#cisco certifications

Today I decided to practice more DMVPN here is my lab with Phase one for those who would like to follow see below commands used. Also basic routing was done between Serial interfaces with static routes. EIGRP was used for Tunnel interfaces.

Configuration for practice lab below:

router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.101.0  exit

router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.102.0  exit

 router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.103.0  exit

 router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.104.0  exit

 crypto isakmp policy 1  authentication pre-share  encryption aes  hash sha  group 5  lifetime 1800  exit crypto isakmp key cisco address 0.0.0.0 0.0.0.0 ! ! crypto ipsec transform-set t-set esp-aes esp-sha-hmac mode transport ! crypto ipsec profile cisco set transform-set t-set !

  interface tunnel 0  ip address 192.168.1.1 255.255.255.0  tunnel source s 0/0  tunnel mode gre multipoint  tunnel key 1  ip nhrp map multicast dynamic  ip nhrp authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  no ip split-horizon eigrp 100  exit

  interface tunnel 0  tunnel source serial 0/0  ip address 192.168.1.2 255.255.255.0  tunnel source s 0/0  tunnel key 1  tunnel destination 101.1.1.100  ip nhrp map 192.168.1.1 101.1.1.100  ip nhrp map multicast 101.1.1.100  ip nhrp  authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  ip nhrp nhs 192.168.1.1

 interface tunnel 0  tunnel source serial 0/0  ip address 192.168.1.3 255.255.255.0  tunnel source s 0/0  tunnel key 1  tunnel destination 101.1.1.100  ip nhrp map 192.168.1.1 101.1.1.100  ip nhrp map multicast 101.1.1.100  ip nhrp  authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  ip nhrp nhs 192.168.1.1

CCNA 200-125 PDF files are way easier to carry with you while you travel. Accessible and easy to transfer files makes your exam preparation effortless.

With Braindumpskey, you must expect to get the best score We are the second name of reliability. With us you must expect to score the best marks. The highly skilled experts in the industry are working day and night tirelessly to produce the kind of products that can not be found anywhere else. These distinctly qualified people develop the best exam solutions for you. The products are thoroughly tested, and good performance of the customers is made certain. Taking a chance with us will surely take you a step closer to your success.

So this is a lab setup I practiced DMVPN with EIGRP below I have the configuration if you want to follow what I have done.

Static routes were used for the basic connectivity then EIGRP was used to build the DMVPN. I highly recommend that if you have very little experience with this kind of configuration to first do some reading or viewing some videos on YouTube.

Below is some of the configuration used:

MVPN Crypto config hub

crypto isakmp policy 1  authentication pre-share  encryption aes  hash sha  group 5  lifetime 1800  exit  crypto isakmp key 0 cisco address 102.1.1.100  crypto isakmp key 0 cisco address 103.1.1.100  crypto isakmp key 0 cisco address 104.1.1.100  crypto ipsec transform-set t-set esp-aes esp-sha-hmac  mode transport  exit  crypto ipsec profile cisco  set transform-set t-set  exit

 **************************************************************  spoke

 crypto isakmp policy 1  authentication pre-share  encryption aes  hash sha  group 5  lifetime 1800  exit  crypto isakmp key 0 cisco address 101.1.1.100  crypto isakmp key 0 cisco address 103.1.1.100  crypto isakmp key 0 cisco address 104.1.1.100  crypto ipsec transform-set t-set esp-aes esp-sha-hmac  mode transport  exit  crypto ipsec profile cisco  set transform-set t-set  exit

 ************************************************************   soke

 crypto isakmp policy 1  authentication pre-share  encryption aes  hash sha  group 5  lifetime 1800  exit  crypto isakmp key 0 cisco address 101.1.1.100  crypto isakmp key 0 cisco address 102.1.1.100  crypto isakmp key 0 cisco address 104.1.1.100  crypto ipsec transform-set t-set esp-aes esp-sha-hmac  mode transport  exit  crypto ipsec profile cisco  set transform-set t-set  exit

 ***************************************************************

 spoke

 crypto isakmp policy 1  authentication pre-share  encryption aes  hash sha  group 5  lifetime 1800  exit  crypto isakmp key 0 cisco address 101.1.1.100  crypto isakmp key 0 cisco address 102.1.1.100  crypto isakmp key 0 cisco address 103.1.1.100  crypto ipsec transform-set t-set esp-aes esp-sha-hmac  mode transport  exit  crypto ipsec profile cisco  set transform-set t-set  exit

 ****************************************************************

 Routing hub

 router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.101.0  exit

 ****************************************************************

 Spoke

 router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.102.0  exit

 *******************************************************************

 spoke

 router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.103.0  exit

 ******************************************************************

 Spoke

 router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.104.0  exit

 ******************************************************************

 interface tunnel configuration

  int t0  ip address 192.168.1.2 255.255.255.0  tunnel source serial 0/0  tunnel mode gre multipoint  tunnel key 1  ip nhrp map 192.168.1.1 101.1.1.100  ip nhrp map multicast 101.1.1.100  ip nhrp authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  ip nhrp nhs 192.168.1.1

