Cisco: DMVPN

DMVPN, mGRE, NHRP, GRE, IPsec, VPN, Cisco, Networking, Secuirty, Encryption

Topology: mGRE + NHRP + OSPF

Preparation

Project name: ccna-vpn-gre-0003-gre-over-ipsec-1-n

~~Project name: ccna-vpn-dmvpn-0001-mgre+nhrp~~

R1

configure terminal
!
interface GigabitEthernet 0/1
no ip address
pppoe enable group global
pppoe-client dial-pool-number 10
exit
!
interface GigabitEthernet 0/0
ip tcp adjust-mss 1356
exit
!
interface Loopback 1
ip address 100.0.0.1 255.255.255.255
exit
!
interface Dialer 1
ip unnumbered Loopback 1
ip mtu 1454
encapsulation ppp
dialer pool 10
dialer-group 20
ppp authentication chap callin
ppp chap hostname ccie@example.com
ppp chap password cc13
no shutdown
exit
!
ip route 0.0.0.0 0.0.0.0 Dialer 1
!
dialer-list 20 protocol ip permit
!
end

R2

configure terminal
!
interface GigabitEthernet 0/1
no ip address
pppoe enable group global
pppoe-client dial-pool-number 10
exit
!
interface GigabitEthernet 0/0
ip tcp adjust-mss 1356
exit
!
interface Loopback 1
ip address 200.0.0.2 255.255.255.255
exit
!
interface Dialer 1
ip unnumbered Loopback 1
ip mtu 1454
encapsulation ppp
dialer pool 10
dialer-group 20
ppp authentication chap callin
ppp chap hostname ccie@example.com
ppp chap password cc13
no shutdown
exit
!
ip route 0.0.0.0 0.0.0.0 Dialer 1
!
dialer-list 20 protocol ip permit
!
end

R6

configure terminal
!
interface GigabitEthernet 0/1
no ip address
pppoe enable group global
pppoe-client dial-pool-number 10
exit
!
interface GigabitEthernet 0/0
ip tcp adjust-mss 1356
exit
!
interface Loopback 1
ip address 106.0.0.6 255.255.255.255
exit
!
interface Dialer 1
ip unnumbered Loopback 1
ip mtu 1454
encapsulation ppp
dialer pool 10
dialer-group 20
ppp authentication chap callin
ppp chap hostname ccie@isp3.pg1x.net
ppp chap password cc13
no shutdown
exit
!
ip route 0.0.0.0 0.0.0.0 Dialer 1
!
dialer-list 20 protocol ip permit
!
end

Configure

R1(NHS, Hub)

configure terminal
!
interface tunnel0
 ip address 172.16.0.1 255.255.255.0
 tunnel source 100.0.0.1
 tunnel mode gre multipoint
 !
 ip nhrp network-id 100
 ip nhrp map multicast dyanmic
 !
 ip ospf network broadcast
exit
!
router ospf 1
 network 172.16.0.1 0.0.0.0 area 0
 network 10.100.0.1 0.0.0.0 area 0
exit
!
end

R2(NHC, Spoke)

configure terminal
!
interface tunnel0
 ip address 172.16.0.2 255.255.255.0
 tunnel source 200.0.0.2
 tunnel mode gre multipoint
 !
 ip nhrp network-id 100
 ip nhrp nhs 172.16.0.1
 ip nhrp map 172.16.0.1 100.0.0.1
 ip nhrp map multicast 100.0.0.1
 !
 ip ospf network broadcast
 ip ospf priority 0
exit
!
router ospf 1
 network 172.16.0.2 0.0.0.0 area 0
 network 10.200.0.2 0.0.0.0 area 0
exit
!
end

R6(NHC, Spoke)

configure terminal
!
interface tunnel0
 ip address 172.16.0.6 255.255.255.0
 tunnel source 106.0.0.6
 tunnel mode gre multipoint
 !
 ip nhrp network-id 100
 ip nhrp nhs 172.16.0.1
 ip nhrp map 172.16.0.1 100.0.0.1
 ip nhrp map multicast 100.0.0.1
 !
 ip ospf network broadcast
 ip ospf priority 0
exit
!
router ospf 1
 network 172.16.0.6 0.0.0.0 area 0
 network 10.6.0.6 0.0.0.0 area 0
exit
!
end

Topology: DMVPN + OSPF

mGRE + NHRP + IPsec + OSPF

figure ip is messed

Preparation

Project name: ccna-vpn-gre-0003-gre-over-ipsec-1-n

~~Project name: ccna-vpn-dmvpn-0001-mgre+nhrp~~

R1

configure terminal
!
interface GigabitEthernet 0/1
no ip address
pppoe enable group global
pppoe-client dial-pool-number 10
exit
!
interface GigabitEthernet 0/0
ip tcp adjust-mss 1356
exit
!
interface Loopback 1
ip address 100.0.0.1 255.255.255.255
exit
!
interface Dialer 1
ip unnumbered Loopback 1
ip mtu 1454
encapsulation ppp
dialer pool 10
dialer-group 20
ppp authentication chap callin
ppp chap hostname ccie@example.com
ppp chap password cc13
no shutdown
exit
!
ip route 0.0.0.0 0.0.0.0 Dialer 1
!
dialer-list 20 protocol ip permit
!
end

R2

configure terminal
!
interface GigabitEthernet 0/1
no ip address
pppoe enable group global
pppoe-client dial-pool-number 10
exit
!
interface GigabitEthernet 0/0
ip tcp adjust-mss 1356
exit
!
interface Loopback 1
ip address 200.0.0.2 255.255.255.255
exit
!
interface Dialer 1
ip unnumbered Loopback 1
ip mtu 1454
encapsulation ppp
dialer pool 10
dialer-group 20
ppp authentication chap callin
ppp chap hostname ccie@example.com
ppp chap password cc13
no shutdown
exit
!
ip route 0.0.0.0 0.0.0.0 Dialer 1
!
dialer-list 20 protocol ip permit
!
end

R6

configure terminal
!
interface GigabitEthernet 0/1
no ip address
pppoe enable group global
pppoe-client dial-pool-number 10
exit
!
interface GigabitEthernet 0/0
ip tcp adjust-mss 1356
exit
!
interface Loopback 1
ip address 106.0.0.6 255.255.255.255
exit
!
interface Dialer 1
ip unnumbered Loopback 1
ip mtu 1454
encapsulation ppp
dialer pool 10
dialer-group 20
ppp authentication chap callin
ppp chap hostname ccie@isp3.pg1x.net
ppp chap password cc13
no shutdown
exit
!
ip route 0.0.0.0 0.0.0.0 Dialer 1
!
dialer-list 20 protocol ip permit
!
end

