11-24-2018
08:13 PM
- last edited on
10-12-2022
03:17 AM
by
Translator
Dear all,
I am beginner for network and some my question is duplicate and very bad to understand.Please forgive me.I would like to ask about DMVPN and IPSec. I have the network diagram for our network.
We have 2 DC .One DC1 and our branches have cisco devices.DC2 are using other vendor. We want to run DMVPN between DC one and our branches .And then branches network and DC2 is IPSec only.Please see below attachment and please help me.
So I would like to know some confusion and please hlep me and explain.
and let me know do i need to put ebgp-multihop 2 ?
Spoke 1
router bgp 102
net 2.2.2.0 mask 255.255.255.0 (lookback ip)
net 22.22.22.0 mask 255.255.255.0
nei 192.168.100.1 remote-as 65300 (192.168.100.1 is tunnel IP)
nei 192.168.100.3 remote-as 65301 (branches 2 tunnel IP and AS )
nei 192.168.100.3 ebgp-multihop 2
Solved! Go to Solution.
11-26-2018
07:05 AM
- last edited on
10-12-2022
03:26 AM
by
Translator
Hi,
You can run BGP, EIGRP or OSPF as the overlay routing protocol. The spokes only need to peer with the Hub, the spokes do not need to peer with each other. This cisco live presentation provides more information about suggested protocols to use, EIGRP or BGP should be fine, BGP might be considered more complex to configure.
I would definately suggest you purchase another router for DC2 in order to run a second DMVPN hub rather than a static IPSec VPN to another device. This would allow you to have full resilency for the DMVPN topology, because if DC1 Hub fails you'd have no spoke-to-spoke connectivity. In addition the complexity of the overall configuration would be greatly simplified.
Assuming the certificate of all the devices is issued from the same Certificate Authority and the issuer-name for example was pki-ca, then you'd use the following example for the certificate map:-
crypto pki certificate map CERT_MAP 1
issuer-name co cn = pki-ca
If you have 2 ISP's on one router then you could use place each physical interface in a unique VRF, create a default route per VRF, then define 2 separate tunnel interfaces. Each tunnel interface would have a different tunnel source. You would use define a delay on the tunnel interface to make one tunnel preferred over the other. This link provides information on this scenario.
HTH
11-25-2018 05:27 PM
11-26-2018
07:05 AM
- last edited on
10-12-2022
03:26 AM
by
Translator
Hi,
You can run BGP, EIGRP or OSPF as the overlay routing protocol. The spokes only need to peer with the Hub, the spokes do not need to peer with each other. This cisco live presentation provides more information about suggested protocols to use, EIGRP or BGP should be fine, BGP might be considered more complex to configure.
I would definately suggest you purchase another router for DC2 in order to run a second DMVPN hub rather than a static IPSec VPN to another device. This would allow you to have full resilency for the DMVPN topology, because if DC1 Hub fails you'd have no spoke-to-spoke connectivity. In addition the complexity of the overall configuration would be greatly simplified.
Assuming the certificate of all the devices is issued from the same Certificate Authority and the issuer-name for example was pki-ca, then you'd use the following example for the certificate map:-
crypto pki certificate map CERT_MAP 1
issuer-name co cn = pki-ca
If you have 2 ISP's on one router then you could use place each physical interface in a unique VRF, create a default route per VRF, then define 2 separate tunnel interfaces. Each tunnel interface would have a different tunnel source. You would use define a delay on the tunnel interface to make one tunnel preferred over the other. This link provides information on this scenario.
HTH
11-26-2018
04:53 PM
- last edited on
10-12-2022
03:33 AM
by
Translator
Hi ,
Thanks alot your help.before I read your suggested links I would like to ask .
For DC2,
I have the plan to change cisco device.but now we need to run on existing devices.my main challenge is on DC 2.
So DC2 is not using DMVPN now,try to use IPSec VPN only.So may i know can I use IPSec VPN only to all branches.can be? if I run BGP for DC2 how to peer .Because bgp peering is doing on router infornt of firewall.FW will do ipsec.is it limitation ,correct ? if i want to use eigrp canot because my firewall didn't support.my firewall support bgp and ospf.ospf cannot run on IPSec ,correct ? if i want to use ospf i need to use GRE over IPSec ? So may i know for DC 2,
Which scenario is the best ?
1.IPSec with ACL (policy base)
2.IPsec with BGP
3.GRE over IPsec with (OSPF)
For certificate enrollment,
May I know do I need tto put isusser-name as subject-name?
I mean eg.
enrollment terminal
subject-name Cn=r1,Cn=issuer-name?
or
enrollment terminal
subject-name Cn=r1 is enough?
For DMVPN,
We have plan to add another router next three month.So second ISP link will move to next router.So i need temporary configuration for second tunnel.
If I use bgp,1 AS number for each site,correct?
I am using eBGP for isp peering ,shout I use ebgp or ibgp?
If bgp is so complex for configuration,which protocol should I use?
May I know if I request to remove ebgp peering with isp and if I use default route only for isp,can I get some limitations for dmvpn? Because ebgp make me headache
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide