DMVPN Configuration
R1#conf terminal
R1(config)#in lo 0
R1(config-if)#ip address 10.1.1.1 255.255.255.0
R1(config-if)#in fas 0/0
R1(config-if)#ip address 51.10.1.2 255.255.255.252
R1(config-if)#no shutdown
R2#conf terminal
R2(config)#in lo 0
R2(config-if)#ip address 10.1.2.1 255.255.255.0
R2(config-if)#in fas 0/0
R2(config-if)#ip address 51.10.2.2 255.255.255.252
R2(config-if)#no shutdown
R3#conf terminal
R3(config)#in lo 0
R3(config-if)#ip address 10.1.3.1 255.255.255.0
R3(config-if)#in fas 0/0
R3(config-if)#ip address 51.10.3.2 255.255.255.0
R3(config-if)#no shutdown
* Static Routes needed
! Configure Tunnel
! Hub
R1(config)#interface tunnel 0
R1(config-if)#tunnel source fastEthernet 0/0
R1(config-if)#tunnel mode gre multipoint
R1(config-if)#tunnel key 1234
R1(config-if)#ip nhrp network-id 1
R1(config-if)#ip nhrp authentication asdfasdf
R1(config-if)#ip nhrp map multicast dynamic
R1(config-if)#ip address 192.168.0.1 255.255.255.0
R1(config-if)#ip mtu 1400
R1(config-if)#ip tcp adjust-mss 1360
! Spokes
R2(config)#in tunnel 0
R2(config-if)#tunnel source fas 0/0
R2(config-if)#tunnel mode gre multipoint
R2(config-if)#tunnel key 1234
R2(config-if)#ip nhrp network-id 1
R2(config-if)#ip nhrp authentication asdfasdf
R2(config-if)#ip nhrp map multicast dynamic
R2(config-if)#ip nhrp nhs 192.168.0.1
R2(config-if)#ip nhrp map 192.168.0.1 51.10.1.2
R2(config-if)#ip nhrp map multicast 51.10.1.2 <- (Multicast allowed)
R2(config-if)#ip address 192.168.0.2 255.255.255.0
R2(config-if)#ip mtu 1400
R2(config-if)#ip tcp adjust-mss 1360
R3(config)#interface Tunnel0
R3(config-if)#ip address 192.168.0.3 255.255.255.0
R3(config-if)#no ip redirects
R3(config-if)#ip mtu 1400
R3(config-if)#ip nhrp authentication asdfasdf
R3(config-if)#ip nhrp map multicast dynamic
R3(config-if)#ip nhrp map multicast 51.10.1.2
R3(config-if)#ip nhrp map 192.168.0.1 51.10.1.2
R3(config-if)#ip nhrp network-id 1
R3(config-if)#ip nhrp nhs 192.168.0.1
R3(config-if)#ip tcp adjust-mss 1360
R3(config-if)#tunnel source FastEthernet0/0
R3(config-if)#tunnel mode gre multipoint
R3(config-if)#tunnel key 1234
R2#show ip nhrp
192.168.0.1/32 via 192.168.0.1
Tunnel0 created 00:04:50, never expire
Type: static, Flags: used
NBMA address: 51.10.1.2
R2#ping 192.168.0.3
!!!!!