Configuration

R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#cry
R1(config)#crypto isakm
R1(config)#crypto isakmp po
R1(config)#crypto isakmp policy 1
R1(config-isakmp)#er
R1(config-isakmp)#enc
R1(config-isakmp)#encryption 3de
R1(config-isakmp)#encryption 3des 
*Apr 30 05:20:01.738: %PLATFORM-5-SIGNATURE_VERIFIED: Image 'flash0:/vios-adventerprisek9-m' passed code signing verification
R1(config-isakmp)#encryption 3des 
R1(config-isakmp)#ha
R1(config-isakmp)#hash md
R1(config-isakmp)#hash md5 
R1(config-isakmp)#auth
R1(config-isakmp)#authentication pre
R1(config-isakmp)#authentication pre-share 
R1(config-isakmp)#gr
R1(config-isakmp)#group 2
R1(config-isakmp)#cr
R1(config-isakmp)#cry
R1(config-isakmp)#cryp
R1(config-isakmp)#exit
R1(config)#cry
R1(config)#crypto isak
R1(config)#crypto isakmp ke
R1(config)#crypto isakmp kecis
R1(config)#crypto isakmp key  
R1(config)#crypto isakmp key cis
R1(config)#crypto isakmp key cisco address 0.0.0.0
R1(config)#cry
R1(config)#crypto isakm
R1(config)#crypto isakmp kee
R1(config)#crypto isakmp keepalive 30
R1(config)#cry
R1(config)#crypto ipse
R1(config)#crypto ipsec trans
R1(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp
R1(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp-md
R1(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp-md5-hmac 
R1(cfg-crypto-trans)#mod
R1(cfg-crypto-trans)#mode trans
R1(cfg-crypto-trans)#mode transport 
R1(cfg-crypto-trans)#exit
R1(config)#cry
R1(config)#crypto ip
R1(config)#crypto ipsec pro
R1(config)#crypto ipsec profile PRO-DMVPN1
R1(ipsec-profile)#set tra
R1(ipsec-profile)#set transform-set TS-IPSEC1
R1(ipsec-profile)#exit
R1(config)#int tun0
R1(config-if)#
*Apr 30 05:21:41.298: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down
R1(config-if)#exit
R1(config)#interface GigabitEthernet 0/1
R1(config-if)#no ip address
R1(config-if)#pppoe enable group global
R1(config-if)#pppoe-client dial-pool-number 10
R1(config-if)#exit
R1(config)#!
R1(config)#interface GigabitEthernet 0/0
R1(config-if)#ip tcp adjust-mss 1356
R1(config-if)#exit
R1(config)#!
R1(config)#interface Loopback 1
R1(config-if)#ip address 100.0.0.1 255.255.255.255
R1(config-if)#exit
R1(config)#
*Apr 30 05:22:19.367: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to up!
R1(config)#interface Dialer 1
R1(config-if)#ip unnumbered Loopback 1
R1(config-if)#ip mtu 1454
R1(config-if)#encapsulation ppp
R1(config-if)#dialer pool 10
R1(config-if)#dialer-group 20
R1(config-if)#ppp authentication chap callin
R1(config-if)#ppp chap hostname ccie@example.com
R1(config-if)#ppp chap password cc13
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#!
R1(config)#ip route 0.0.0.0 0.0.0.0 Dialer 1
R1(config)#!
R1(config)#dialer-list 20 protocol ip permit
R1(config)#
*Apr 30 05:22:19.374: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
R1(config)#
*Apr 30 05:22:20.608: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up
R1(config)#
*Apr 30 05:22:23.907: %DIALER-6-BIND: Interface Vi2 bound to profile Di1
*Apr 30 05:22:23.913: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
R1(config)#
*Apr 30 05:22:27.578: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up
R1(config)#int tun0
R1(config-if)#ip add
R1(config-if)#ip address 172.16.0.1 255.255.255.0
R1(config-if)#tunn
R1(config-if)#tunnel sou
R1(config-if)#tunnel source 100.0.0.1
R1(config-if)#tunn
R1(config-if)#tunnel mo
R1(config-if)#tunnel mode gr
R1(config-if)#tunnel mode gre mu
R1(config-if)#tunnel mode gre multipoint 
R1(config-if)#
*Apr 30 05:23:40.321: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up
R1(config-if)#tunn
R1(config-if)#tunnel ke
R1(config-if)#tunnel key ?
  <0-4294967295>  key

R1(config-if)#tunnel key 10
R1(config-if)#tunn
R1(config-if)#tunnel p
R1(config-if)#tunnel pr
R1(config-if)#tunnel protection ?
  ipsec  Use ipsec to protect this tunnel interface

R1(config-if)#tunnel protection ipse
R1(config-if)#tunnel protection ipsec pro
R1(config-if)#tunnel protection ipsec profile PRO-DMVPN1
R1(config-if)#ip
*Apr 30 05:24:06.952: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R1(config-if)#ip nhr
R1(config-if)#ip nhrp netwo
R1(config-if)#ip nhrp network-id 100
R1(config-if)#ip nhr
R1(config-if)#ip nhrp ma
R1(config-if)#ip nhrp map mul
R1(config-if)#ip nhrp map multicast dyn
R1(config-if)#ip nhrp map multicast dynamic 
R1(config-if)#ip os
R1(config-if)#ip ospf net
R1(config-if)#ip ospf network bro
R1(config-if)#ip ospf network broadcast 
R1(config-if)#router ospf 1
R1(config-router)#netwo
R1(config-router)#network 172.16.0.1 0.0.0.0 area 0
R1(config-router)#netow
R1(config-router)#netwo
R1(config-router)#network 10.100.0.1 0.0.0.0 area 0.0.0.0
R1(config-router)#
*Apr 30 05:29:36.515: %OSPF-5-ADJCHG: Process 1, Nbr 200.0.0.2 on Tunnel0 from LOADING to FULL, Loading Done
R1(config-router)#
*Apr 30 05:36:53.851: %OSPF-5-ADJCHG: Process 1, Nbr 106.0.0.6 on Tunnel0 from LOADING to FULL, Loading Done
R1(config-router)#
*Apr 30 05:37:23.294: %OSPF-5-ADJCHG: Process 1, Nbr 106.0.0.6 on Tunnel0 from LOADING to FULL, Loading Done

R2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R2(config)#
*Apr 30 05:20:02.197: %PLATFORM-5-SIGNATURE_VERIFIED: Image 'flash0:/vios-adventerprisek9-m' passed code signing verification
R2(config)#interface GigabitEthernet 0/1
R2(config-if)#no ip address
R2(config-if)#pppoe enable group global
R2(config-if)#pppoe-client dial-pool-number 10
R2(config-if)#exit
R2(config)#!
R2(config)#interface GigabitEthernet 0/0
R2(config-if)#ip tcp adjust-mss 1356
R2(config-if)#exit
R2(config)#!
R2(config)#interface Loopback 1
R2(config-if)#ip address 200.0.0.2 255.255.255.255
*Apr 30 05:22:31.533: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to up
R2(config-if)#exit
R2(config)#!
R2(config)#interface Dialer 1
R2(config-if)#ip unnumbered Loopback 1
R2(config-if)#ip mtu 1454
R2(config-if)#encapsulation ppp
R2(config-if)#dialer pool 10
R2(config-if)#dialer-group 20
R2(config-if)#ppp authentication chap callin
R2(config-if)#ppp chap hostname ccie@example.com
R2(config-if)#ppp chap password cc13
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#!
R2(config)#ip route 0.0.0.0 0.0.0.0 Dialer 1
R2(config)#!
R2(config)#dialer-list 20 protocol ip permit
R2(config)#
*Apr 30 05:22:31.540: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
R2(config)#
*Apr 30 05:22:32.746: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up
R2(config)#
*Apr 30 05:22:35.920: %DIALER-6-BIND: Interface Vi2 bound to profile Di1
*Apr 30 05:22:35.925: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
R2(config)#
*Apr 30 05:22:39.598: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up
R2(config)#cry
R2(config)#crypto isakm
R2(config)#crypto isakmp po
R2(config)#crypto isakmp policy 1
R2(config-isakmp)#enc
R2(config-isakmp)#encryption 3des 
R2(config-isakmp)#has
R2(config-isakmp)#hash md
R2(config-isakmp)#hash md5 
R2(config-isakmp)#aut
R2(config-isakmp)#authentication pre
R2(config-isakmp)#authentication pre-share 
R2(config-isakmp)#gor
R2(config-isakmp)#gr 
R2(config-isakmp)#group 2
R2(config-isakmp)#exit
R2(config)#cry
R2(config)#crypto isakm
R2(config)#crypto isakmp key
R2(config)#crypto isakmp key cisco address 0.0.0.0
R2(config)#cry
R2(config)#crypto isakm
R2(config)#crypto isakmp kee
R2(config)#crypto isakmp keepalive 30
R2(config)#cry
R2(config)#crypto ipse
R2(config)#crypto ipsec trans
R2(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp-md5-hmac
R2(cfg-crypto-trans)#mode
R2(cfg-crypto-trans)#mode tra
R2(cfg-crypto-trans)#mode transport 
R2(cfg-crypto-trans)#exit
R2(config)#cry
R2(config)#crypto ipse
R2(config)#crypto ipsec pro
R2(config)#crypto ipsec profile PRO-DMVPN1
R2(ipsec-profile)#set tran
R2(ipsec-profile)#set transform-set TS-IPSEC1
R2(ipsec-profile)#int tun0
R2(config-if)#ip ad
*Apr 30 05:27:32.893: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down
R2(config-if)#ip add
R2(config-if)#ip address 172.16.0.2 255.255.255.0
R2(config-if)#tun
R2(config-if)#tunnel so
R2(config-if)#tunnel source 200.0.0.2
R2(config-if)#tunn
R2(config-if)#tunnel mo
R2(config-if)#tunnel mode gr
R2(config-if)#tunnel mode gre mu
R2(config-if)#tunnel mode gre multipoint 
R2(config-if)#tunn
R2(config-if)#tunnel ke
R2(config-if)#tunnel key 10
R2(config-if)#tunn
R2(config-if)#tunnel p
R2(config-if)#tunnel pr
R2(config-if)#tunnel protection 
*Apr 30 05:28:01.916: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up
R2(config-if)#tunnel protection ipse
R2(config-if)#tunnel protection ipsec pro
R2(config-if)#tunnel protection ipsec profile PRO-DMVPN1
R2(config-if)#
*Apr 30 05:28:15.230: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R2(config-if)#ip nhrp netwo
R2(config-if)#ip nhrp network-id 100
R2(config-if)#ip nhr
R2(config-if)#ip nhrp nhs 172.16.0.1
R2(config-if)#ip nhr
R2(config-if)#ip nhrp map 172.16.0.1 100.0.0.1
R2(config-if)#ip nh
R2(config-if)#ip nhrp ma
R2(config-if)#ip nhrp map
R2(config-if)#ip nhrp map mut
R2(config-if)#ip nhrp map mul,
R2(config-if)#ip nhrp map mul 
R2(config-if)#ip nhrp map multicast 100.0.0.1
R2(config-if)#ip os
R2(config-if)#ip ospf netwo
R2(config-if)#ip ospf network bro
R2(config-if)#ip ospf network broadcast 
R2(config-if)#ip osp
R2(config-if)#ip ospf pri
R2(config-if)#ip ospf priority 0
R2(config-if)#router ospf 1
R2(config-router)#netw  
R2(config-router)#network 172.16.0.2 0.0.0.0 area 0.0.0.0
R2(config-router)#netow
*Apr 30 05:29:38.381: %OSPF-5-ADJCHG: Process 1, Nbr 100.0.0.1 on Tunnel0 from LOADING to FULL, Loading Done
R2(config-router)#netwo
R2(config-router)#network 10.200.0.2 0.0.0.0 area 0
R2(config-router)#^Z 
R2#sh ip ro 
*Apr 30 05:30:05.235: %SYS-5-CONFIG_I: Configured from console by console
R2#sh ip ro ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

