Hello,
I'm implementing a project where will have a DMVPN in a hub-spoke topology with ZBF on spoke ISR G2 routers. The CUCM will be in Data Center behind Hub Router.
I tried to configure ZBF in spoke routers allowing just signaling protocols to CUCM like sccp, mgcp, sip and h323 expecting that pinholes would be opened for RTP ports but it doesn't work. The source LAN RTP packet in spoke router was dropped and I needed to open the RTP UDP range ports to have VoIP comunication between two spoke sites.
Anyone have an experience with this kind of scenario or have any idea if this ZBF config should work in this implementation?
!
crypto keyring DMVPN
pre-shared-key address 0.0.0.0 0.0.0.0 key cisco@123
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 10
!
crypto ipsec security-association replay window-size 1024
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
mode transport
!
crypto ipsec profile DMVPN
set transform-set 3DES-SHA
!
!
!
!
!
class-map type inspect match-any VPN-PROT
match protocol ftp
match protocol tftp
match protocol skinny
match protocol sip
match protocol h323
match protocol mgcp
match protocol icmp
match protocol tcp
match protocol udp
class-map type inspect match-all IN-VPN
match access-group name IN-VPN
class-map type inspect match-all IN-VPN-POLICY
match class-map VPN-PROT
match class-map IN-VPN
class-map type inspect match-all VPN-IN
match access-group name VPN-IN
match access-group name VPN-IN
class-map type inspect match-all VPN-IN-POLICY
match class-map VPN-PROT
match class-map VPN-IN
class-map type inspect match-any VOICE-PROT
match protocol skinny
match protocol sip
match protocol h323
match protocol mgcp
match protocol icmp
match protocol user-rtp
class-map type inspect match-all IN-VOICE
match access-group name IN-VOICE
class-map type inspect match-all IN-VOICE-POLICY
match class-map VOICE-PROT
match class-map IN-VOICE
class-map type inspect match-all VOICE-IN
match access-group name VOICE-IN
class-map type inspect match-all VOICE-IN-POLICY
match class-map VOICE-PROT
match class-map VOICE-IN
!
!
policy-map type inspect IN-VPN-POLICY
class type inspect IN-VOICE-POLICY
inspect
class type inspect IN-VPN-POLICY
inspect
class class-default
drop log
policy-map type inspect VPN-IN-POLICY
class type inspect VOICE-IN-POLICY
inspect
class type inspect VPN-IN-POLICY
inspect
class class-default
drop log
!
zone security INSIDE
zone security MPLS
zone-pair security IN-VPN source INSIDE destination MPLS
service-policy type inspect IN-VPN-POLICY
zone-pair security VPN-IN source MPLS destination INSIDE
service-policy type inspect VPN-IN-POLICY
!
!
!
!
interface Tunnel10
ip address 10.255.255.2 255.255.255.0
no ip redirects
ip mtu 1408
ip hold-time eigrp 1 35
no ip next-hop-self eigrp 1
ip nhrp authentication cisco
ip nhrp map multicast dynamic
ip nhrp map multicast 192.168.100.2
ip nhrp map 10.255.255.1 192.168.100.2
ip nhrp network-id 1
ip nhrp holdtime 300
ip nhrp nhs 10.255.255.1
ip nhrp registration no-unique
zone-member security MPLS
ip tcp adjust-mss 1368
no ip split-horizon eigrp 1
tunnel source 192.168.101.2
tunnel mode gre multipoint
tunnel key 1
tunnel path-mtu-discovery
tunnel protection ipsec profile DMVPN shared
!
interface FastEthernet0/0
ip address 192.168.101.2 255.255.255.252
zone-member security MPLS
speed 100
full-duplex
!
interface FastEthernet0/1
ip address 192.168.10.1 255.255.255.0
zone-member security INSIDE
duplex auto
speed auto
!
router eigrp 1
network 10.255.255.0 0.0.0.255
network 192.168.10.0
no auto-summary
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 192.168.101.1
!
!
no ip http server
no ip http secure-server
!
ip access-list extended IN-VOICE
permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.255.255
ip access-list extended IN-VPN
permit ip 192.168.10.0 0.0.0.255 10.123.45.0 0.0.0.255
ip access-list extended VOICE-IN
permit ip 192.168.0.0 0.0.255.255 192.168.10.0 0.0.0.255
ip access-list extended VPN-IN
permit ip 10.123.45.0 0.0.0.255 192.168.10.0 0.0.0.255
!
!
!
!
