Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

DMVPN. Spoke to Spoke

Всем привет. Имеется DMVPN Phase 2 закрытый IPSECом. Возникла проблема Spoke не общаются между собой, проблема в установлении первоначального IKE канала. Ввиду того, ведь обмен данными идет через Hub. Не могу понять в чем причина. Подскажите пожалуйста.

 

Hi all. 

 

We've created a DMVPN Phase 2 topology with IPSec. But spokes didnt communicate with each other, all communication are through Hub. There is a problem in Phase one i think. Can you help please

 

 

Config -  Hub-MAIN

crypto keyring DMVPN
pre-shared-key address 0.0.0.0 0.0.0.0 key !QAZ1qaz

crypto isakmp policy 5
encr aes 256
authentication pre-share
group 2

crypto isakmp profile DMVPN
keyring DMVPN
match identity address 0.0.0.0

crypto ipsec transform-set DMVPN esp-aes esp-sha-hmac
mode transport

crypto ipsec profile DMVPN
set transform-set DMVPN
set isakmp-profile DMVPN

interface Tunnel10
description HUB
bandwidth 1000000
ip address 172.16.10.1 255.255.255.0
no ip redirects
ip mtu 1400
no ip next-hop-self eigrp 1
no ip split-horizon eigrp 1
ip nhrp authentication 12345
ip nhrp map multicast dynamic
ip nhrp network-id 10
delay 1000
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 10
tunnel protection ipsec profile DMVPN shared

interface FastEthernet0/0
ip add 20.20.20.1 255.255.255.0

interface FastEthernet0/1
ip address 10.0.0.1 255.255.255.0
ip ospf priority 50
ip ospf 1 area 0
duplex auto
speed auto

router eigrp 1
no auto-summary
network 10.0.0.0 0.0.0.255
network 172.16.10.0 0.0.0.255

Конфиг Hub-BACK

crypto keyring DMVPN
pre-shared-key address 0.0.0.0 0.0.0.0 key !QAZ1qaz

crypto isakmp policy 5
encr aes 256
authentication pre-share
group 2

crypto isakmp profile DMVPN
keyring DMVPN
match identity address 0.0.0.0

crypto ipsec transform-set DMVPN esp-aes esp-sha-hmac
mode transport

crypto ipsec profile DMVPN
set transform-set DMVPN
set isakmp-profile DMVPN

interface Tunnel10
description HUB
bandwidth 1000000
ip address 172.16.20.1 255.255.255.0
no ip redirects
ip mtu 1400
no ip next-hop-self eigrp 1
no ip split-horizon eigrp 1
ip nhrp authentication 12345
ip nhrp map multicast dynamic
ip nhrp network-id 20
delay 10000
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 20
tunnel protection ipsec profile DMVPN shared

interface FastEthernet0/0
ip add 30.30.30.1 255.255.255.0

interface FastEthernet0/1
ip address 10.20.0.1 255.255.255.0
ip ospf priority 50
ip ospf 1 area 0
duplex auto
speed auto

router eigrp 1
no auto-summary
network 10.20.0.0 0.0.0.255
network 172.16.20.0 0.0.0.255


Config - Spoke1

crypto keyring DMVPN
pre-shared-key address 0.0.0.0 0.0.0.0 key !QAZ1qaz

crypto isakmp policy 5
encr aes 256
authentication pre-share
group 2

crypto isakmp profile DMVPN
keyring DMVPN
match identity address 0.0.0.0

crypto ipsec transform-set DMVPN esp-aes esp-sha-hmac
mode transport

interface Tunnel10
description SPOKE1-MAIN
bandwidth 1000000
ip address 172.16.10.100 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication 12345
ip nhrp map multicast 20.20.20.1
ip nhrp map 172.16.10.1 20.20.20.1
ip nhrp nhs 172.16.10.1
ip nhrp network-id 10
delay 1000
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 10
tunnel protection ipsec profile DMVPN shared

interface Tunnel11
description SPOKE1-BACK
bandwidth 1000000
ip address 172.16.20.100 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp map multicast 30.30.30.1
ip nhrp map 172.16.20.1 30.30.30.1
ip nhrp nhs 172.16.20.1
ip nhrp network-id 20
delay 10000
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 20
tunnel protection ipsec profile DMVPN shared

interface FastEthernet0/1
ip address 10.0.1.1 255.255.255.0
ip ospf priority 50
ip ospf 1 area 0
duplex auto
speed auto

router eigrp 1
no auto-summary
network 10.0.1.0 0.0.0.255
network 172.16.10.0 0.0.0.255
network 172.16.20.0 0.0.0.255

Config -  Spoke2

crypto keyring DMVPN
pre-shared-key address 0.0.0.0 0.0.0.0 key !QAZ1qaz

crypto isakmp policy 5
encr aes 256
authentication pre-share
group 2

crypto isakmp profile DMVPN
keyring DMVPN
match identity address 0.0.0.0

crypto ipsec transform-set DMVPN esp-aes esp-sha-hmac
mode transport

interface Tunnel10
description SPOKE1-MAIN
bandwidth 1000000
ip address 172.16.10.200 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication 12345
ip nhrp map multicast 20.20.20.1
ip nhrp map 172.16.10.1 20.20.20.1
ip nhrp nhs 172.16.10.1
ip nhrp network-id 10
delay 1000
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 10
tunnel protection ipsec profile DMVPN shared

interface Tunnel11
description SPOKE1-BACK
bandwidth 1000000
ip address 172.16.20.200 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp map multicast 30.30.30.1
ip nhrp map 172.16.20.1 30.30.30.1
ip nhrp nhs 172.16.20.1
ip nhrp network-id 20
delay 10000
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 20
tunnel protection ipsec profile DMVPN shared

interface FastEthernet0/1
ip address 10.0.2.1 255.255.255.0
ip ospf priority 50
ip ospf 1 area 0
duplex auto
speed auto

router eigrp 1
no auto-summary
network 10.0.2.0 0.0.0.255
network 172.16.10.0 0.0.0.255
network 172.16.20.0 0.0.0.255

 

 

Spokes see each other

ISAKMP stops in this step

1.2.3.4 10.11.12.13 CONF_XAUTH 1005 ACTIVE
1.2.3.4 10.11.12.13 MM_NO_STATE 1004 ACTIVE (deleted)

Here is debug

May 12 05:24:18.576: ISAKMP:(0):Proposed key length does not match policy
May 12 05:24:18.576: ISAKMP:(0):atts are not acceptable. Next payload is 3
May 12 05:24:18.576: ISAKMP:(0):Encryption algorithm offered does not match policy!
May 12 05:24:18.576: ISAKMP:(0):atts are not acceptable. Next payload is 3

May 12 05:24:33.936: ISAKMP:(1006):deleting SA reason "IKMP_ERR_NO_RETRANS" state (R) CONF_XAUTH (peer 10.11.12.13 )
May 12 05:24:33.940: ISAKMP:(1006):deleting SA reason "IKMP_ERR_NO_RETRANS" state (R) CONF_XAUTH (peer 1 10.11.12.13 )

Everyone's tags (1)
1 REPLY
Community Member

Can anyone help?

Can anyone help?

136
Views
0
Helpful
1
Replies
CreatePlease to create content