cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Community Helping Community

914
Views
160
Helpful
67
Replies
Beginner

DMVPN and Point-to-Point (IPSec)

Dear All,

PLease help me:

  1. I would like to know DMVPN and Point to Point (IPSec) can run in one router ? I mean two type of VPN can run together ?
  2. If i will use GBP for DMVPN ,how many RAM will need in minimum ?
  3. For BGP in DMVPN, my remote as is ISP AS number and PE router IP(gateway IP)?
  4. For my DMVPN,can I use AS number are (100,200,300 etc) ?
Everyone's tags (1)
5 ACCEPTED SOLUTIONS

Accepted Solutions
VIP Advisor

Re: DMVPN and Point-to-Point (IPSec)

Hi

 

Here are answers for your questions:

1. Yes you can have both dmvpn and ipsec L2L running at the same time. How many interfaces do you have for this? 

 

2. How many tunnels do you want to run amd on which platform?

 

3. Don't understand this question. The AS used for your dmvpn will be 1 private AS which has nothing to do with your ISP AS. I mean, after all you can do many kind of designs but the one i explained is the simplest and straight one.

 

4. You should use private rfc bgp as instead of the ones you're talking about. If you're sure that these routes won't never be distributed/exchanged with public AS (like your isp), technically you can use them. I highly believe that these bgp routes learned through your dmvpn will always stay private and it should work but i also highly recommend that you confirm with AS number convention using rfc private AS.


Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

View solution in original post

VIP Advisor

Re: DMVPN and Point-to-Point (IPSec)

On your question 2, why you want to have dmvpn tunnel and ipsec vpn for each site? It's useless as they'll both terminate on same hub device as i understood.

The memory is kind of tricky one because it depends on how many prefixes will be in the bgp table, what attributes are used.....
Here an example the full bgp table:
https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/12512-41.html

In the past, i tried to make a kind of average and the result was around 150 bytes. This is a simple route calculation. When using filters, other attributes like community consumption will be higher.

 

The real question will also be how many vpn tunnels you can have on your platform, specially your hub.

i doubt in your dmvpn cloud you'll thousands and thousands of prefixes which led me to say you will probably consume something less than 100Mb or even saturate the memory.

 

Why do you want to have vpn cert and 802.1x certs to be the same?

Vpn and 802.1x don't share the same certificate template.


Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

View solution in original post

VIP Advisor

Re: DMVPN and Point-to-Point (IPSec)

Yes you can run both. I've done same design for a customer on an asr and everything works like a charm.

It's up to you if you want to run ibgp or ebgp and depends on your design.
Actually, ebgp will be simple and you won't need to deal with ibgp limitations if i can say so.


Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

View solution in original post

VIP Advisor

Re: DMVPN and Point-to-Point (IPSec)

Yes this will helps learning all mpls routes to build tunnels. You can control what you want to advertise. For example, if you're adding dmvpn on top of mpls, you'll just advertise your loopbacks and your ce-to-pe prefixes, then build the dmvpn and run bgp to learn all internal subnets from each site.

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

View solution in original post

VIP Advisor

Re: DMVPN and Point-to-Point (IPSec)

Ok I'm getting lost here. You're moving and switching with different questions at the same time.
Ikev2 has some advanced features compared to ikev1 like nat traversal, eap support, ....
Take a look here:
https://en.m.wikipedia.org/wiki/Internet_Key_Exchange

There are many documents in internet going into details.

I talked about bgp local pref to prefer routes from a tunnel against the other.

You can apply local-pref on the neighbor with empty match statement in the route-maps to prefer all receiving routes from that neighbor. If you use a route-map with match statement then you'll apply a local-pref on specific routes.

You'll have 2 tunnels but not mandatory to have a different nhrp id. They can be part of the same dmvpn cloud.

On spoke side: if you mean priority on hubs then you can play with nhrp cluster. If you have 2 tunnel interfaces and you want to prioritize a tunnel over the other, you can play with routing.

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

View solution in original post

67 REPLIES 67
VIP Advisor

Re: DMVPN and Point-to-Point (IPSec)

Hi

 

Here are answers for your questions:

1. Yes you can have both dmvpn and ipsec L2L running at the same time. How many interfaces do you have for this? 

 

2. How many tunnels do you want to run amd on which platform?

 

3. Don't understand this question. The AS used for your dmvpn will be 1 private AS which has nothing to do with your ISP AS. I mean, after all you can do many kind of designs but the one i explained is the simplest and straight one.

 

4. You should use private rfc bgp as instead of the ones you're talking about. If you're sure that these routes won't never be distributed/exchanged with public AS (like your isp), technically you can use them. I highly believe that these bgp routes learned through your dmvpn will always stay private and it should work but i also highly recommend that you confirm with AS number convention using rfc private AS.


Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

View solution in original post

Beginner

Re: DMVPN and Point-to-Point (IPSec)

Hi Francesco Molino,

Thanks for your Help :

  1. I have one interface for each site .
  2. I have two tunnel per each site (1 for DMVPN ,1 for IPSec )and now i have about 8 sites and later will be around over 100 .So i want to calculate minimal RAM requirement for this.I didn't know minimal RAM requirement for BGP.So i want to know?
  3. I also confuse this question myself,I really don't know how to integrate my network and ISP Mega port for DMVPN
    So my question is stupid because i ask generally.
  4. Noted with thanks
  5. I want to know other question,I want to use 802.1x with certificate .Can i use the same Cert for 802.1x that used for VPN ? I mean can i use 1 certificate for both .1x and VPN per site? i will use MS CA server.
VIP Advisor

Re: DMVPN and Point-to-Point (IPSec)

On your question 2, why you want to have dmvpn tunnel and ipsec vpn for each site? It's useless as they'll both terminate on same hub device as i understood.