 *********************************************************************

 interface tunnel configuration

  int t0  ip address 192.168.1.3 255.255.255.0  tunnel source serial 0/0  tunnel mode gre multipoint  tunnel key 1  ip nhrp map 192.168.1.1 101.1.1.100  ip nhrp map multicast 101.1.1.100  ip nhrp authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  ip nhrp nhs 192.168.1.1

 **************************************************************************

 interface tunnel configuration

  int t0  ip address 192.168.1.4 255.255.255.0  tunnel source serial 0/0  tunnel mode gre multipoint  tunnel key 1  ip nhrp map 192.168.1.1 101.1.1.100  ip nhrp map multicast 101.1.1.100  ip nhrp authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  ip nhrp nhs 192.168.1.1  exit

 **************************************************************************

 R1#show ip eigrp neighbors IP-EIGRP neighbors for process 100 H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq                                            (sec)         (ms)       Cnt Num 2   192.168.1.4             Tu0               14 00:01:09  152  5000  0  3 1   192.168.1.3             Tu0               10 00:01:43   96  5000  0  3 0   192.168.1.2             Tu0               12 00:04:46   41  5000  0  3

*****************************************************************************

R1#show ip route eigrp D    192.168.104.0/24 [90/297270016] via 192.168.1.4, 00:02:05, Tunnel0 D    192.168.102.0/24 [90/297270016] via 192.168.1.2, 00:05:14, Tunnel0 D    192.168.103.0/24 [90/297270016] via 192.168.1.3, 00:02:40, Tunnel0 R1#

*****************************************************************************

R4#show crypto ipsec sa

interface: Tunnel0    Crypto map tag: Tunnel0-head-0, local addr 104.1.1.100

  protected vrf: (none)   local  ident (addr/mask/prot/port): (104.1.1.100/255.255.255.255/47/0)   remote ident (addr/mask/prot/port): (101.1.1.100/255.255.255.255/47/0)   current_peer 101.1.1.100 port 500     PERMIT, flags={origin_is_acl,}    #pkts encaps: 59, #pkts encrypt: 59, #pkts digest: 59    #pkts decaps: 60, #pkts decrypt: 60, #pkts verify: 60    #pkts compressed: 0, #pkts decompressed: 0    #pkts not compressed: 0, #pkts compr. failed: 0    #pkts not decompressed: 0, #pkts decompress failed: 0    #send errors 1, #recv errors 0

    local crypto endpt.: 104.1.1.100, remote crypto endpt.: 101.1.1.100     path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0     current outbound spi: 0xA347CF36(2739392310)

    inbound esp sas:      spi: 0x37DB83F1(937133041)        transform: esp-aes esp-sha-hmac ,        in use settings ={Transport, }        conn id: 2001, flow_id: SW:1, crypto map: Tunnel0-head-0        sa timing: remaining key lifetime (k/sec): (4398054/3374)        IV size: 16 bytes        replay detection support: Y        Status: ACTIVE

    inbound ah sas:

    inbound pcp sas:

    outbound esp sas:      spi: 0xA347CF36(2739392310)        transform: esp-aes esp-sha-hmac ,        in use settings ={Transport, }        conn id: 2002, flow_id: SW:2, crypto map: Tunnel0-head-0        sa timing: remaining key lifetime (k/sec): (4398054/3372)        IV size: 16 bytes        replay detection support: Y        Status: ACTIVE

    outbound ah sas:

    outbound pcp sas: R4#

**********************************************************************************

R4#ping 192.168.102.1 source fastEthernet 0/0 repeat 1000

Type escape sequence to abort. Sending 1000, 100-byte ICMP Echos to 192.168.102.1, timeout is 2 seconds: Packet sent with a source address of 192.168.104.1 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! Success rate is 100 percent (1000/1000), round-trip min/avg/max = 1/2/56 ms

***********************************************************************************

R4#show ip nhrp 192.168.1.1/32 via 192.168.1.1, Tunnel0 created 00:07:16, never expire  Type: static, Flags: authoritative used  NBMA address: 101.1.1.100 192.168.1.2/32 via 192.168.1.2, Tunnel0 created 00:00:30, expire 00:04:32  Type: dynamic, Flags: router  NBMA address: 102.1.1.100 R4#

************************************************************************************

DVTI LAB Topology

Today I have configured a practice DVTI setup. The routing used was OSPF, there are static routes on the PC1 and PC2 devices. Remember to enable redistribution for static.

See below configuration for R1 the server and R2 the Remote client as per above Topology.