      10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
O        10.100.0.0/24 [110/1001] via 172.16.0.1, 00:00:25, Tunnel0
R2#ping 10.100.0.101
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.100.0.101, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 13/15/21 ms

R6#
R6#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R6(config)#
*Apr 30 05:20:04.198: %PLATFORM-5-SIGNATURE_VERIFIED: Image 'flash0:/vios-adventerprisek9-m' passed code signing verification
R6(config)#interface GigabitEthernet 0/1
R6(config-if)#no ip address
R6(config-if)#pppoe enable group global
R6(config-if)#pppoe-client dial-pool-number 10
R6(config-if)#exit
R6(config)#!
R6(config)#interface GigabitEthernet 0/0
R6(config-if)#ip tcp adjust-m
*Apr 30 05:22:45.571: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to upss 1356
R6(config-if)#exit
R6(config)#!
R6(config)#interface Loopback 1
R6(config-if)#ip address 106.0.0.6 255.255.255.255
R6(config-if)#exit
R6(config)#!
R6(config)#interface Dialer 1
R6(config-if)#ip unnumbered Loopback 1
R6(config-if)#ip mtu 1454
R6(config-if)#encapsulation ppp
R6(config-if)#dialer pool 10
R6(config-if)#dialer-group 20
R6(config-if)#ppp authentication chap callin
R6(config-if)#ppp chap hostname ccie@isp3.pg1x.net
R6(config-if)#ppp chap password cc13
R6(config-if)#no shutdown
R6(config-if)#exit
R6(config)#!
R6(config)#ip route 0.0.0.0 0.0.0.0 Dialer 1
R6(config)#!
R6(config)#dialer-list 20 protocol ip permit
R6(config)#
*Apr 30 05:22:45.578: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
R6(config)#
*Apr 30 05:22:46.852: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up
R6(config)#
*Apr 30 05:22:50.065: %DIALER-6-BIND: Interface Vi2 bound to profile Di1
*Apr 30 05:22:50.071: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
R6(config)#
*Apr 30 05:22:54.135: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up
R6(config)#cry
R6(config)#crypto i
R6(config)#crypto isa
R6(config)#crypto isakmp poli
R6(config)#crypto isakmp policy 1
R6(config-isakmp)#ecn 
R6(config-isakmp)#enc 
R6(config-isakmp)#en         
R6(config-isakmp)#e          
R6(config-isakmp)#e
R6(config-isakmp)#e
R6(config-isakmp)#e
R6(config-isakmp)#en
R6(config-isakmp)#encryption 3de
R6(config-isakmp)#encryption 3des 
R6(config-isakmp)#ha
R6(config-isakmp)#hash md
R6(config-isakmp)#hash md5 
R6(config-isakmp)#aut
R6(config-isakmp)#authentication pre
R6(config-isakmp)#authentication pre-share 
R6(config-isakmp)#gro
R6(config-isakmp)#group 2
R6(config-isakmp)#cry
R6(config-isakmp)#exit
R6(config)#cry
R6(config)#crypto isak
R6(config)#crypto isakmp ke
R6(config)#crypto isakmp key
R6(config)#crypto isakmp key cis
R6(config)#crypto isakmp key cisc
R6(config)#crypto isakmp key cisco addre
R6(config)#crypto isakmp key cisco address ?
  A.B.C.D  Peer IP address
  ipv6     define shared key with IPv6 address

R6(config)#crypto isakmp key cisco address 0.0.0.0
R6(config)#cry
R6(config)#crypto i
R6(config)#crypto isa
R6(config)#crypto isakmp kee
R6(config)#crypto isakmp keepalive 30
R6(config)#cry
R6(config)#crypto ipse
R6(config)#crypto ipsec tra
R6(config)#crypto ipsec transform-set TS-IPSEC1 es
R6(config)#crypto ipsec transform-set TS-IPSEC1 esp-3
R6(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des es
R6(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp-md
R6(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp-md5-hmac 
R6(cfg-crypto-trans)#mod
R6(cfg-crypto-trans)#mode tra
R6(cfg-crypto-trans)#mode transport 
R6(cfg-crypto-trans)#exit
R6(config)#cry
R6(config)#crypto ip
R6(config)#crypto ipsec pro
R6(config)#crypto ipsec profile PRO-DMVPN1
R6(ipsec-profile)#set tra
R6(ipsec-profile)#set transform-set TS-IPSEC1
R6(ipsec-profile)#int tun0
R6(config-if)#ip add
R6(config-if)#ip address 
*Apr 30 05:32:56.786: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down
R6(config-if)#ip address 172.16.0.6 255.255.255.0
R6(config-if)#tunn
R6(config-if)#tunnel so
R6(config-if)#tunnel source 106.0.0.6
R6(config-if)#tunn
R6(config-if)#tunnel m
R6(config-if)#tunnel mo
R6(config-if)#tunnel mode gr
R6(config-if)#tunnel mode gre mu
R6(config-if)#tunnel mode gre multipoint 
R6(config-if)#tunn
R6(config-if)#tunnel ke
R6(config-if)#tunnel key 10
R6(config-if)#tunn
R6(config-if)#tunnel pro
R6(config-if)#tunnel protection 
*Apr 30 05:35:45.806: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up
R6(config-if)#tunnel protection ipse
R6(config-if)#tunnel protection ipsec pro
R6(config-if)#tunnel protection ipsec profile PRO-DMVPN1
R6(config-if)#ip nh
R6(config-if)#ip nhrp 
*Apr 30 05:35:54.517: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R6(config-if)#ip nhrp netwo
R6(config-if)#ip nhrp network-id 100
R6(config-if)#ip nh
R6(config-if)#ip nhrp nhs 172.16.0.1
R6(config-if)#ip nhr
R6(config-if)#ip nhrp map 172.16.0.1 100.0.0.1
R6(config-if)#ip nh
R6(config-if)#ip nhrp map
R6(config-if)#ip nhrp map mul
R6(config-if)#ip nhrp map multicast 100.0.0.1
R6(config-if)#ip os
R6(config-if)#ip ospf pri
R6(config-if)#ip ospf priority 0
R6(config-if)#rou
R6(config-if)#router ospf 1
R6(config-router)#netwo
R6(config-router)#network 172.16.0.6 0.0.0.0 area 0
R6(config-router)#net
*Apr 30 05:36:55.188: %OSPF-4-NET_TYPE_MISMATCH: Received Hello from 100.0.0.1 on Tunnel0 indicating a  potential 
             network type mismatch
R6(config-router)#netwo
R6(config-router)#network 
*Apr 30 05:36:55.267: %OSPF-5-ADJCHG: Process 1, Nbr 100.0.0.1 on Tunnel0 from LOADING to FULL, Loading Done
R6(config-router)#int tun0
R6(config-if)#ip os
R6(config-if)#ip ospf netwo
R6(config-if)#ip ospf network bro
R6(config-if)#ip ospf network broadcast 
R6(config-if)#
*Apr 30 05:37:24.595: %OSPF-5-ADJCHG: Process 1, Nbr 100.0.0.1 on Tunnel0 from FULL to DOWN, Neighbor Down: Interface down or detached
*Apr 30 05:37:24.689: %OSPF-5-ADJCHG: Process 1, Nbr 100.0.0.1 on Tunnel0 from LOADING to FULL, Loading Done
R6(config-if)#router ospf 1
R6(config-router)#netwo
R6(config-router)#knetwonetwork 172.16.0.6
R6(config-router)#netwo                   
R6(config-router)#network 10.6.0.6 0.0.0.0 area
R6(config-router)#network 10.6.0.6 0.0.0.0 area 0
R6(config-router)#^Z
R6#sh ip 
*Apr 30 05:38:09.275: %SYS-5-CONFIG_I: Configured from console by console
R6#sh ip ro ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

