206-hub#show run
Building configuration...

Current configuration : 3211 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 206-hub
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
clock timezone EST 0
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
ip source-route
!
!
ip vrf HOPA
 rd 21719:24
 route-target export 21719:24
 route-target import 21719:24
!
!
!
ip cef
!
!
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set encrypted-inet-dmvpn esp-3des esp-sha-hmac
 mode transport
!
crypto ipsec profile encrypted-inet-dmvpn
 set security-association lifetime seconds 1440
 set transform-set encrypted-inet-dmvpn
!
interface Loopback0
 ip address 111.111.111.111 255.255.255.0
!

interface Tunnel100
 ip vrf forwarding HOPA
 ip address 172.26.253.1 255.255.255.0
 no ip redirects
 ip mtu 1400
 ip flow ingress
 ip nhrp authentication abc123
 ip nhrp map multicast dynamic
 ip nhrp network-id 1234
 ip nhrp holdtime 120
 ip tcp adjust-mss 1360
 no ip split-horizon
 tunnel source Ethernet0/0
 tunnel mode gre multipoint
 tunnel key 1234
 tunnel path-mtu-discovery
 tunnel protection ipsec profile encrypted-inet-dmvpn
!
interface Ethernet0/0
 ip address 6.1.1.2 255.255.255.0
!
interface Ethernet0/1
 ip address 16.1.1.1 255.255.255.0
!
!
router eigrp 100
 network 6.0.0.0
 no auto-summary
!
router bgp 1
 no synchronization
 bgp log-neighbor-changes
 no auto-summary
 !
 address-family ipv4 vrf HOPA
  neighbor 172.26.253.100 remote-as 1
  neighbor 172.26.253.100 activate
  neighbor 172.26.253.100 route-reflector-client
  neighbor 172.26.253.200 remote-as 1
  neighbor 172.26.253.200 activate
  neighbor 172.26.253.200 route-reflector-client
  no synchronization
  network 111.111.111.0 mask 255.255.255.0
  network 172.26.253.0 mask 255.255.255.0
 exit-address-family
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 6.1.1.1
!

206-hub#sh crypto isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id status
6.1.1.2         7.1.1.2         QM_IDLE           1012 ACTIVE
2.1.1.2         6.1.1.2         QM_IDLE           1011 ACTIVE

IPv6 Crypto ISAKMP SA

206-hub#
206-hub#
206-hub#sh crypto ipsec sa

interface: Tunnel100
    Crypto map tag: Tunnel100-head-0, local addr 6.1.1.2

   protected vrf: HOPA
   local  ident (addr/mask/prot/port): (6.1.1.2/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (2.1.1.2/255.255.255.255/47/0)
   current_peer 2.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 13669, #pkts encrypt: 13669, #pkts digest: 13669
    #pkts decaps: 13656, #pkts decrypt: 13656, #pkts verify: 13656
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 6.1.1.2, remote crypto endpt.: 2.1.1.2
     path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0
     current outbound spi: 0x278DFFD1(663617489)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0xA5D80B31(2782399281)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Transport, }
        conn id: 249, flow_id: SW:249, sibling_flags 80000006, crypto map: Tunnel100-head-0
        sa timing: remaining key lifetime (k/sec): (4454293/1044)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x278DFFD1(663617489)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Transport, }
        conn id: 250, flow_id: SW:250, sibling_flags 80000006, crypto map: Tunnel100-head-0
        sa timing: remaining key lifetime (k/sec): (4454292/1044)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

   protected vrf: HOPA
   local  ident (addr/mask/prot/port): (6.1.1.2/255.255.255.255/47/0)
   remote ident (addr/mask/prot/port): (7.1.1.2/255.255.255.255/47/0)
   current_peer 7.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 13668, #pkts encrypt: 13668, #pkts digest: 13668
    #pkts decaps: 13676, #pkts decrypt: 13676, #pkts verify: 13676
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 6.1.1.2, remote crypto endpt.: 7.1.1.2
     path mtu 1500, ip mtu 1500, ip mtu idb Ethernet0/0
     current outbound spi: 0xE436255(239297109)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x3DE92C93(1038691475)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Transport, }
        conn id: 247, flow_id: SW:247, sibling_flags 80000006, crypto map: Tunnel100-head-0
        sa timing: remaining key lifetime (k/sec): (4560607/186)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xE436255(239297109)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Transport, }
        conn id: 248, flow_id: SW:248, sibling_flags 80000006, crypto map: Tunnel100-head-0
        sa timing: remaining key lifetime (k/sec): (4560605/186)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:
206-hub#
206-hub#
206-hub#
206-hub#sh crypto sock
206-hub#sh crypto sockets

Number of Crypto Socket connections 2

 Tu100 Peers (local/remote): 6.1.1.2/2.1.1.2
       Local Ident  (addr/mask/port/prot): (6.1.1.2/255.255.255.255/0/47)
       Remote Ident (addr/mask/port/prot): (2.1.1.2/255.255.255.255/0/47)
       IPSec Profile: "encrypted-inet-dmvpn"
       Socket State: Open
       Client: "TUNNEL SEC" (Client State: Active)
 Tu100 Peers (local/remote): 6.1.1.2/7.1.1.2
       Local Ident  (addr/mask/port/prot): (6.1.1.2/255.255.255.255/0/47)
       Remote Ident (addr/mask/port/prot): (7.1.1.2/255.255.255.255/0/47)
       IPSec Profile: "encrypted-inet-dmvpn"
       Socket State: Open
       Client: "TUNNEL SEC" (Client State: Active)

Crypto Sockets in Listen state:
Client: "TUNNEL SEC" Profile: "encrypted-inet-dmvpn" Map-name: "Tunnel100-head-0"

206-hub#
206-hub#
206-hub#
206-hub#
206-hub#
206-hub#sh ip nhrp
172.26.253.100/32 via 172.26.253.100
   Tunnel100 created 2d16h, expire 00:01:43
   Type: dynamic, Flags: registered
   NBMA address: 2.1.1.2
172.26.253.200/32 via 172.26.253.200
   Tunnel100 created 2d16h, expire 00:01:23
   Type: dynamic, Flags: registered
   NBMA address: 7.1.1.2
206-hub#
206-hub#
206-hub#
206-hub#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 6.1.1.1 to network 0.0.0.0

     16.0.0.0/24 is subnetted, 1 subnets
C       16.1.1.0 is directly connected, Ethernet0/1
     2.0.0.0/24 is subnetted, 1 subnets
D       2.1.1.0 [90/307200] via 6.1.1.1, 2d16h, Ethernet0/0
     6.0.0.0/24 is subnetted, 1 subnets
C       6.1.1.0 is directly connected, Ethernet0/0
     7.0.0.0/24 is subnetted, 1 subnets
D       7.1.1.0 [90/307200] via 6.1.1.1, 2d16h, Ethernet0/0
     111.0.0.0/24 is subnetted, 1 subnets
C       111.111.111.0 is directly connected, Loopback0
S*   0.0.0.0/0 [1/0] via 6.1.1.1
206-hub#
206-hub#
206-hub#
206-hub#
206-hub#
206-hub#sh ip route vrf
206-hub#sh ip route vrf HOPA

Routing Table: HOPA
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.26.0.0/24 is subnetted, 1 subnets
C       172.26.253.0 is directly connected, Tunnel100
     22.0.0.0/24 is subnetted, 1 subnets
B       22.22.22.0 [200/0] via 172.26.253.200, 2d16h
     11.0.0.0/24 is subnetted, 1 subnets
B       11.11.11.0 [200/0] via 172.26.253.100, 2d16h