32 is directly connected, GigabitEthernet0/3
H     192.168.2.0/24 [250/255] via 10.0.1.2, 00:44:35, Tunnel0
S     200.0.0.0/24 is directly connected, GigabitEthernet0/1
      201.1.1.0/24 is variably subnetted, 2 subnets, 2 masks
C        201.1.1.0/24 is directly connected, GigabitEthernet0/1
L        201.1.1.1/32 is directly connected, GigabitEthernet0/1
S     202.2.2.0/24 is directly connected, GigabitEthernet0/1

Branch1#show crypto ipsec sa peer 202.2.2.2

interface: Tunnel0
    Crypto map tag: Tunnel0-head-0, local addr 201.1.1.1

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (201.1.1.1/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (202.2.2.2/255.255.255.255/47/0)
   current_peer 202.2.2.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3
    #pkts decaps: 3, #pkts decrypt: 3, #pkts verify: 3
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 201.1.1.1, remote crypto endpt.: 202.2.2.2
     plaintext mtu 1458, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/1
     current outbound spi: 0xB067DC4D(2959596621)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x8A86633F(2324063039)
        transform: esp-aes esp-sha-hmac ,
        in use settings ={Transport, }
        conn id: 3, flow_id: SW:3, sibling_flags 80000000, crypto map: Tunnel0-head-0
        sa timing: remaining key lifetime (k/sec): (4608000/2948)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)
      spi: 0xDF9429D6(3751029206)
        transform: esp-aes esp-sha-hmac ,
        in use settings ={Transport, }
        conn id: 7, flow_id: SW:7, sibling_flags 80004000, crypto map: Tunnel0-head-0
        sa timing: remaining key lifetime (k/sec): (4213278/2952)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x805A639F(2153407391)
        transform: esp-aes esp-sha-hmac ,
        in use settings ={Transport, }
        conn id: 4, flow_id: SW:4, sibling_flags 80000000, crypto map: Tunnel0-head-0
        sa timing: remaining key lifetime (k/sec): (4608000/2948)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)
      spi: 0xB067DC4D(2959596621)
        transform: esp-aes esp-sha-hmac ,
        in use settings ={Transport, }
        conn id: 8, flow_id: SW:8, sibling_flags 80004000, crypto map: Tunnel0-head-0
        sa timing: remaining key lifetime (k/sec): (4213278/2952)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:
  • GRE uses IP protocol 47
  • With IPsec, HQ will have an SA with each branch.
  • With a large network that might be a burden on the hub router
  • One solution is to implement DMVPN over Group Encrypted Transport (GETVPN)
    • GETVPN is any-to-any VPN
Back to top