      10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
O        10.100.0.0/24 [110/1001] via 172.16.0.1, 00:00:43, Tunnel0
O        10.200.0.0/24 [110/1001] via 172.16.0.2, 00:00:43, Tunnel0
R6#ping 172.16.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/14/19 ms
R6#ping 172.16.0.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/54/79 ms
R6#ping 10.100.0.101
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.100.0.101, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 13/262/1010 ms
R6#ping 10.100.0.101
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.100.0.101, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/17/23 ms
R6#ping 10.200.0.202
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.200.0.202, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/16/24 ms

Topology: PPPoE + DMVPN + OSPF

PPPoE + mGRE + NHRP + IPsec + OSPF

figure ip is messed

Preparation

Project name: ccna-vpn-gre-0003-gre-over-ipsec-1-n

~~Project name: ccna-vpn-dmvpn-0001-mgre+nhrp~~

Configuration

R1

configure terminal
!
interface GigabitEthernet 0/1
no ip address
pppoe enable group global
pppoe-client dial-pool-number 10
exit
!
interface GigabitEthernet 0/0
ip tcp adjust-mss 1356
exit
!
interface Loopback 1
ip address 100.0.0.1 255.255.255.255
exit
!
interface Dialer 1
ip unnumbered Loopback 1
ip mtu 1454
encapsulation ppp
dialer pool 10
dialer-group 20
ppp authentication chap callin
ppp chap hostname ccie@example.com
ppp chap password cc13
no shutdown
exit
!
ip route 0.0.0.0 0.0.0.0 Dialer 1
!
dialer-list 20 protocol ip permit
!
end

R2

configure terminal
!
interface GigabitEthernet 0/1
no ip address
pppoe enable group global
pppoe-client dial-pool-number 10
exit
!
interface GigabitEthernet 0/0
ip tcp adjust-mss 1356
exit
!
interface Loopback 1
ip address 200.0.0.2 255.255.255.255
exit
!
interface Dialer 1
ip unnumbered Loopback 1
ip mtu 1454
encapsulation ppp
dialer pool 10
dialer-group 20
ppp authentication chap callin
ppp chap hostname ccie@example.com
ppp chap password cc13
no shutdown
exit
!
ip route 0.0.0.0 0.0.0.0 Dialer 1
!
dialer-list 20 protocol ip permit
!
end

R6

configure terminal
!
interface GigabitEthernet 0/1
no ip address
pppoe enable group global
pppoe-client dial-pool-number 10
exit
!
interface GigabitEthernet 0/0
ip tcp adjust-mss 1356
exit
!
interface Loopback 1
ip address 106.0.0.6 255.255.255.255
exit
!
interface Dialer 1
ip unnumbered Loopback 1
ip mtu 1454
encapsulation ppp
dialer pool 10
dialer-group 20
ppp authentication chap callin
ppp chap hostname ccie@isp3.pg1x.net
ppp chap password cc13
no shutdown
exit
!
ip route 0.0.0.0 0.0.0.0 Dialer 1
!
dialer-list 20 protocol ip permit
!
end

R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#cry
R1(config)#crypto iksa
R1(config)#crypto iksak
R1(config)#cryp        
R1(config)#crypto isakm
R1(config)#crypto isakmp poli
R1(config)#crypto isakmp policy 1
R1(config-isakmp)#ecn
R1(config-isakmp)#en 
R1(config-isakmp)#encryption 3de
R1(config-isakmp)#encryption 3des 
R1(config-isakmp)#ha
R1(config-isakmp)#hash md
R1(config-isakmp)#hash md5 atu
R1(config-isakmp)#hash md5    
R1(config-isakmp)#auth
R1(config-isakmp)#authentication pre
R1(config-isakmp)#authentication pre-share 
R1(config-isakmp)#gro
R1(config-isakmp)#group 2
R1(config-isakmp)#exit
R1(config)#crypto
R1(config)#crypto isakm
R1(config)#crypto isakmp key cisco address 0.0.0.0
R1(config)#crypto isakm
R1(config)#crypto isakmp kee
R1(config)#crypto isakmp keepalive 30
R1(config)#cryp
R1(config)#crypto isakm
R1(config)#cryp          
R1(config)#crypto ipse
R1(config)#crypto ipsec trans
R1(config)#crypto ipsec transform-set TS-IPSEC1 esp-3de
R1(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp-md
R1(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp-md5-hmac 
R1(cfg-crypto-trans)#mod
R1(cfg-crypto-trans)#mode tran
R1(cfg-crypto-trans)#mode transport 
R1(cfg-crypto-trans)#exit
R1(config)#cry
R1(config)#crypto ipse
R1(config)#crypto ipsec pro
R1(config)#crypto ipsec profile PRO-DMVPN1
R1(ipsec-profile)#set tra
R1(ipsec-profile)#set transform-set TS-IPSEC1
R1(ipsec-profile)#int tun0
R1(config-if)#ip
*Apr 30 06:38:51.897: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down
R1(config-if)#ip addre
R1(config-if)#ip address 172.16.0.1 255.255.255.0
R1(config-if)#ip mt
R1(config-if)#ip mtu 1368
R1(config-if)#tunn
R1(config-if)#tunnel sou
R1(config-if)#tunnel source Di
R1(config-if)#tunnel source Dialer 1
R1(config-if)#tunn
R1(config-if)#tunnel mo
R1(config-if)#tunnel mode gr
R1(config-if)#tunnel mode gre mu
R1(config-if)#tunnel mode gre multipoint 
R1(config-if)#tunn
R1(config-if)#tunnel ke
R1(config-if)#tunnel key 10
R1(config-if)#tunn
R1(config-if)#tunnel p
R1(config-if)#tunnel pr
R1(config-if)#tunnel protection ipse
R1(config-if)#tunnel protection ipsec pro
R1(config-if)#tunnel protection ipsec profile PRO-DMVPN1
R1(config-if)#ip nh
R1(config-if)#ip nhrp netwo
R1(config-if)#ip nhrp network-id 100
R1(config-if)#ip nh
R1(config-if)#ip nhrp map mul
R1(config-if)#ip nhrp map multicast ?
  A.B.C.D     IP NBMA address
  X:X:X:X::X  IPv6 NBMA address
  dynamic     Dynamically learn destinations from client registrations on hub

R1(config-if)#ip nhrp map multicast dyn
R1(config-if)#ip nhrp map multicast dynamic 
R1(config-if)#ip os
R1(config-if)#ip ospf netwo
R1(config-if)#ip ospf network bro
R1(config-if)#ip ospf network broadcast 
R1(config-if)#router
R1(config-if)#router osp
R1(config-if)#router ospf 1
R1(config-router)#netwo
R1(config-router)#network 172.16.0.1 0.0.0.0 area 0
R1(config-router)#netwo
R1(config-router)#network 10.100.0.1 0.0.0.0 area
R1(config-router)#network 10.100.0.1 0.0.0.0 area 0
R1(config-router)#int lo0
R1(config-if)#ip add
R1(config-if)#ip address 1
*Apr 30 06:40:48.694: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
R1(config-if)#ip address 100.0.0.1
% Incomplete command.