R2#show ip nhrp
192.168.0.1/32 via 192.168.0.1
Tunnel0 created 00:15:30, never expire
Type: static, Flags: used
NBMA address: 51.10.1.2
192.168.0.3/32 via 192.168.0.3
Tunnel0 created 00:00:07, expire 01:59:53
Type: dynamic, Flags: router used
NBMA address: 51.10.3.2
! Configure RIP
R1/R2/R3
RX(config)#router rip
RX(config-router)#ver 2
RX(config-router)#no auto
RX(config-router)#net 192.168.0.0
RX(config-router)#net 10.0.0.0
R1#show ip route rip
10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
R 10.1.2.0/24 [120/1] via 192.168.0.2, 00:00:11, Tunnel0
R 10.1.3.0/24 [120/1] via 192.168.0.3, 00:00:03, Tunnel0
R3#show ip route rip
10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
R 10.1.1.0/24 [120/1] via 192.168.0.1, 00:00:02, Tunnel0
R2#show ip route rip
10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
R 10.1.1.0/24 [120/1] via 192.168.0.1, 00:00:10, Tunnel0
! Disable Split-horizon
R1(config)#in tunnel 0
R1(config-if)#no ip split-horizon
R2#show ip route rip
10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
R 10.1.1.0/24 [120/1] via 192.168.0.1, 00:00:25, Tunnel0
R 10.1.3.0/24 [120/2] via 192.168.0.3, 00:00:25, Tunnel0
GRE Configuration
R1#conf terminal
R1(config)#in lo 0
R1(config-if)#ip address 10.1.1.1 255.255.255.0
R1(config-if)#in fas 0/0
R1(config-if)#ip address 51.10.1.1 255.255.255.252
R1(config-if)#no shutdown
R2#conf terminal
R2(config)#in lo 0
R2(config-if)#ip address 10.1.2.1 255.255.255.0
R2(config-if)#in fas 0/0
R2(config-if)#ip address 51.10.1.2 255.255.255.252
R2(config-if)#no shutdown
R2(config-if)#do ping 51.10.1.1 re 1
!
! Create GRE Tunnel
R1(config)#do show ip inter bri | exc unas
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 51.10.1.1 YES manual up up
Loopback0 10.1.1.1 YES manual up up
R1(config)#interface tunnel 12
R1(config-if)#tunnel source 51.10.1.1
R1(config-if)#tunnel destination 51.10.1.2
R1(config-if)#ip address 192.168.0.1 255.255.255.0
R2(config)#interface tunnel 12
R2(config-if)#tunnel source 51.10.1.2
R2(config-if)#tunnel destination 51.10.1.1
R2(config-if)#ip address 192.168.0.2 255.255.255.0
R2(config-if)#do show ip inter bri | exc unas
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 51.10.1.2 YES manual up up
Loopback0 10.1.2.1 YES manual up up
Tunnel12 192.168.0.2 YES manual up up
! Configure RIP
R1(config)#router rip
R1(config-router)#version 2
R1(config-router)#no auto-summary
R1(config-router)#network 192.168.0.0
R1(config-router)#network 10.0.0.0
R1(config-router)#exit
R2(config)#router rip
R2(config-router)#version 2
R2(config-router)#no auto-summary
R2(config-router)#network 192.168.0.0
R2(config-router)#network 10.0.0.0
R2(config-router)#end
R2#show ip route
R 10.1.1.0/24 [120/1] via 192.168.0.1, 00:00:01, Tunnel12
C 10.1.2.0/24 is directly connected, Loopback0
51.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 51.10.1.0/30 is directly connected, FastEthernet0/0
192.168.0.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.0.0/24 is directly connected, Tunnel12
Ping Capture file here
The Call Admission Control for IKE feature describes the application of Call Admission Control (CAC) to the Internet Key Exchange (IKE) protocol in Cisco IOS software. CAC limits the number of simultaneous IKE and IPsec security associations (SAs) that is, calls to CAC that a router can establish.
CAC Protection
- In-Negotiation Limit
- SA Limit
Implementation:
In-Negotiation Limit:
Rate Limiting for IKE Phase 1. Prevent IKE Phase 1 Negotiation from Hackers
SA Limit:
In Our Lab in worst case we have 2 IKE phase tunnels between each device, each device has 6 IKE phase tunnels in this case.
If we configure the limit to 10 its prevents malicious connections.
