All:
Here is my scenario:
MainSite (DMVPN HUB)- Cisco 2901 - Internal IP - 10.10.20.2
MainSite (Firewall) - Cisco ASA 5525x - Inside IP - 10.10.20.253
Remote Site (DMVPN SPOKE)- Cisco 881 - Inside IP - 10.10.186.1
I want all traffic from the Remote site (including internet traffic) to route through to the Main site and out the ASA for internet access. We have a passive Web Filter at the main site and we need to capture all DMVPN remote site's traffic. We do have an MPLS for a majority of our sites, but about a dozen DMVPN's still exist.
We use EIGRP as our routing protocol.
I have a Core Switch at the Main Site that all servers/devices have their default-gateway set to. IP of 10.10.20.1. It's route of last resort is the ASA Firewall - 10.10.20.253
I have attempted a policy based route map to tag all interesting traffic and set a net-hop route, which does result in the route-map counter to tick up, but internet traffic is still going out the remote sites ISP.
VPN tunnels are up and all internal routing is working well. I've scoured the interweb and haven't found a solution to my question. So I'm hoping someone much more experienced then I at this Cisco Stuff (I'm at best at the CCNA level) can help. Config examples extremely appreciated.
THANKS!!!
Here are the configs for 2 routers: (I'm assuming we don't need the ASA involved here)
SPOKE:
BO-LAB-RTR1#sh run
Building configuration...
Current configuration : 6594 bytes
!
! Last configuration change at 22:02:20 UTC Tue Mar 24 2015 by admin
! NVRAM config last updated at 19:47:01 UTC Tue Mar 24 2015 by brianb
!
version 15.0
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname BO-LAB-RTR1
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 4096
no logging console
!
aaa new-model
!
aaa authentication login local_authen local
aaa authorization exec local_author local
!
aaa session-id common
!
memory-size iomem 10
!
crypto pki trustpoint TP-self-signed-220850891
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-220850891
revocation-check none
rsakeypair TP-self-signed-220850891
!
crypto pki certificate chain TP-self-signed-220850891
certificate self-signed 01
quit
ip source-route
!
ip cef
no ip bootp server
no ip domain lookup
ip domain name mobasin.local
ip port-map user-meraki port udp 7734 7351 7752 description Meraki Cloud comms
ip port-map user-p8443 port tcp 8443 description bcbsnd website
ip port-map user-RDP port tcp 3389 description RDP
ip inspect log drop-pkt
ip inspect name fw realaudio
ip inspect name fw streamworks
ip inspect name fw ssh
ip inspect name fw ftp
ip inspect name fw icmp
ip inspect name fw http
ip inspect name fw https
ip inspect name fw user-meraki
ip inspect name fw user-RDP
ip inspect name fw user-p8443
no ipv6 cef
!
multilink bundle-name authenticated
license udi pid CISCO881-SEC-K9 sn FTX161983RT
!
ip tcp synwait-time 10
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
crypto isakmp key fun2run address 0.0.0.0 0.0.0.0
!
crypto ipsec transform-set DMVPN esp-aes esp-sha-hmac
mode transport
!
crypto ipsec profile DMVPN
set transform-set DMVPN
!
interface Tunnel0
description dmvpn-fargodcn
bandwidth 1000
ip address 10.254.100.186 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication XXXXXXX
ip nhrp map 10.254.100.1 66.97.245.106
ip nhrp map multicast xxx.xxx.245.106
ip nhrp network-id 100000
ip nhrp holdtime 360
ip nhrp nhs 10.254.100.1
ip tcp adjust-mss 1360
delay 1100
tunnel source FastEthernet4
tunnel mode gre multipoint
tunnel key 100000
tunnel protection ipsec profile DMVPN shared
!
interface Null0
no ip unreachables
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $ETH-LAN$$FW_OUTSIDE$
ip address dhcp
ip access-group outside_acl_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip inspect fw out
ip virtual-reassembly
duplex auto
speed auto
!
interface Vlan1
description TestLAN
ip address 10.10.186.1 255.255.255.0
ip access-group inside_acl_in in
ip helper-address 10.10.20.30
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
ip policy route-map vpn
router eigrp 100
network 10.10.186.0 0.0.0.255
network 10.254.100.0 0.0.0.255
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 1000
!
ip nat inside source list 105 interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 dhcp
!
ip access-list extended inside_acl_in
deny ip 72.20.74.0 0.0.0.63 any
deny ip host 255.255.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
permit ip any any
ip access-list extended outside_acl_in
permit udp any any eq bootpc
permit udp any any eq non500-isakmp
permit udp any any eq isakmp
permit gre any any
permit esp any any
permit icmp any any echo-reply
permit icmp any any time-exceeded
permit icmp any any unreachable
permit tcp any any eq 22
deny ip 10.0.0.0 0.255.255.255 any
deny ip 172.16.0.0 0.15.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip host 255.255.255.255 any
deny ip host 0.0.0.0 any
deny ip any any log
!
access-list 104 permit ip 10.10.186.0 0.0.0.255 any
access-list 105 deny ip 10.10.186.0 0.0.0.255 10.10.0.0 0.0.255.255
access-list 105 permit ip 10.10.186.0 0.0.0.255 any
no cdp run
!
route-map vpn permit 10
match ip address 105
set ip next-hop 10.10.20.1
!
HUB
rtr-far-dcn-2901#sh run
Building configuration...