R1(config-if)#ip address 100.0.0.1 255.255.255.255
R1(config-if)#int gig0/1
R1(config-if)#no ip add
R1(config-if)#no ip address 
R1(config-if)#pppoe
R1(config-if)#pppoe en
R1(config-if)#pppoe enable 
R1(config-if)#ppp
*Apr 30 06:41:34.894: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to up
R1(config-if)#pppoe
*Apr 30 06:41:34.898: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
R1(config-if)#pppoe
R1(config-if)#pppoe-cli
R1(config-if)#pppoe-client di
R1(config-if)#pppoe-client dial-pool-number 1
R1(config-if)#int gig0/0
R1(config-if)#ip add
R1(config-if)#ip address 10.100.0.1 255.255.255.0
R1(config-if)#ip tc
R1(config-if)#ip tcp ad
R1(config-if)#ip tcp adjust-mss 1328
R1(config-if)#no shut
R1(config-if)#int gig0/1
R1(config-if)#no shut
R1(config-if)#int di
R1(config-if)#int dia1
R1(config-if)#ip unnu
R1(config-if)#ip unnumbered Loo
R1(config-if)#ip unnumbered Loopback 0
R1(config-if)#
*Apr 30 06:42:36.551: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up
R1(config-if)#
*Apr 30 06:42:36.608: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R1(config-if)#ip mt
R1(config-if)#ip mtu 1454
R1(config-if)#enca
R1(config-if)#encapsulation ppp
R1(config-if)#dia
R1(config-if)#dialerpo
R1(config-if)#dialer pooo
R1(config-if)#dialer poo 
R1(config-if)#dialer pool 1
R1(config-if)#dia
R1(config-if)#dialer-g
R1(config-if)#dialer-group r
R1(config-if)#dialer-group r
*Apr 30 06:43:04.833: %DIALER-6-BIND: Interface Vi2 bound to profile Di1
*Apr 30 06:43:04.837: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
*Apr 30 06:43:06.896: %DIALER-6-UNBIND: Interface Vi2 unbound from profile Di1
R1(config-if)#dialer-group  
*Apr 30 06:43:06.914: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to down
R1(config-if)#dialer-group 1
R1(config-if)#ppp auth
R1(config-if)#ppp authe
R1(config-if)#ppp authentication chap calli
R1(config-if)#ppp authentication chap callin 
R1(config-if)#ppp chap hostna
R1(config-if)#ppp chap hostname ccie@example.com
*Apr 30 06:43:29.144: %DIALER-6-BIND: Interface Vi2 bound to profile Di1
*Apr 30 06:43:29.148: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
*Apr 30 06:43:29.261: %DIALER-6-UNBIND: Interface Vi2 unbound from profile Di1
R1(config-if)#ppp chap hostname ccie@example.com
*Apr 30 06:43:29.278: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to down
R1(config-if)#ppp chap pass
R1(config-if)#ppp chap password cc13
R1(config-if)#exit  
R1(config)#ip route 0.0.0.0 0.0.0.0 D
*Apr 30 06:43:51.470: %DIALER-6-BIND: Interface Vi2 bound to profile Di1ia
R1(config)#ip route 0.0.0.0 0.0.0.0 Dialer 1
*Apr 30 06:43:51.475: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
*Apr 30 06:43:52.012: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up
R1(config)#ip route 0.0.0.0 0.0.0.0 Dialer 1
R1(config)#dia
R1(config)#dialer-li
R1(config)#dialer-list 1 pro
R1(config)#dialer-list 1 protocol ip per
R1(config)#dialer-list 1 protocol ip permit 
R1(config)#^Z
R1#
*Apr 30 06:44:09.301: %SYS-5-CONFIG_I: Configured from console by console
R1#ping 100.1.3.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 100.1.3.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/4/8 ms
R1#ping 35.0.0.5 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 35.0.0.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/7/11 ms
R1#
*Apr 30 06:55:40.644: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.2 on Tunnel0 from EXSTART to DOWN, Neighbor Down: Too many retransmissions
R1#
*Apr 30 06:56:40.645: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.2 on Tunnel0 from DOWN to DOWN, Neighbor Down: Ignore timer expired
R1#ping 172.16.0.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 15/17/20 ms
R1#sh run int tun0
Building configuration...

Current configuration : 284 bytes
!
interface Tunnel0
 ip address 172.16.0.1 255.255.255.0
 no ip redirects
 ip mtu 1368
 ip nhrp map multicast dynamic
 ip nhrp network-id 100
 ip ospf network broadcast
 tunnel source Dialer1
 tunnel mode gre multipoint
 tunnel key 10
 tunnel protection ipsec profile PRO-DMVPN1
end

R1#
*Apr 30 06:58:46.830: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.2 on Tunnel0 from EXSTART to DOWN, Neighbor Down: Too many retransmissions
R1#sh ip proto
*** IP Routing is NSF aware ***

Routing Protocol is "application"
  Sending updates every 0 seconds
  Invalid after 0 seconds, hold down 0, flushed after 0
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Maximum path: 32
  Routing for Networks:
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: (default is 4)

Routing Protocol is "nhrp"
  Maximum path: 32
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: (default is 250)

Routing Protocol is "ospf 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Router ID 172.16.0.1
  Number of areas in this router is 1. 1 normal 0 stub 0 nssa
  Maximum path: 4
  Routing for Networks:
    10.100.0.1 0.0.0.0 area 0
    172.16.0.1 0.0.0.0 area 0
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: (default is 110)

R1#
*Apr 30 06:59:46.831: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.2 on Tunnel0 from DOWN to DOWN, Neighbor Down: Ignore timer expired
R1#sh ip int tun0 | i Internet
  Internet address is 172.16.0.1/24
R1#
*Apr 30 07:01:57.996: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.2 on Tunnel0 from EXSTART to DOWN, Neighbor Down: Too many retransmissions
R1#sh ip int tun0 | i MTU
  MTU is 1368 bytes
R1#sh ip ospf neigh detail
 Neighbor 172.16.0.2, interface address 172.16.0.2
    In the area 0 via interface Tunnel0
    Neighbor priority is 0, State is DOWN, 4 state changes
    Neighbor ignored, reenable in 00:00:15
    DR is 0.0.0.0 BDR is 0.0.0.0
    Options is 0x12 in Hello (E-bit, L-bit)
    LLS Options is 0x1 (LR)
    Index 0/0/0, retransmission queue length 0, number of retransmission 0
    First 0x0(0)/0x0(0)/0x0(0) Next 0x0(0)/0x0(0)/0x0(0)
    Last retransmission scan length is 0, maximum is 0
    Last retransmission scan time is 0 msec, maximum is 0 msec
R1#
*Apr 30 07:02:57.997: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.2 on Tunnel0 from DOWN to DOWN, Neighbor Down: Ignore timer expired
R1#
*Apr 30 07:05:06.765: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.2 on Tunnel0 from EXSTART to DOWN, Neighbor Down: Too many retransmissions
R1#
*Apr 30 07:06:06.766: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.2 on Tunnel0 from DOWN to DOWN, Neighbor Down: Ignore timer expired
*Apr 30 07:06:07.011: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.2 on Tunnel0 from LOADING to FULL, Loading Done
R1#
*Apr 30 07:54:09.586: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.6 on Tunnel0 from LOADING to FULL, Loading Done
R1#