With this configuration we limit DOS Attacks and also malformed system from our devices. (Logic error or Software issues)
! Check EIGRP Routes
R2-Spoke#show ip route eigrp
D 10.1.1.0/24 [90/27008000] via 172.16.0.1, 02:29:53, Tunnel0
D 10.3.3.0/24 [90/28288000] via 172.16.0.3, 02:28:34, Tunnel0
D 10.4.4.0/24 [90/28288000] via 172.16.0.4, 02:27:59, Tunnel0
R2-Spoke#ping 10.1.1.1 source lo 0
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.2.2.2
!!!!! Success rate is 100 percent (5/5)
R2-Spoke#ping 10.3.3.3 source lo 0
Sending 5, 100-byte ICMP Echos to 10.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 10.2.2.2
!!!!! Success rate is 100 percent (5/5)
R2-Spoke#ping 10.4.4.4 source lo 0
Sending 5, 100-byte ICMP Echos to 10.4.4.4, timeout is 2 seconds:
Packet sent with a source address of 10.2.2.2
!!!!! Success rate is 100 percent (5/5)
! Check IKE Phase 1 Security Associations (SA)
R2-Spoke#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
25.0.0.2 35.0.0.3 QM_IDLE 1002 ACTIVE
35.0.0.3 25.0.0.2 QM_IDLE 1003 ACTIVE
45.0.0.4 25.0.0.2 QM_IDLE 1005 ACTIVE
25.0.0.2 45.0.0.4 QM_IDLE 1004 ACTIVE
15.0.0.1 25.0.0.2 QM_IDLE 1001 ACTIVE
! Check Default Configuration
R2-Spoke#show crypto call admission statistics
-----------------------------------------------------------------------
Crypto Call Admission Control Statistics
-----------------------------------------------------------------------
System Resource Limit: 0 Max IKE SAs: 0 Max in nego: 1000
Total IKE SA Count: 5 active: 5 negotiating: 0
Incoming IKE Requests: 2 accepted: 2 rejected: 0
Outgoing IKE Requests: 3 accepted: 3 rejected: 0
Rejected IKE Requests: 0 rsrc low: 0 SA limit: 0
IKE packets dropped at dispatch: 0
! Note:
Max IKE SAs: 0 = Means that we don't use any limit
Max in nego: 1000 = Means that we have Max Neg Num 1000, this is very high number.
! Note: The Security configuration only affects to new connections. not an ACTIVE
! Set Rate Limit for SA
R2-Spoke(config)#crypto call admission limit ike sa 10
R2-Spoke(config)#do show crypto call admission statistics | in Max
System Resource Limit: 0 Max IKE SAs: 10 Max in nego: 1000
! Note: We have 5 ACTIVE SA, If we configure to 2 the IOS generate log massage:
R2-Spoke(config)#crypto call admission limit ike sa 2
*Sep 3 17:41:31.399: %CRYPTO-4-IKE_SA_LIMIT: IKE active SA count is 5 but SA limit has been set to 2.
! Set Maximum number of in-negotiation IKE SAs allowed
R2-Spoke(config)#crypto call admission limit ike in-negotiation-sa 10
R2-Spoke(config)#do show crypto call admission statistics | in Max
System Resource Limit: 0 Max IKE SAs: 10 Max in nego: 10
! Make Some Test to Check how its works.
! Reset Statistics
R1-Hub(config)#in ser 1/0
R1-Hub(config-if)#shutdown
R1-Hub(config-if)#do clear crypto isakmp
R1-Hub(config-if)#do clear crypto sa
! Do the same on all devices R2,R3,R4 and than make no shutdown
R1-Hub(config-if)#no shutdown
! Set SA Limit to 2 (Allowed 2)
R2-Spoke(config)#crypto call admission limit ike sa 2
! Check EIGRP Routes
R2-Spoke(config)#do show ip route eigrp | in Tunn
D 10.1.1.0/24 [90/27008000] via 172.16.0.1, 00:04:34, Tunnel0
D 10.3.3.0/24 [90/28288000] via 172.16.0.3, 00:04:34, Tunnel0
D 10.4.4.0/24 [90/28288000] via 172.16.0.4, 00:04:34, Tunnel0
! Now do the ping to 10.4.4.4
R2-Spoke#ping 10.4.4.4 source lo 0
Sending 5, 100-byte ICMP Echos to 10.4.4.4, timeout is 2 seconds:
Packet sent with a source address of 10.2.2.2
!!!!! Success rate is 100 percent (5/5)
! Note: Its Generate log Message:
*Sep 3 18:06:28.567: %CRYPTO-4-IKE_DENY_SA_REQ: IKE denied an OUTGOING SA request from 25.0.0.2 to 45.0.0.4 due to IKE SA LIMIT REACHED
! Check again Configured Limits and Statistics.