Current configuration : 8380 bytes
!
! Last configuration change at 15:01:00 Denver Tue Mar 24 2015 by brianb
version 15.2
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname rtr-far-dcn-2901
!
boot-start-marker
boot system flash:c2900-universalk9-mz.SPA.152-4.M2.bin
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
!
aaa new-model
!
aaa authentication login local_authen local
aaa authorization exec local_author local
!
aaa session-id common
clock timezone Denver -6 0
clock summer-time Chicago date Apr 6 2003 2:00 Oct 26 2003 2:00
!
no ip source-route
ip cef
!
no ip bootp server
ip domain name mobasin.com
ip inspect log drop-pkt
ip inspect name fw realaudio
ip inspect name fw streamworks
ip inspect name fw ssh
ip inspect name fw ftp
ip inspect name fw icmp
ip inspect name fw dns
ip inspect name fw http
ip inspect name fw https
ip inspect name fw smtp max-data 4294967295
ip inspect name fw ntp
ip inspect name fw imap
ip inspect name fw imaps
ip inspect name fw pop3
ip inspect name fw pop3s
ip inspect name fw tcp
ip inspect name fw udp
no ipv6 cef
!
parameter-map type inspect global
log dropped-packets enable
multilink bundle-name authenticated
!
crypto pki trustpoint TP-self-signed-1061911734
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1061911734
revocation-check none
rsakeypair TP-self-signed-1061911734
!
crypto pki certificate chain TP-self-signed-1061911734
certificate self-signed 01
quit
!
redundancy
!
ip tcp synwait-time 10
no ip ftp passive
ip ssh version 2
csdb tcp synwait-time 30
csdb tcp idle-time 3600
csdb tcp finwait-time 5
csdb tcp reassembly max-memory 1024
csdb tcp reassembly max-queue-length 16
csdb udp idle-time 30
csdb icmp idle-time 10
csdb session max-session 65535
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
!
crypto isakmp policy 2
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 3
authentication pre-share
group 2
!
crypto isakmp policy 4
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 5
hash md5
authentication pre-share
group 2
crypto isakmp key fun2run address 0.0.0.0
!
crypto ipsec transform-set ESP-AES128-SHA esp-aes esp-sha-hmac
mode transport
!
crypto ipsec profile DMVPN
set transform-set ESP-AES128-SHA
!
interface Tunnel0
description vpn - Fargo hub
bandwidth 1000
ip address 10.254.100.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1400
no ip next-hop-self eigrp 100
ip flow ingress
ip nhrp authentication XXXXXX
ip nhrp map multicast dynamic
ip nhrp network-id 100000
ip nhrp holdtime 360
ip tcp adjust-mss 1360
ip policy route-map vpn-internet
delay 1000
tunnel source GigabitEthernet0/1
tunnel mode gre multipoint
tunnel key 100000
tunnel protection ipsec profile DMVPN
!
interface Null0
no ip unreachables
!
interface Embedded-Service-Engine0/0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
shutdown
!
interface GigabitEthernet0/0
description lan - fargo dmvpn gateway
ip address 10.10.20.2 255.255.255.0
ip access-group inside_acl_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
no mop enabled
!
interface GigabitEthernet0/1
description wan - fargo dmvpn gateway
ip address XXX.XXX.245.106 255.255.255.240
ip access-group outside_acl_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip inspect fw out
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/0/0
no ip address
shutdown
!
interface FastEthernet0/0/1
no ip address
shutdown
!
interface FastEthernet0/0/2
no ip address
shutdown
!
interface FastEthernet0/0/3
no ip address
shutdown
!
interface Virtual-Template1
ip unnumbered GigabitEthernet0/1
!
interface Vlan1
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
!
!
router eigrp 100
network 10.10.0.0 0.0.255.255
network 10.254.100.0 0.0.0.255
!
ip forward-protocol nd
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip flow-top-talkers
top 10
sort-by bytes
!
ip nat inside source route-map internet interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 XXX.XXX.245.110
!
ip access-list extended dmvpn-traffic
deny ip 10.10.186.0 0.0.0.255 10.10.0.0 0.0.255.255
permit ip 10.10.186.0 0.0.0.255 any
ip access-list extended inside_acl_in
deny ip host 255.255.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
permit ip any any
ip access-list extended outside_acl_in
permit udp any host XXX.XXX.245.106 eq non500-isakmp
permit udp any host XXX.XXX.245.106 eq isakmp
permit gre any host XXX.XXX.245.106
permit esp any host XXX.XXX.245.106
permit icmp any host XXX.XXX.245.106 echo-reply
permit icmp any host XXX.XXX.245.106 time-exceeded
permit icmp any host XXX.XXX.245.106 unreachable
permit tcp any host XXX.XXX.245.106 eq 22 log
permit udp any any eq bootpc
deny ip 127.0.0.0 0.255.255.255 any
deny ip host 255.255.255.255 any
deny ip host 0.0.0.0 any
deny ip any any log
!
no logging trap
access-list 104 permit ip 10.10.20.0 0.0.0.255 any
access-list 104 permit ip 10.10.16.0 0.0.0.255 any
access-list 104 permit ip 10.10.15.0 0.0.0.255 any
no cdp run
!
route-map internet permit 1
match ip address 104
!
route-map vpn-internet permit 10
match ip address dmvpn-traffic
set ip next-hop 10.10.20.253
!
