Ipsec dynamic map with certificate

[MrBeginner]

Hi,

i would like to do hub and spoke vpn setup.i already tested dynamic map with preshare key.

1. let me know can we do dynamic map using certificate.let me know the sample config or reference link?
2. do we have other way to create  multi ipsec tunnel on hub router without using dynamic map? i want to use pure ipsec.i caanot use gre or vti.

[Rob Ingram]

Hi @MrBeginner 

You are using Cisco IOS router right? or ASA/FTD?

If using hub and spoke, the recommended approach would be FlexVPN or DMVPN, assuming you are using a cisco router. Cisco considers crypto maps as legacy. Most up to date cisco documentation for cisco IOS router VPNs, is based on FlexVPN and to a lesser extent DMVPN.

What certificate authority are you intending to use IOS router, Microsoft CA or?

Links:

FlexVPN certificate authentication

IOS Router certificate enrolment

[MrBeginner]

Hi @Rob Ingram ,

I cannot use DMVPN Hub is cisco router and spoke are different brands. So i consider dynamic map.

i will use microsoft ca.

Let me know any issue on dynamic map with certificate ?

I also want to know ipsec tunnel can carry ospf route ?

[Rob Ingram]

@MrBeginner Ok, what are the other vendors used? You can't run a routing protocol over a crypto map without using GRE. If you cannot use a routing protocol over the VPN, you can use Reverse Route Injection (RRI) to learn the VPN routes for established tunnels and redistribute them locally via routing protocol.

[MrBeginner]

Hi ,

I would like to know if i apply ipsec profile on WAN interface and soure is WAN IP and BGP neighbor relationship is also using WAN IP, it is any problem on encryption ? 

[Rob Ingram]

@MrBeginner 

I assume you mean apply crypto map to the WAN interface? If so, then if the WAN interface IP address and the BGP peer is not defined in the crypto ACL (to define the interesting traffic) then the traffic would never match, nor attempted to be encrypted. It should therefore be fine.