R2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R2(config)#cry
R2(config)#crypto isak
R2(config)#crypto isakmp po
R2(config)#crypto isakmp policy 1 
R2(config-isakmp)#enc
R2(config-isakmp)#encryption  3de
R2(config-isakmp)#encryption  3des 
R2(config-isakmp)#ha
R2(config-isakmp)#hash md
R2(config-isakmp)#hash md5 
R2(config-isakmp)#auth
R2(config-isakmp)#authentication pre
R2(config-isakmp)#authentication pre-share 
R2(config-isakmp)#gr
R2(config-isakmp)#group 2
R2(config-isakmp)#cry
R2(config-isakmp)#cryp
R2(config-isakmp)#exit
R2(config)#cry
R2(config)#crypto isak
R2(config)#crypto isakmp ke
R2(config)#crypto isakmp key
R2(config)#crypto isakmp key cisco address 0.0.0.0
R2(config)#cry
R2(config)#crypto isak
R2(config)#crypto isakmp kee
R2(config)#crypto isakmp keepalive 30
R2(config)#cry
R2(config)#crypto ipse
R2(config)#crypto ipsec tran
R2(config)#crypto ipsec transform-set TS-IPSEC1 esp
R2(config)#crypto ipsec transform-set TS-IPSEC1 esp-3de
R2(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des es
R2(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp-md
R2(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp-md5-hmac h
R2(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp-md5-hmac  
R2(cfg-crypto-trans)#mod
R2(cfg-crypto-trans)#mode tra
R2(cfg-crypto-trans)#mode transport 
R2(cfg-crypto-trans)#exit
R2(config)#cry
R2(config)#crypto ipse
R2(config)#crypto ipsec pro
R2(config)#crypto ipsec profile PRO-DMVPN1
R2(ipsec-profile)#set tra
R2(ipsec-profile)#set transform-set TS-IPSEC1
R2(ipsec-profile)#int tun0 
R2(config-if)#ip 
*Apr 30 06:46:40.154: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down
R2(config-if)#ip add
R2(config-if)#ip address 172.16.0.2 255.255.255.0
R2(config-if)#tunn
R2(config-if)#tunnel saou
R2(config-if)#tunnel sou 
R2(config-if)#tunnel source Dia
R2(config-if)#tunnel source Dialer 1
R2(config-if)#tunn
R2(config-if)#tunnel mo
R2(config-if)#tunnel mode gr
R2(config-if)#tunnel mode gre mul
R2(config-if)#tunnel mode gre multipoint 
R2(config-if)#tunn
R2(config-if)#tunnel ke
R2(config-if)#tunnel key 10
R2(config-if)#tunn
R2(config-if)#tunnel pro
R2(config-if)#tunnel protection ip
R2(config-if)#tunnel protection ipsec pro
R2(config-if)#tunnel protection ipsec profile PRO-DMVPN1
R2(config-if)#ip nh
R2(config-if)#ip nhrp netow
R2(config-if)#ip nh        
R2(config-if)#ip nhrp netwo
R2(config-if)#ip nhrp network-id 100
R2(config-if)#ip nh
R2(config-if)#ip nhrp nhs 172.16.0.1
R2(config-if)#ip nh
R2(config-if)#ip nhrp map 172.16.0.1 100.0.0.1
R2(config-if)#ip nhr
R2(config-if)#ip nhrp ma
R2(config-if)#ip nhrp map
R2(config-if)#ip nhrp map mul
R2(config-if)#ip nhrp map multicast 100.0.0.1
R2(config-if)#ip os
R2(config-if)#ip ospf netwo
R2(config-if)#ip ospf network bro
R2(config-if)#ip ospf network broadcast 
R2(config-if)#ip os
R2(config-if)#ip ospf pri
R2(config-if)#ip ospf priority 0
R2(config-if)#router ospf 1 
R2(config-router)#netwo
R2(config-router)#network 172.16.0.2 0.0.0.0 area 0
R2(config-router)#netwo
R2(config-router)#network 10.200.0.2 0.0.0.0 area 0
R2(config-router)#int lo0
R2(config-if)#ip add
R2(config-if)#ip address 1
*Apr 30 06:50:22.469: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
R2(config-if)#ip address 200.0.0.2 255.255.255.255
R2(config-if)#int gig0/1
R2(config-if)#no ip addre
R2(config-if)#no ip address       
R2(config-if)#pppoe ena
R2(config-if)#pppoe enable 
R2(config-if)#pp
*Apr 30 06:50:54.101: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to up
R2(config-if)#pppoe-
*Apr 30 06:50:54.104: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
R2(config-if)#pppoe-clie
R2(config-if)#pppoe-client dial
R2(config-if)#pppoe-client dial-pool-number 1
R2(config-if)#int gig0/0
R2(config-if)#ip add
R2(config-if)#ip address 10.200.0.2 255.255.255.0  
R2(config-if)#ip tc
R2(config-if)#ip tcp ad
R2(config-if)#ip tcp adjust-mss 1328
R2(config-if)#int dia1
R2(config-if)#ip unnu
R2(config-if)#ip unnumbered lo0
R2(config-if)#
*Apr 30 06:52:25.082: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up
R2(config-if)#ip 
*Apr 30 06:52:25.141: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R2(config-if)#ip mt
R2(config-if)#ip mtu 1454
R2(config-if)#enca
R2(config-if)#encapsulation ppp
R2(config-if)#dia
R2(config-if)#dialer po
R2(config-if)#dialer pool 1
R2(config-if)#dia
R2(config-if)#dialer-gr
R2(config-if)#dialer-group 
*Apr 30 06:52:44.791: %DIALER-6-BIND: Interface Vi2 bound to profile Di1
*Apr 30 06:52:44.795: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
*Apr 30 06:52:46.591: %DIALER-6-UNBIND: Interface Vi2 unbound from profile Di1
R2(config-if)#dialer-group 
*Apr 30 06:52:46.605: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to down
R2(config-if)#dialer-group 1
R2(config-if)#ppp auth
R2(config-if)#ppp authe
R2(config-if)#ppp authentication chap calli
R2(config-if)#ppp authentication chap callin 
R2(config-if)#ppp chap hostname ccie@example.com
R2(config-if)#
*Apr 30 06:53:08.836: %DIALER-6-BIND: Interface Vi2 bound to profile Di1
*Apr 30 06:53:08.839: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
*Apr 30 06:53:08.945: %DIALER-6-UNBIND: Interface Vi2 unbound from profile Di1
R2(config-if)#
*Apr 30 06:53:08.965: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to down
R2(config-if)#ppp chap pass
R2(config-if)#ppp chap password cc13
R2(config-if)#exit
R2(config)#ip route 0.0.0.0 0.0.0.0 Dia
R2(config)#ip route 0.0.0.0 0.0.0.0 Dialer 1
R2(config)#
*Apr 30 06:53:31.117: %DIALER-6-BIND: Interface Vi2 bound to profile Di1
R2(config)#diale
*Apr 30 06:53:31.121: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
*Apr 30 06:53:31.686: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up
R2(config)#dialer
R2(config)#dialer-li
R2(config)#dialer-list 1 pro
R2(config)#dialer-list 1 protocol ip per
R2(config)#dialer-list 1 protocol ip permit 
R2(config)#^Z
R2#sh i
*Apr 30 06:53:41.892: %SYS-5-CONFIG_I: Configured from console by console
R2#sh ip ro ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

R2#ping 200.2.4.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 200.2.4.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/6/16 ms
R2#ping 100.0.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 100.0.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/10 ms
R2#sh ip ro
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

S*    0.0.0.0/0 is directly connected, Dialer1
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.200.0.0/24 is directly connected, GigabitEthernet0/0
L        10.200.0.2/32 is directly connected, GigabitEthernet0/0
      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.16.0.0/24 is directly connected, Tunnel0
L        172.16.0.2/32 is directly connected, Tunnel0
      200.0.0.0/32 is subnetted, 1 subnets
C        200.0.0.2 is directly connected, Loopback0
      200.2.4.0/32 is subnetted, 1 subnets
C        200.2.4.4 is directly connected, Dialer1
R2#sh ip ro ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

R2#sh ip ospf neigh
R2#sh ip ospf neighbor 

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.0.1        1   EXSTART/DR      00:00:37    172.16.0.1      Tunnel0
R2#sh ip ospf neighbor 

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.0.1        1   EXSTART/DR      00:00:35    172.16.0.1      Tunnel0
R2#sh ip ospf neighbor 

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.0.1        1   EXSTART/DR      00:00:39    172.16.0.1      Tunnel0
R2#sh ip ospf neighbor 

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.0.1        1   EXSTART/DR      00:00:39    172.16.0.1      Tunnel0
R2#sh ip ospf neighbor 

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.0.1        1   EXSTART/DR      00:00:38    172.16.0.1      Tunnel0
R2#sh ip ospf neighbor 

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.0.1        1   EXSTART/DR      00:00:37    172.16.0.1      Tunnel0
R2#sh ip ospf neighbor 

