Hi,
I am installing a point to multipoint network using DMVPN. All the DSL links come up and I can ping the public IP of the other router, but not through to the 192.168 (LAN) side. Presumably a simple mistake, but I am a little stuck. I have a 2901 as the hub, and 800 series for the spokes.
Using CiscoConfigProfessional, IPsec tunnels are up, but DMVPN tunnels do not exist.
I get the following messages "rec'd ipsec packet has invalid spi for destaddr"
All suggestions appreciated.
Each router has 5 connected subnets, all of which need to route across the WAN.i.e.
the hub has 192.168.0.x, 192.168.1.x, 192.168.2.x,192.168.3.x, 192.168.4.x,
spoke 1 has 192.168.8.x, 192.168.9.x, 192.168.10.x, 192.168.11.x, 192.168.12.x
spoke 2 has 192.168.16.x, etc
The hub router has the following configuration:
hostname hub
!
boot-start-marker
boot-end-marker
!
!
no logging buffered
!
no aaa new-model
clock timezone PCTime 10 0
!
ip name-server 203.50.2.71
ip name-server 139.130.4.4
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
cts logging verbose
!
license udi pid CISCO2901/K9 sn FGL195320YQ
!
username xxxxx privilege 15 secret 5 xxxxx
!
redundancy
!
controller VDSL 0/0/0
!
crypto keyring ccp-dmvpn-keyring
pre-shared-key address 0.0.0.0 0.0.0.0 key 074842abcd
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp profile ccp-dmvpn-isakmprofile
keyring ccp-dmvpn-keyring
match identity address 0.0.0.0
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
mode transport
!
crypto ipsec profile CiscoCP_Profile1
set transform-set ESP-3DES-SHA
set isakmp-profile ccp-dmvpn-isakmprofile
!
interface Tunnel0
bandwidth 1000
ip address 192.168.254.1 255.255.255.0
ip mtu 1400
no ip split-horizon eigrp 99
no ip next-hop-self eigrp 99
no ip redirects
ip nhrp authentication DMVPN_NW
ip nhrp map multicast dynamic
ip nhrp network-id 100000
ip nhrp holdtime 360
ip tcp adjust-mss 1360
delay 1000
tunnel source Dialer0
tunnel mode gre multipoint
tunnel key 100000
tunnel protection ipsec profile CiscoCP_Profile1
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
ip address 192.168.1.254 255.255.255.0
ip address 192.168.1.254 255.255.255.0 secondary
ip address 192.168.2.254 255.255.255.0 secondary
ip address 192.168.3.254 255.255.255.0 secondary
ip address 192.168.4.254 255.255.255.0 secondary
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface ATM0/0/0
no ip address
no atm ilmi-keepalive
!
interface ATM0/0/0.1 point-to-point
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
interface Ethernet0/0/0
no ip address
ip virtual-reassembly in
!
interface Dialer0
ip address 144.139.198.112 255.255.255.0
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname xxxxx@direct.telstra.net
ppp chap password 0 xxxxx
ppp pap sent-username xxxxx@direct.telstra.net password 0 xxxxx
!
router eigrp 99
network 192.168.0.0 0.0.7.255
network 192.168.0.0
no auto-summary
!
ip forward-protocol nd
!
ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source list 1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 144.139.198.1
!
dialer-list 1 protocol ip permit
!
access-list 1 remark INSIDE_IF=GigabitEthernet0/0
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.1.0 0.0.0.255
!
control-plane
!
banner login ^CThis is the hub
!
line con 0
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
login local
transport input telnet
!
scheduler allocate 20000 1000
hub 72 configuration is
version 15.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname hub72
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
no logging buffered
enable secret 5 $1$bAhU$/QlanXdT2nZxxxxxxxx
enable password xxxxxxx
!
no aaa new-model
clock timezone ESTime 10 0
!
ip name-server 203.50.2.71
ip name-server 139.130.4.4
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
license udi pid C887VA-K9 sn FGL2006224M
!
username xxxxx privilege 15 password 0 xxxxx
!
controller VDSL 0
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key xxxxx address 144.139.198.112
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
mode transport
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
mode transport
crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
mode transport
crypto ipsec transform-set ESP-3DES-SHA3 esp-3des esp-sha-hmac
mode transport
crypto ipsec transform-set ESP-3DES-SHA4 esp-3des esp-sha-hmac
mode transport
!
crypto ipsec profile CiscoCP_Profile1
set transform-set ESP-3DES-SHA4
!
interface Tunnel0
bandwidth 1000
ip address 192.168.254.72 255.255.255.0
no ip split-horizon eigrp 99
no ip next-hop-self eigrp 99
no ip redirects
ip mtu 1400
ip nhrp authentication DMVPN_NW
ip nhrp map 192.168.254.1 144.139.198.112
ip nhrp map multicast dynamic
ip nhrp network-id 100000
ip nhrp holdtime 360
ip nhrp nhs 192.168.254.1
ip tcp adjust-mss 1360
delay 1000
tunnel source Dialer0
tunnel destination 144.139.198.112
tunnel key 100000
tunnel protection ipsec profile CiscoCP_Profile1
!
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
interface Ethernet0
no ip address
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface Vlan1
description Wired LAN interface
ip address 192.168.72.254 255.255.255.0
ip address 192.168.73.254 255.255.255.0 secondary
ip address 192.168.74.254 255.255.255.0 secondary
ip address 192.168.75.254 255.255.255.0 secondary
ip address 192.168.76.254 255.255.255.0 secondary
ip nat inside
ip virtual-reassembly in
!
interface Dialer0
description WAN Interface
ip address 149.135.115.72 255.255.255.0
ip mtu 1492
ip nat outside
ip virtual-reassembly in
encapsulation ppp
ip tcp adjust-mss 1452
dialer pool 1
ppp authentication chap pap callin
ppp chap hostname xxxxx@direct.telstra.net
ppp chap password 0 xxxxx
ppp pap sent-username xxxxx@direct.telstra.net password 0 xxxxx
!
router eigrp 99
network 192.168.72.0 0.0.7.255
network 192.168.254.0
!
ip forward-protocol nd
ip http server
ip http authentication local
no ip http secure-server
!
ip nat inside source list 1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 144.139.198.1
!
dialer-list 1 protocol ip permit
!
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.72.0 0.0.7.255
!
control-plane
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
line con 0
no modem enable
line aux 0
line vty 0 4
password 22xxxxxx
login
transport input all
!
scheduler allocate 20000 1000