The memory is kind of tricky one because it depends on how many prefixes will be in the bgp table, what attributes are used.....
Here an example the full bgp table:
https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/12512-41.html

In the past, i tried to make a kind of average and the result was around 150 bytes. This is a simple route calculation. When using filters, other attributes like community consumption will be higher.

 

The real question will also be how many vpn tunnels you can have on your platform, specially your hub.

i doubt in your dmvpn cloud you'll thousands and thousands of prefixes which led me to say you will probably consume something less than 100Mb or even saturate the memory.

 

Why do you want to have vpn cert and 802.1x certs to be the same?

Vpn and 802.1x don't share the same certificate template.


Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

View solution in original post

Beginner

Re: DMVPN and Point-to-Point (IPSec)

Thank a lot,

I have two DC they have different services and different servers.One DC support DMVPN and Old DC doesn't support DMVPN they are not using Cisco devices. we will use DMVPN for some service and L2L for other services.So i want to run two type of VPN in each branch sites.Just i want to know it is possible or not ?

For DMVPN ,which protocol is most prefer ? iBGP or eBGP? if i  consider to use eBGP ,let me know any concern or challenge ?

 

 

VIP Advisor

Re: DMVPN and Point-to-Point (IPSec)

Yes you can run both. I've done same design for a customer on an asr and everything works like a charm.

It's up to you if you want to run ibgp or ebgp and depends on your design.
Actually, ebgp will be simple and you won't need to deal with ibgp limitations if i can say so.


Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question

View solution in original post

Beginner

Re: DMVPN and Point-to-Point (IPSec)

Hi Francesco Molino,

Thank for your help.I have one more question,if i use two wan link in one router for HUB(now i have only one router ,later i will add one router) .I need to use vrf for DMVPN to get redundancy ? Do we have other way for fail-over wan without using VRF?

 

 

VIP Advisor

Re: DMVPN and Point-to-Point (IPSec)

No it's not mandatory to have vrf. You can have all in the same vrf or global routing and make one primary by playing with routing protocol or by configuring nhrp cluster on spoke side.


Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question
Beginner

Re: DMVPN and Point-to-Point (IPSec)

Hi Francesco Molino,

I just want to know the best practice way for this.if i use IP SLA for wan link fail over,it is best pracitise ? Or create 2 DMVPN tunnles on the hub and configuring nhrp cluster on spoke side ?

Because i use second want link is using as a backup link only.i don't want to run vrf because if i will get another router for that backup wan link, i need to sparate those two link.if i use vrf i need to change configuration,right? So let me know which is the best paractise for WAN fail over for DMVPN ,please?

VIP Advisor

Re: DMVPN and Point-to-Point (IPSec)

As you want to do dmvpn, using default route with sla won't help you in building the 2nd tunnel.
You have 2 simple options here:
- add an ip sla on your default route as you suggested with a second default route having a higher distance. + EEM script to no shut the backup tunnel when primary link is down and the invert when it's up.

The second solution would be:
- add a specific route to reach a 2nd hub ip through isp2
- configure nhrp cluster.

On the hub router, you'll have 2 different public IPs to terminate tunnels?
If not, only solution 1 would fit better.

If you have a design, i can help you out with the config. The design should mention your ips (don't put real public ips but fakes).

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question
Beginner

Re: DMVPN and Point-to-Point (IPSec)

Hi Francesco Molino,

Thanks.If you help with config it is very useful for me.It make me headache every day now :P

.We have two option but i don't know jet with service should we use.ISP told their service is Layer 3 MPLS.Please see the design diagram.Let me know any concern for design ? Our CA server is in DC2 we will use this certificate server for both IPSec and DMVPN. i want to run BGP for DMVPN.I think IPSec also can carry BGP,right? we can use IPSec with BGP ?

VIP Advisor

Re: DMVPN and Point-to-Point (IPSec)

You have 2 CE at your DC which means you can have 1 tunnel per CE. As you're running bgp, you can have both tunnels up at the same time and use local-pref to choose 1 tunnel as primary versus the other. Same can apply at spoke level. This is the simplest way.
Yes you can have bgp peeing over ipsec.

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question
Beginner

Re: DMVPN and Point-to-Point (IPSec)

Hi Francesco Molino,

I have not much experience in DMVPN with bgp.I have experience in DMVPN with eigrp.

But i can't not find any sample for DMVPN with bgp in internet.if you know the links or sample lab. let me know ,please ? 

 

VIP Advisor

Re: DMVPN and Point-to-Point (IPSec)

This is not so much different a DMVPN using EIGRP or BGP as routing protocol.
Here some links:
- https://networklessons.com/cisco/ccie-routing-switching/dmvpn-phase-3-bgp-routing/
- https://packetpushers.net/designing-a-multi-region-multi-hub-phase-3-dmvpn-with-bgp/

You can start building your config the same way you'll do with EIGRP but instead config BGP protocol. Then you can share what you did if you have issues and I can help to solve them or tweak them with what we discussed (LOCAL-PREF)

Thanks
Francesco
PS: Please don't forget to rate and select as validated answer if this answered your question
Beginner

Re: DMVPN and Point-to-Point (IPSec)

Hi,

I alittle confuse in our CE and ISP PE router.ISP provide MPLS L3 service.ISP want me to run BGP between our CE routers and their PE routers.So can i use private AS for each sites ,How is it ? 

CreatePlease to create content
Content for Community-Ad