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.0.1        1   EXSTART/DR      00:00:36    172.16.0.1      Tunnel0
R2#sh ipse
R2#sh ip i
*Apr 30 06:55:42.979: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.1 on Tunnel0 from EXSTART to DOWN, Neighbor Down: Too many retransmissions
R2#sh ip ipse
R2#sh ip ipsec
R2#sh ipse    
R2#sh ipse
R2#sh ipse
R2#sh cry 
R2#sh crypto ip
R2#sh crypto ipsec sa

interface: Tunnel0
    Crypto map tag: Tunnel0-head-0, local addr 200.0.0.2

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (200.0.0.2/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (100.0.0.1/255.255.255.255/47/0)
   current_peer 100.0.0.1 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 45, #pkts encrypt: 45, #pkts digest: 45
    #pkts decaps: 44, #pkts decrypt: 44, #pkts verify: 44
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 200.0.0.2, remote crypto endpt.: 100.0.0.1
     plaintext mtu 1442, path mtu 1472, ip mtu 1472, ip mtu idb Tunnel0
     current outbound spi: 0xCD11C1FD(3440493053)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x8D00840B(2365621259)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Transport, }
        conn id: 1, flow_id: SW:1, sibling_flags 80004000, crypto map: Tunnel0-head-0
        sa timing: remaining key lifetime (k/sec): (4608000/3449)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)
      spi: 0x2F470E3D(793185853)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Transport, }
        conn id: 3, flow_id: SW:3, sibling_flags 80000000, crypto map: Tunnel0-head-0
        sa timing: remaining key lifetime (k/sec): (4193753/3449)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x43219BBB(1126276027)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Transport, }
        conn id: 2, flow_id: SW:2, sibling_flags 80004000, crypto map: Tunnel0-head-0
        sa timing: remaining key lifetime (k/sec): (4608000/3449)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)
      spi: 0xCD11C1FD(3440493053)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Transport, }
        conn id: 4, flow_id: SW:4, sibling_flags 80000000, crypto map: Tunnel0-head-0
        sa timing: remaining key lifetime (k/sec): (4193753/3449)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:
R2# 
*Apr 30 06:56:42.979: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.1 on Tunnel0 from DOWN to DOWN, Neighbor Down: Ignore timer expired
R2#sh crypto ipsec sa

interface: Tunnel0
    Crypto map tag: Tunnel0-head-0, local addr 200.0.0.2

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (200.0.0.2/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (100.0.0.1/255.255.255.255/47/0)
   current_peer 100.0.0.1 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 56, #pkts encrypt: 56, #pkts digest: 56
    #pkts decaps: 54, #pkts decrypt: 54, #pkts verify: 54
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 200.0.0.2, remote crypto endpt.: 100.0.0.1
     plaintext mtu 1442, path mtu 1472, ip mtu 1472, ip mtu idb Tunnel0
     current outbound spi: 0xCD11C1FD(3440493053)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x8D00840B(2365621259)
          
R2#ping 172.16.0.1   
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/18/27 ms
R2#sh run | s tun0
R2#sh run tun0    
          ^
% Invalid input detected at '^' marker.

R2#sh run int tun0
Building configuration...

Current configuration : 351 bytes
!
interface Tunnel0
 ip address 172.16.0.2 255.255.255.0
 no ip redirects
 ip nhrp map 172.16.0.1 100.0.0.1
 ip nhrp map multicast 100.0.0.1
 ip nhrp network-id 100
 ip nhrp nhs 172.16.0.1
 ip ospf network broadcast
 ip ospf priority 0
 tunnel source Dialer1
 tunnel mode gre multipoint
 tunnel key 10
 tunnel protection ipsec profile PRO-DMVPN1
end

R2#sh ip proto
*** IP Routing is NSF aware ***

Routing Protocol is "application"
  Sending updates every 0 seconds
  Invalid after 0 seconds, hold down 0, flushed after 0
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Maximum path: 32
  Routing for Networks:
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: (default is 4)

Routing Protocol is "nhrp"
  Maximum path: 32
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: (default is 250)

Routing Protocol is "ospf 1"
  Outgoing update filter list for all interfaces is not set
  Incoming update filter list for all interfaces is not set
  Router ID 172.16.0.2
  Number of areas in this router is 1. 1 normal 0 stub 0 nssa
  Maximum path: 4
  Routing for Networks:
    10.200.0.2 0.0.0.0 area 0
    172.16.0.2 0.0.0.0 area 0
  Routing Information Sources:
    Gateway         Distance      Last Update
  Distance: (default is 110)

R2#sh ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0         10.200.0.2      YES NVRAM  up                    up      
GigabitEthernet0/1         unassigned      YES NVRAM  up                    up      
GigabitEthernet0/2         unassigned      YES NVRAM  administratively down down    
GigabitEthernet0/3         unassigned      YES NVRAM  administratively down down    
Dialer1                    200.0.0.2       YES TFTP   up                    up      
Loopback0                  200.0.0.2       YES manual up                    up      
Tunnel0                    172.16.0.2      YES manual up                    up      
Virtual-Access1            unassigned      YES unset  up                    up      
Virtual-Access2            unassigned      YES unset  up                    up      
R2#sh ip int tun0 | i Internet
  Internet address is 172.16.0.2/24
R2#sh ip int tun0 | i M
*Apr 30 07:02:01.972: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.1 on Tunnel0 from EXSTART to DOWN, Neighbor Down: Too many retransmissions
R2#sh ip int tun0 | i MTU
  MTU is 1472 bytes
R2#sh ip ospf neigh detai
R2#sh ip ospf neigh detail 
 Neighbor 172.16.0.1, interface address 172.16.0.1
    In the area 0 via interface Tunnel0
    Neighbor priority is 1, State is DOWN, 7 state changes
    Neighbor ignored, reenable in 00:00:24
    DR is 0.0.0.0 BDR is 0.0.0.0
    Options is 0x12 in Hello (E-bit, L-bit)
    LLS Options is 0x1 (LR)
    Index 0/0/0, retransmission queue length 0, number of retransmission 0
    First 0x0(0)/0x0(0)/0x0(0) Next 0x0(0)/0x0(0)/0x0(0)
    Last retransmission scan length is 0, maximum is 0
    Last retransmission scan time is 0 msec, maximum is 0 msec
R2#
*Apr 30 07:03:01.973: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.1 on Tunnel0 from DOWN to DOWN, Neighbor Down: Ignore timer expired
R2#cofn t
     ^
% Invalid input detected at '^' marker.

R2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R2(config)#int tun0
R2(config-if)#ip mt
R2(config-if)#ip mtu 1368
*Apr 30 07:05:09.284: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.1 on Tunnel0 from EXSTART to DOWN, Neighbor Down: Too many retransmissions
R2(config-if)#ip mtu 1368
R2(config-if)#do sh ip ospf neigh

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.0.1        1   DOWN/DROTHER       -        172.16.0.1      Tunnel0
R2(config-if)#do sh ip ospf neigh

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.0.1        1   DOWN/DROTHER       -        172.16.0.1      Tunnel0
R2(config-if)#do sh ip ospf neigh

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.0.1        1   DOWN/DROTHER       -        172.16.0.1      Tunnel0
R2(config-if)#do sh ip ospf neigh

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.0.1        1   DOWN/DROTHER       -        172.16.0.1      Tunnel0
R2(config-if)#do sh ip int | i MTU
  MTU is 1500 bytes
  MTU is 1454 bytes
  MTU is 1514 bytes
  MTU is 1368 bytes
R2(config-if)#do sh ip int tun0 | i MTU
  MTU is 1368 bytes
R2(config-if)#
*Apr 30 07:06:09.284: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.1 on Tunnel0 from DOWN to DOWN, Neighbor Down: Ignore timer expired
*Apr 30 07:06:09.676: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.1 on Tunnel0 from LOADING to FULL, Loading Done
R2(config-if)#^Z
R2#sh ip
*Apr 30 07:06:13.859: %SYS-5-CONFIG_I: Configured from console by console
R2#sh ip ro ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

      10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
O        10.100.0.0/24 [110/1001] via 172.16.0.1, 00:00:02, Tunnel0
R2#ping 10.100.0.101
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.100.0.101, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/15/23 ms
R2#

