Need assistance with CGNAT/NAT within DMVPN environment

[Gene Geng]

My objective whether using Starlink, TMHI, or other vendor that uses CGNAT/NAT to give out IP addresses (Starlink 100.64.0.0 or TMHI 192.168.12.0) is to configure DHCP on the physical interface for Remote2-vpn router on the drawing and NAT into an ip address that I can control (192.168.23.2) and about to talk to other nodes like 172.16.200.1 and 172.16.200.128.

I have the DHCP/Translation working (if I designed/configured it right) but I cannot ping 172.16.200.1 or 172.16.200.128.

Any help is GREATLY appreciated.

Attached is the DMVPN config parts of the DHCP router remote2-vpn and a drawing.

[Torbjørn]

You will need to provide a bit more info to be able to help you. What is the output of show dmvpn, show ip eigrp neighbour and show ip route? Can you post the config + show commands rom the hub as well? 

[MHM Cisco World]

for any spoke behind NAT

use ipsec transform AH not ESP and use transport not tunnel mode 

MHM

[Gene Geng]

Thanks for the response. I've changed my crypto ipsec transform-set to:

crypto ipsec transform-set nex_ts ah-sha-hmac

 mode transport. After this change, I was unable to ping 172.16.200.1. I'm assuming you have to match the transport on the headend router (hqvpn) which I did.

I took out all the NAT stuff and went back to the original DMVPN configuration with a static ip address on Gi0/1 just to make sure I could ping 172.16.200.1 and 172.16.200.128. All pings.

When i start doing NAT and DHCP, thats where i'm unsure. We've always used transport mode tunnel and ESP.

What I'm trying to do is: normally when we order a mpls circuit or internet circuit we ask for a static IP address. Of course, Starlink and TMHI cannot give you a static IP. 

We use the static IP address in ACLs to allow/deny what each router in our DMVPN environment can talk to and cannot talk to.

Any other ideas?

[MHM Cisco World]

sorry can you more elaborate
and for using ACL you can use ACL or you can filter subnet to make some Spoke LAN is hidden from other Spoke and Hub

MHM 

[Gene Geng]

ip access-list extended VPN  {this ACL we configure on the outside interface on the circuit, Gi0/1 and always ip access-group VPN in}
permit ip host 192.168.123.2 host 192.168.23.2
permit ip host 192.168.223.2 host 192.168.23.2

We have this similar ACL on all of DMVPN spokes.

it permits other Spokes outside IP address [from Cox, Lumen, etc] to communicate with this local router Physical outside IP address. That's how we control what talks with what in our DMVPN/Internet environment.