DMVPN and Point-to-Point (IPSec)

[UCrypto]

Dear All,

PLease help me:

1. I would like to know DMVPN and Point to Point (IPSec) can run in one router ? I mean two type of VPN can run together ?
2. If i will use GBP for DMVPN ,how many RAM will need in minimum ?
3. For BGP in DMVPN, my remote as is ISP AS number and PE router IP(gateway IP)?
4. For my DMVPN,can I use AS number are (100,200,300 etc) ?

[Francesco Molino · Accepted solution]

Hi

Here are answers for your questions:

1. Yes you can have both dmvpn and ipsec L2L running at the same time. How many interfaces do you have for this? 

2. How many tunnels do you want to run amd on which platform?

3. Don't understand this question. The AS used for your dmvpn will be 1 private AS which has nothing to do with your ISP AS. I mean, after all you can do many kind of designs but the one i explained is the simplest and straight one.

4. You should use private rfc bgp as instead of the ones you're talking about. If you're sure that these routes won't never be distributed/exchanged with public AS (like your isp), technically you can use them. I highly believe that these bgp routes learned through your dmvpn will always stay private and it should work but i also highly recommend that you confirm with AS number convention using rfc private AS.

[UCrypto]

Hi Francesco Molino,

Thanks for your Help :

1. I have one interface for each site .
2. I have two tunnel per each site (1 for DMVPN ,1 for IPSec )and now i have about 8 sites and later will be around over 100 .So i want to calculate minimal RAM requirement for this.I didn't know minimal RAM requirement for BGP.So i want to know?
3. I also confuse this question myself,I really don't know how to integrate my network and ISP Mega port for DMVPN
   So my question is stupid because i ask generally.
4. Noted with thanks
5. I want to know other question,I want to use 802.1x with certificate .Can i use the same Cert for 802.1x that used for VPN ? I mean can i use 1 certificate for both .1x and VPN per site? i will use MS CA server.

[Francesco Molino · Accepted solution]

On your question 2, why you want to have dmvpn tunnel and ipsec vpn for each site? It's useless as they'll both terminate on same hub device as i understood.

The memory is kind of tricky one because it depends on how many prefixes will be in the bgp table, what attributes are used.....
Here an example the full bgp table:
https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/12512-41.html

In the past, i tried to make a kind of average and the result was around 150 bytes. This is a simple route calculation. When using filters, other attributes like community consumption will be higher.

The real question will also be how many vpn tunnels you can have on your platform, specially your hub.

i doubt in your dmvpn cloud you'll thousands and thousands of prefixes which led me to say you will probably consume something less than 100Mb or even saturate the memory.

Why do you want to have vpn cert and 802.1x certs to be the same?

Vpn and 802.1x don't share the same certificate template.

[UCrypto]

Thank a lot,

I have two DC they have different services and different servers.One DC support DMVPN and Old DC doesn't support DMVPN they are not using Cisco devices. we will use DMVPN for some service and L2L for other services.So i want to run two type of VPN in each branch sites.Just i want to know it is possible or not ?

For DMVPN ,which protocol is most prefer ? iBGP or eBGP? if i  consider to use eBGP ,let me know any concern or challenge ?

[Francesco Molino · Accepted solution]

Yes you can run both. I've done same design for a customer on an asr and everything works like a charm.

It's up to you if you want to run ibgp or ebgp and depends on your design.
Actually, ebgp will be simple and you won't need to deal with ibgp limitations if i can say so.

[UCrypto]

Hi Francesco Molino,

Thank for your help.I have one more question,if i use two wan link in one router for HUB(now i have only one router ,later i will add one router) .I need to use vrf for DMVPN to get redundancy ? Do we have other way for fail-over wan without using VRF?

[Francesco Molino]

No it's not mandatory to have vrf. You can have all in the same vrf or global routing and make one primary by playing with routing protocol or by configuring nhrp cluster on spoke side.

[UCrypto]

Hi Francesco Molino,

I just want to know the best practice way for this.if i use IP SLA for wan link fail over,it is best pracitise ? Or create 2 DMVPN tunnles on the hub and configuring nhrp cluster on spoke side ?

Because i use second want link is using as a backup link only.i don't want to run vrf because if i will get another router for that backup wan link, i need to sparate those two link.if i use vrf i need to change configuration,right? So let me know which is the best paractise for WAN fail over for DMVPN ,please?

[Francesco Molino]

As you want to do dmvpn, using default route with sla won't help you in building the 2nd tunnel.
You have 2 simple options here:
- add an ip sla on your default route as you suggested with a second default route having a higher distance. + EEM script to no shut the backup tunnel when primary link is down and the invert when it's up.

The second solution would be:
- add a specific route to reach a 2nd hub ip through isp2
- configure nhrp cluster.

On the hub router, you'll have 2 different public IPs to terminate tunnels?
If not, only solution 1 would fit better.

If you have a design, i can help you out with the config. The design should mention your ips (don't put real public ips but fakes).

[UCrypto]

Hi Francesco Molino,

Thanks.If you help with config it is very useful for me.It make me headache every day now :P

.We have two option but i don't know jet with service should we use.ISP told their service is Layer 3 MPLS.Please see the design diagram.Let me know any concern for design ? Our CA server is in DC2 we will use this certificate server for both IPSec and DMVPN. i want to run BGP for DMVPN.I think IPSec also can carry BGP,right? we can use IPSec with BGP ?

[Francesco Molino]

You have 2 CE at your DC which means you can have 1 tunnel per CE. As you're running bgp, you can have both tunnels up at the same time and use local-pref to choose 1 tunnel as primary versus the other. Same can apply at spoke level. This is the simplest way.
Yes you can have bgp peeing over ipsec.

[UCrypto]

Hi Francesco Molino,

I have not much experience in DMVPN with bgp.I have experience in DMVPN with eigrp.

But i can't not find any sample for DMVPN with bgp in internet.if you know the links or sample lab. let me know ,please ? 

[Francesco Molino]

This is not so much different a DMVPN using EIGRP or BGP as routing protocol.
Here some links:
- https://networklessons.com/cisco/ccie-routing-switching/dmvpn-phase-3-bgp-routing/
- https://packetpushers.net/designing-a-multi-region-multi-hub-phase-3-dmvpn-with-bgp/

You can start building your config the same way you'll do with EIGRP but instead config BGP protocol. Then you can share what you did if you have issues and I can help to solve them or tweak them with what we discussed (LOCAL-PREF)

[UCrypto]

Hi,

I alittle confuse in our CE and ISP PE router.ISP provide MPLS L3 service.ISP want me to run BGP between our CE routers and their PE routers.So can i use private AS for each sites ,How is it ?