R6#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R6(config)#cry
R6(config)#crypto isak
R6(config)#crypto isakmp po
R6(config)#crypto isakmp policy 1
R6(config-isakmp)#enc
R6(config-isakmp)#encryption 3de
R6(config-isakmp)#encryption 3des 
R6(config-isakmp)#ha
R6(config-isakmp)#hash md
R6(config-isakmp)#hash md5 
R6(config-isakmp)#auth
R6(config-isakmp)#authentication pre
R6(config-isakmp)#authentication pre-share 
R6(config-isakmp)#gr
R6(config-isakmp)#group 2
R6(config-isakmp)#cry
R6(config-isakmp)#exit   
R6(config)#crypto
R6(config)#crypto isak
R6(config)#crypto isakmp ke
R6(config)#crypto isakmp key cisco add
R6(config)#crypto isakmp key cisco address 0.0.0.0
R6(config)#crypto
R6(config)#crypto isakm
R6(config)#crypto isakmp kee
R6(config)#crypto isakmp keepalive 30
R6(config)#crypt
R6(config)#crypto ipse
R6(config)#crypto ipsec tran
R6(config)#crypto ipsec transform-set TS-IPSEC1 esp
R6(config)#crypto ipsec transform-set TS-IPSEC1 esp-3de
R6(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp-md
R6(config)#crypto ipsec transform-set TS-IPSEC1 esp-3des esp-md5-hmac 
R6(cfg-crypto-trans)#mod
R6(cfg-crypto-trans)#mode tra
R6(cfg-crypto-trans)#mode transport 
R6(cfg-crypto-trans)#cry
R6(cfg-crypto-trans)#cryp
R6(cfg-crypto-trans)#exit
R6(config)#cryp
R6(config)#crypto ipse
R6(config)#crypto ipsec pro
R6(config)#crypto ipsec profile PRO-DMVPN1
R6(ipsec-profile)#set tra
R6(ipsec-profile)#set transform-set TS-IPSEC1
R6(ipsec-profile)#int tun0
R6(config-if)#
*Apr 30 07:32:49.891: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down
R6(config-if)#ip add
R6(config-if)#ip address 172.16.0.6 255.255.255.0
R6(config-if)#tunn
R6(config-if)#tunnel sour
R6(config-if)#tunnel source Dia
R6(config-if)#tunnel source Dialer 1
R6(config-if)#tunn
R6(config-if)#tunnel mod
R6(config-if)#tunnel mode gr
R6(config-if)#tunnel mode gre mu
R6(config-if)#tunnel mode gre multipoint 
R6(config-if)#tunn
R6(config-if)#tunnel ke
R6(config-if)#tunnel key 10
R6(config-if)#tunn
R6(config-if)#tunnel p
R6(config-if)#tunnel pro
R6(config-if)#tunnel protection ipse
R6(config-if)#tunnel protection ipsec pro
R6(config-if)#tunnel protection ipsec profile PRO-DMVPN1
R6(config-if)#ip nh
R6(config-if)#ip nhrp netwo
R6(config-if)#ip nhrp network-id 100
R6(config-if)#ip nh
R6(config-if)#ip nhrp nhs 172.16.0.1 
R6(config-if)#ip nh
R6(config-if)#ip nhrp map 172.16.0.1 100.0.0.1
R6(config-if)#ip nhrp map mul
R6(config-if)#ip nhrp map multicast 100.0.0.1
R6(config-if)#ip osp
R6(config-if)#ip ospf netwo
R6(config-if)#ip ospf network bro
R6(config-if)#ip ospf network broadcast 
R6(config-if)#ip os
R6(config-if)#ip ospf pri
R6(config-if)#ip ospf priority o
R6(config-if)#ip ospf priority 0
R6(config-if)#router ospf 1 
R6(config-router)#netwo
R6(config-router)#network 172.16.0.6 0.0.0.0 area 0
R6(config-router)#net
R6(config-router)#network 10.6.0.6 0.0.0.0 area 0
R6(config-router)#int lo0
R6(config-if)#ip 
*Apr 30 07:48:55.542: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to upa
R6(config-if)#ip add
R6(config-if)#ip address 106.0.0.6 255.255.255.255
R6(config-if)#int gig0/1
R6(config-if)#no ip add
R6(config-if)#no ip address 
R6(config-if)#pppoe enabl
R6(config-if)#pppoe enable 
R6(config-if)#pppoe 
*Apr 30 07:50:22.401: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to up
R6(config-if)#pppoe-
*Apr 30 07:50:22.404: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
R6(config-if)#pppoe-clie
R6(config-if)#pppoe-client dia
R6(config-if)#pppoe-client dial-pool-number 1
R6(config-if)#int gig0/0
R6(config-if)#ip addre
R6(config-if)#ip address 10.6.0.6 255.255.255.0
R6(config-if)#ip tcp ad
R6(config-if)#ip tcp adjust-mss 1328
R6(config-if)#int tun0
R6(config-if)#ip mt
R6(config-if)#ip mtu 1368
R6(config-if)#int gig0/0
R6(config-if)#int dia 1
R6(config-if)#ip unnu
R6(config-if)#ip unnumbered Lo
R6(config-if)#ip unnumbered Loo
R6(config-if)#ip unnumbered Loopback 0
R6(config-if)#ip
*Apr 30 07:53:12.605: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up
R6(config-if)#ip mt
R6(config-if)#ip mtu 
*Apr 30 07:53:12.668: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
R6(config-if)#ip mtu 1454
R6(config-if)#enca
R6(config-if)#encapsulation ppp
R6(config-if)#dial
R6(config-if)#dialer po
R6(config-if)#dialer pool 1
R6(config-if)#dia
R6(config-if)#dialer-g
R6(config-if)#dialer-group 
*Apr 30 07:53:26.348: %DIALER-6-BIND: Interface Vi2 bound to profile Di1
*Apr 30 07:53:26.353: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
*Apr 30 07:53:28.231: %DIALER-6-UNBIND: Interface Vi2 unbound from profile Di1
R6(config-if)#dialer-group 
*Apr 30 07:53:28.247: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to down
R6(config-if)#dialer-group 1
R6(config-if)#ppp auth
R6(config-if)#ppp authe
R6(config-if)#ppp authentication chap calli
R6(config-if)#ppp authentication chap callin 
R6(config-if)#ppp chap hostnae
R6(config-if)#ppp chap hostna 
R6(config-if)#ppp chap hostname ccie@
*Apr 30 07:53:50.543: %DIALER-6-BIND: Interface Vi2 bound to profile Di1
*Apr 30 07:53:50.547: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
*Apr 30 07:53:50.640: %DIALER-6-UNBIND: Interface Vi2 unbound from profile Di1
R6(config-if)#ppp chap hostname ccie@isp3
*Apr 30 07:53:50.655: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to down
R6(config-if)#ppp chap hostname ccie@isp3.pg1x.net
R6(config-if)#ppp chap
R6(config-if)#ppp chap pass
R6(config-if)#ppp chap password cc13
R6(config-if)#exit
R6(config)#ip route 0.0.0.0 0.0.0.0
*Apr 30 07:54:12.886: %DIALER-6-BIND: Interface Vi2 bound to profile Di1 D
R6(config)#ip route 0.0.0.0 0.0.0.0 Dia
R6(config)#ip route 0.0.0.0 0.0.0.0 Dialer 
*Apr 30 07:54:12.889: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up
*Apr 30 07:54:13.434: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up
R6(config)#ip route 0.0.0.0 0.0.0.0 Dialer 1
R6(config)#dia
R6(config)#dialer-li
R6(config)#dialer-list 1 
*Apr 30 07:54:19.670: %OSPF-5-ADJCHG: Process 1, Nbr 172.16.0.1 on Tunnel0 from LOADING to FULL, Loading Done
R6(config)#dialer-list 1 pro
R6(config)#dialer-list 1 protocol ip
R6(config)#dialer-list 1 protocol ip per
R6(config)#dialer-list 1 protocol ip permit 
R6(config)#^Z
R6#sh ip 
*Apr 30 07:54:25.651: %SYS-5-CONFIG_I: Configured from console by console
R6#sh ip ro ospf
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

      10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
O        10.100.0.0/24 [110/1001] via 172.16.0.1, 00:00:04, Tunnel0
O        10.200.0.0/24 [110/1001] via 172.16.0.2, 00:00:04, Tunnel0
R6#ping 172.16.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 14/17/24 ms
R6#ping 172.16.0.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 28/36/53 ms
R6#ping 10.100.0.101
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.100.0.101, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 7/258/1005 ms
R6#ping 10.100.0.101
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.100.0.101, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 13/16/22 ms
R6#ping 10.200.0.202
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.200.0.202, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/15/20 ms
R6#sh ip ospf neigh

Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.0.1        1   FULL/DR         00:00:39    172.16.0.1      Tunnel0

R6#ping 10.200.0.202 repeat 10000
Type escape sequence to abort.
Sending 10000, 100-byte ICMP Echos to 10.200.0.202, timeout is 2 seconds:
.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.
Success rate is 99 percent (622/624), round-trip min/avg/max = 7/16/1018 ms
R6#

References

PG1X LASTHOPE WIKI

Table of Contents

Cisco: DMVPN

Topology: mGRE + NHRP + OSPF

Preparation

Configure

Topology: DMVPN + OSPF

Preparation

Configuration

Topology: PPPoE + DMVPN + OSPF

Preparation

Configuration

References

PG1X LASTHOPE WIKI

User Tools

Site Tools

Table of Contents

Cisco: DMVPN

Topology: mGRE + NHRP + OSPF

Preparation

Configure

Topology: DMVPN + OSPF

Preparation

Configuration

Topology: PPPoE + DMVPN + OSPF

Preparation

Configuration

References

Page Tools