DMVPN - Hub behind PIX, spokes on the outside

[kelvindam]

Hi all,

Does anyone have any configuration examples with DMVPN, where the hub is behind a PIX, and the spokes are on the outside. The Hub's inside IP should be static NAT'ed to the hub inside.

Thx

[attrgautam · Accepted solution]

"Also added in Cisco IOS Release 12.3(9a) and 12.3(11)T is the capability to have the hub DMVPN router behind static NAT. This was a change in the ISAKMP NAT-T support. For this functionality to be used, all the DMVPN spoke routers and hub routers must be upgraded, and IPSec must use transport mode. "

http://www.cisco.com/en/US/products/sw/iosswrel/ps1839/products_feature_guide09186a0080110ba1.html#wp1060911

Let me know if this link helps

[darraghkennedy]

The config below did the trick for me.

I proxy arped the public address to my inside address.

Both hub and spoke are in transport mode.

I also had to add the no nat so my other translations weren't affected.

access-list outside remark DMVPN Permissions

access-list outside remark DMVPN Permissions

access-list outside permit gre any host PROD_DMVPN01_Known_AS

access-list outside permit udp any host PROD_DMVPN01_Known_AS eq isakmp

access-list outside permit udp any host PROD_DMVPN01_Known_AS eq 4500

access-list outside permit esp any host PROD_DMVPN01_Known_AS

access-list outside permit icmp any host PROD_DMVPN01_Known_AS echo

access-list outside permit icmp any host PROD_DMVPN01_Known_AS echo-reply

!

static (DMVPN,outside) PROD_DMVPN01_Known_AS PROD_DMVPN01_Real_IP netmask 255.255.255.255 0 0

!

nat (outside) 0 access-list no_nat outside

access-list no_nat deny ip any host allservices_except_dmvpn

**********************************

PROD_DMVPN01_Known = public routable i.p. from internet segment

PROD_DMVPN01_Real_IP = internal i.p

************************************