DMVPN IPSec isse - spokes can't communicate

[D@1984]

Hi,

I have a simple hub and 2 spokes topology, with ospf routing. 

after configuring dmvpn, my tunnels come up and  spokes can ping each other and learn each others routes.

However after adding ipsec, although spokes still learn the routes via ospf, Im not able to ping one spoke from another  ( ping from spoke to hub works).

looking at debugs, I see :

ISAKMP:(0):No pre-shared key with 192.168.2.1! - ***this is other spoke wan interface*** 

ISAKMP:(0): No Cert or pre-shared address key.

* ISAKMP:(0): construct_initial_message: Can not start Main mode
ISAKMP: Unlocking peer struct 0x6AD6789C for isadb_unlock_peer_delete_sa(), count 0
ISAKMP: Deleting peer node by peer_reap for 192.168.2.1: 6AD6789C
ISAKMP:(0):purging SA., sa=6AD893F8, delme=6AD893F8
ISAKMP:(0):purging node -1228187533
ISAKMP: Error while processing SA request: Failed to initialize SA
ISAKMP: Error while processing KMI message 0, error 2.
IPSEC(key_engine): got a queue event with 1 KMI message(s)
IPSEC:(SESSION ID = 1) (ERROR) crypto_notify_rp Rejected notify RP, elapse time 0 < 1000

on the hub I have:

crypto isakmp policy 1
encr aes 256
hash sha256
group 2
crypto isakmp key cisco address 0.0.0.0
!
!
crypto ipsec transform-set myset esp-aes esp-sha256-hmac
mode tunnel
!
!
crypto ipsec profile myprofile
set transform-set myset

interface Tunnel0
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel protection ipsec profile myprofile

I have same config on spokes but:

crypto isakmp key cisco address ***address of hub wan interface***

any idea where the problem could be? 

Routerhub#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
192.168.3.1 192.168.2.1 QM_IDLE 1006 ACTIVE
192.168.3.1 192.168.1.1 QM_IDLE 1005 ACTIVE

spake1# show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
192.168.1.1 192.168.3.1 QM_IDLE 1004 ACTIVE

spoke2##show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
192.168.2.1 192.168.3.1 QM_IDLE 1002 ACTIVE

[MHM Cisco World]

This not dmvpn it simply ipsec over gre. And it wrong config with multipoint. 

Dmvpn need nhs/nhrp command which I don't see

MHM

[D@1984]

I didn’t put dmvpn config but as I know it’s working. As mentioned before adding IPsec, I could ping from spoke 1 to 2.

[MHM Cisco World]

Ohh ok' 

The key must config with address 0.0.0.0

Because the ipsec tunnel not form with only hub but with other spokes

MHM

[MHM Cisco World]

What Paul mention is same what I suggest'

The spoke form IPsec one with hub and others with other spoke

Under spoke you specify address of hub in isakmp key that why ipsec failed to form between spokes.

MHM

[paul driver]

Hello
try adding.

crypto isakmp policy 1
authentication pre-share 

[D@1984]

I have tried with authentication pre-shared as well. Unfortunately still the same. 

[paul driver]

Hello

You nee the same isakmp policy and ipsec on both hub /spokes ( including the pre-share authentication and key)

[D@1984]

config is exactly the same the only difference is:

crypto isakmp key cisco address 0.0.0.0 (on hub)

crypto isakmp key cisco address 192.168.3.1  ( on spokes)

[paul driver]

---

D@1984 wrote:

config is exactly the same the only difference is:

crypto isakmp key cisco address 0.0.0.0 (on hub)

crypto isakmp key cisco address 192.168.3.1  ( on spokes)

---

crypto isakmp key cisco address 0.0.0.0 (on spoke)

[D@1984]

requirement was to configure static address for the spokes.

I'm doing this in the eve-ng and its a weird one as when I reboot the router it starts working! 

[MHM Cisco World]

Requirements use static? That  not correct' dmvpn need to use address of key 0.0.0.0 or use other authc like router ID or other.

After that it works <<- with static and it work not meaning that traffic is spoke-to-spoke it can spoke-hub-spoke 

Check show dmvpn see if there is dynamic tunnel build in each spokes

MHM

[MHM Cisco World]

So in end this issue solved or NOT??

MHM