R1(config)#crypto isakmp policy 1 R1(config-isakmp)#authentication pre-share R1(config-isakmp)#encryption 3des R1(config-isakmp)#hash sh R1(config-isakmp)#group 2 R1(config-isakmp)#exit R1(config)# R1(config)#crypto isakmp client configuration group admin R1(config-isakmp-group)#key admin R1(config-isakmp-group)#pool admin R1(config-isakmp-group)#acl stacl R1(config-isakmp-group)#exit R1(config)# R1(config)#ip local pool admin 192.168.100.100 192.168.100.254 R1(config)# R1(config)#ip access-list extended stacl R1(config-ext-nacl)#permit ip 192.168.101.0 0.0.0.255 any R1(config-ext-nacl)#exit R1(config)# R1(config)#crypto isakmp profile isakmp_pro R1(conf-isa-prof)#match identity group admin R1(conf-isa-prof)#client configuration address respond R1(conf-isa-prof)#client authentication list default R1(conf-isa-prof)#isakmp authorization list default R1(conf-isa-prof)#virtual-template 1 R1(conf-isa-prof)#exit R1(config)# R1(config)#crypto ipsec transform-set ez esp-3des esp-sha-hmac R1(cfg-crypto-trans)#mode tunnel R1(cfg-crypto-trans)#exit R1(config)# R1(config)#crypto ipsec profile cisco R1(ipsec-profile)#set transform-set ez R1(ipsec-profile)#set isakmp-profile isakmp_pro R1(ipsec-profile)#exit R1(config)#interface virtual-template 1 type tunnel R1(config-if)#ip unnumbered serial 0/0 R1(config-if)#tunnel source serial 0/0 R1(config-if)#tunnel mode ipsec ipv4 R1(config-if)#tunnel protection ipsec profile cisco %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON R1(config-if)#exit R1(config)#aaa new-model R1(config)#aaa authentication login default local R1(config)#aaa authorization network default local R1(config)#username cisco privilege 15 secret cisco

R2(config)# R2(config)#crypto ipsec client ezvpn ccc

R2(config-crypto-ezvpn)#username cisco password cisco R2(config-crypto-ezvpn)#mode client R2(config-crypto-ezvpn)#peer 101.1.1.100 R2(config-crypto-ezvpn)#group admin key admin R2(config-crypto-ezvpn)#connect auto R2(config-crypto-ezvpn)#int f0/0 R2(config-if)#crypto ipsec client ezvpn ccc inside R2(config-if)#int s0/1 R2(config-if)#crypto ipsec client ezvpn ccc outside R2(config-if)# *Mar  1 00:36:23.671: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON

A Request to enter in the command (crypto ipsec client ezvpn xauth) will be generated. You will then be prompted for username and password this will be cisco and cisco as per my configuration above.

The configuration will now be completed.

This is an example of a Static VTI configuration:

See above topology, same as last config ensure that both “sites” have internet connection to the ISP router.

Below is the configuration used, ensure both sides are configured correctly with the same configuration:

From Configuration Terminal

crypto isakmp policy 1 authentication pre-share encryption aes hash sha group 5 lifetime 1800 exit crypto isakmp key cisco add 0.0.0.0 crypto ipsec transform-set t-set esp-aes esp-sha-hmac mode tunnel exit crypto ipsec profile cisco set transform-set t-set exit interface tunnel 0 %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down ip add 192.168.1.2 255.255.255.0 tunnel mode ipsec ipv4 tunnel protection ipsec profile cisco exit %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON interface tunnel 0 ip ospf 10 area 0 exit router ospf 10 network 192.168.0.0 0.0.255.255 area 0 exit interface tunnel0 tunnel source fa0/0 tunnel destination 102.1.1.100 exit

%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up %OSPF-5-ADJCHG: Process 10, Nbr 102.1.1.100 on Tunnel0 from LOADING to FULL, Loading Done

To Confirm configuration

R1#show crypto ipsec sa

interface: Tunnel0    Crypto map tag: Tunnel0-head-0, local addr 101.1.1.100

  protected vrf: (none)   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)   current_peer 102.1.1.100 port 500     PERMIT, flags={origin_is_acl,}    #pkts encaps: 40, #pkts encrypt: 40, #pkts digest: 40    #pkts decaps: 39, #pkts decrypt: 39, #pkts verify: 39    #pkts compressed: 0, #pkts decompressed: 0    #pkts not compressed: 0, #pkts compr. failed: 0    #pkts not decompressed: 0, #pkts decompress failed: 0    #send errors 0, #recv errors 0

    local crypto endpt.: 101.1.1.100, remote crypto endpt.: 102.1.1.100     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/1     current outbound spi: 0x33306896(858810518)     PFS (Y/N): N, DH group: none

    inbound esp sas:      spi: 0x15FCFCCD(368901325)        transform: esp-aes esp-sha-hmac ,        in use settings ={Tunnel, }        conn id: 1, flow_id: 1, sibling_flags 80000040, crypto map: Tunnel0-head-0        sa timing: remaining key lifetime (k/sec): (4297365/3396)        IV size: 16 bytes        replay detection support: Y        Status: ACTIVE(ACTIVE)

    inbound ah sas:

    inbound pcp sas:

    outbound esp sas:      spi: 0x33306896(858810518)        transform: esp-aes esp-sha-hmac ,        in use settings ={Tunnel, }        conn id: 2, flow_id: 2, sibling_flags 80000040, crypto map: Tunnel0-head-0        sa timing: remaining key lifetime (k/sec): (4297365/3396)        IV size: 16 bytes        replay detection support: Y        Status: ACTIVE(ACTIVE)

    outbound ah sas:

    outbound pcp sas:

R1#show crypto engine connections active Crypto Engine Connections