Abort that approach. Use certificates instead. The approach below will be good for about 500 nodes (I deliberately turn CDP on - because the diagnostics are great but it wont scale really really big).
The below will need 15.2 or better. Do not attempt it on 15.1 or below.
Hub configuration something like:
aaa new-model
aaa authentication login default local
aaa authentication login userlist local
aaa authentication ppp default local
aaa authorization exec default local
aaa authorization network default local
aaa authorization network grouplist local
crypto pki server ca-server-ak
database level names
database archive pem password xxxx
lifetime certificate 3650
lifetime ca-certificate 7305 23 59
auto-rollover 365
database url flash:
crypto pki trustpoint ca-server-ak
revocation-check crl
rsakeypair ca-server-ak
crypto pki trustpoint ca-client-ak
enrollment url http://<head end public ip>:80
revocation-check crl
rsakeypair ca-client-ak
auto-enroll regenerate
crypto pki certificate map ca-certificate-map 10
issuer-name eq cn = ca-server-ak
crypto ikev2 authorization policy default
pool FlexSpokes
route set interface
!
crypto ikev2 proposal default
encryption aes-cbc-256 aes-cbc-192 aes-cbc-128
integrity sha512 sha384 sha256
group 21
crypto ikev2 profile Flex_IKEv2
match certificate ca-certificate-map
authentication remote rsa-sig
authentication local rsa-sig
pki trustpoint ca-client-ak
aaa authorization group cert list default default
virtual-template 1
crypto ipsec transform-set ikev2 esp-gcm 256
mode transport
!
crypto ipsec profile default
set transform-set ikev2
set pfs group24
set ikev2-profile Flex_IKEv2
interface Loopback230
ip address 172.16.230.1 255.255.255.255
interface Virtual-Template1 type tunnel
bandwidth 2000
ip unnumbered Loopback230
ip nhrp network-id 2
cdp enable
tunnel path-mtu-discovery
tunnel protection ipsec profile default
ip local pool FlexSpokes 169.254.0.1 169.254.1.254
And a spoke configuration something like:
aaa new-model
aaa authentication login default local
aaa authentication login userlist local
aaa authentication ppp default local
aaa authorization exec default local
aaa authorization network default local
aaa authorization network grouplist local
crypto pki trustpoint ca-client-ak
enrollment url http://<head end public IP>:80
revocation-check crl
rsakeypair ca-client-ak
auto-enroll regenerate
crypto pki certificate map ca-certificate-map 10
issuer-name co ca-server-ak
crypto ikev2 proposal default
encryption aes-cbc-256 aes-cbc-192 aes-cbc-128
integrity sha512 sha384 sha256
group 21
crypto ikev2 profile Flex_IKEv2
match certificate ca-certificate-map
authentication remote rsa-sig
authentication local rsa-sig
pki trustpoint ca-client-ak
aaa authorization group cert list default default
crypto ikev2 dpd 15 3 on-demand
crypto ipsec transform-set ikev2 esp-gcm 256
mode transport
crypto ipsec profile default
set transform-set ikev2
set pfs group24
set ikev2-profile Flex_IKEv2
interface Tunnel230
bandwidth 2000
ip address negotiated
ip nhrp network-id 2
ip tcp adjust-mss 1360
cdp enable
tunnel source <outside interface or public IP address>
tunnel destination <head end public IP>
tunnel path-mtu-discovery
tunnel protection ipsec profile default
No all you need to do is slap whatever routing you want in. EIGRP or BGP with peer groups are good choices. Also read up on manually requesting and approving certificates on the hub CA server.