R2-Spoke(config)#do show crypto call admission statistics
-----------------------------------------------------------------------
Crypto Call Admission Control Statistics
-----------------------------------------------------------------------
System Resource Limit: 0 Max IKE SAs: 2 Max in nego: 10
Total IKE SA Count: 2 active: 2 negotiating: 0
Incoming IKE Requests: 3 accepted: 3 rejected: 0
Outgoing IKE Requests: 5 accepted: 4 rejected: 1
Rejected IKE Requests: 1 rsrc low: 0 SA limit: 1
IKE packets dropped at dispatch: 0
! Make ping to R3
R2-Spoke#ping 10.3.3.3 source lo 0
Sending 5, 100-byte ICMP Echos to 10.3.3.3, timeout is 2 seconds:
Packet sent with a source address of 10.2.2.2
!!!!! Success rate is 100 percent (5/5)
*Sep 3 18:12:35.883: %CRYPTO-4-IKE_DENY_SA_REQ: IKE denied an INCOMING SA request from 35.0.0.3 to 25.0.0.2 due to IKE SA LIMIT REACHED
! Note: The ping was successful, but we use R1 to Reach R3 (It not create Tunnel between R2 and R3, because of limit we have configured)
R2-Spoke#traceroute 10.3.3.3 source lo 0
Tracing the route to 10.3.3.3
1 172.16.0.1 108 msec 108 msec 84 msec <-- R1
2 172.16.0.3 172 msec 168 msec 72 msec <-- R3
R2-Spoke#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
25.0.0.2 45.0.0.4 QM_IDLE 1007 ACTIVE
15.0.0.1 25.0.0.2 QM_IDLE 1006 ACTIVE
IPv6 Crypto ISAKMP SA
! We have seen how its blocks not allowed connection, Now change the limit to 6
R2-Spoke(config)#crypto call admission limit ike sa 6
! Make more pings to R3 and R4
R2-Spoke#ping 10.3.3.3 source lo 0
R2-Spoke#ping 10.4.4.4 source lo 0
! Check IKE SA Again
R2-Spoke#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
25.0.0.2 35.0.0.3 QM_IDLE 1009 ACTIVE
35.0.0.3 25.0.0.2 QM_IDLE 1008 ACTIVE
25.0.0.2 45.0.0.4 QM_IDLE 1007 ACTIVE
15.0.0.1 25.0.0.2 QM_IDLE 1006 ACTIVE
Before and After
- Naked GRE
- IPsec Protected GRE
Configure R1:
R1-Hub(config)#crypto isakmp policy 5
R1-Hub(config-isakmp)#hash sha
R1-Hub(config-isakmp)#authentication pre-share
R1-Hub(config-isakmp)#group 14 <-- (2048 bit)
R1-Hub(config-isakmp)#lifetime 86400
R1-Hub(config-isakmp)#encryption aes 256
R1-Hub(config-isakmp)#exit
R1-Hub(config)#crypto isakmp key cisco123 address 0.0.0.0 <-- (Any peer who has same Pass)
R1-Hub(config)#crypto ipsec transform-set OURSET esp-aes 256 esp-sha-hmac
R1-Hub(cfg-crypto-trans)#mode transport
R1-Hub(cfg-crypto-trans)#exit
R1-Hub(config)#crypto ipsec profile OUR_IPSec_PROFILE
R1-Hub(ipsec-profile)#set transform-set OURSET
R1-Hub(ipsec-profile)#exit
R1-Hub(config)#in tunnel 0
R1-Hub(config-if)#tunnel protection ipsec profile OUR_IPSec_PROFILE
*Sep 3 00:47:09.627: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON
*Sep 3 00:47:11.299: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /15.0.0.1, src_addr= 35.0.0.3, prot= 47
Configure R2:
R2-Spoke(config)#crypto isakmp policy 5
R2-Spoke(config-isakmp)#hash sha
R2-Spoke(config-isakmp)#authentication pre-share
R2-Spoke(config-isakmp)#group 14
R2-Spoke(config-isakmp)#lifetime 86400
R2-Spoke(config-isakmp)#encryption aes 256
R2-Spoke(config-isakmp)#exit
R2-Spoke(config)#crypto isakmp key cisco123 address 0.0.0.0
R2-Spoke(config)#crypto ipsec transform-set OURSET esp-aes 256 esp-sha-hmac
R2-Spoke(cfg-crypto-trans)#mode transport
R2-Spoke(cfg-crypto-trans)#exit
R2-Spoke(config)#crypto ipsec profile OUR_IPSec_PROFILE
R2-Spoke(ipsec-profile)#set transform-set OURSET
R2-Spoke(ipsec-profile)#exit
R2-Spoke(config)#in tunnel 0
R2-Spoke(config-if)#tunnel protection ipsec profile OUR_IPSec_PROFILE
Configure R3:
R3-Spoke(config)#crypto isakmp policy 5
R3-Spoke(config-isakmp)#hash sha
R3-Spoke(config-isakmp)#authentication pre-share
R3-Spoke(config-isakmp)#group 14
R3-Spoke(config-isakmp)#lifetime 86400
R3-Spoke(config-isakmp)#encryption aes 256
R3-Spoke(config-isakmp)#exit
R3-Spoke(config)#crypto isakmp key cisco123 address 0.0.0.0
R3-Spoke(config)#crypto ipsec transform-set OURSET esp-aes 256 esp-sha-hmac
R3-Spoke(cfg-crypto-trans)#mode transport
R3-Spoke(cfg-crypto-trans)#exit
R3-Spoke(config)#crypto ipsec profile OUR_IPSec_PROFILE
R3-Spoke(ipsec-profile)#set transform-set OURSET
R3-Spoke(ipsec-profile)#exit
R3-Spoke(config)#in tunnel 0
R3-Spoke(config-if)#tunnel protection ipsec profile OUR_IPSec_PROFILE
Configure R4:
R4-Spoke(config)#crypto isakmp policy 5
R4-Spoke(config-isakmp)#hash sha
R4-Spoke(config-isakmp)#authentication pre-share
R4-Spoke(config-isakmp)#group 14
R4-Spoke(config-isakmp)#lifetime 86400
R4-Spoke(config-isakmp)#encryption aes 256
R4-Spoke(config-isakmp)#exit
R4-Spoke(config)#crypto isakmp key cisco123 address 0.0.0.0
R4-Spoke(config)#crypto ipsec transform-set OURSET esp-aes 256 esp-sha-hmac
R4-Spoke(cfg-crypto-trans)#mode transport
R4-Spoke(cfg-crypto-trans)#exit
R4-Spoke(config)#crypto ipsec profile OUR_IPSec_PROFILE
R4-Spoke(ipsec-profile)#set transform-set OURSET
R4-Spoke(ipsec-profile)#exit
R4-Spoke(config)#in tunnel 0
R4-Spoke(config-if)#tunnel protection ipsec profile OUR_IPSec_PROFILE
! Verify Configuretion
R2-Spoke#show dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
N - NATed, L - Local, X - No Socket
# Ent --> Number of NHRP entries with same NBMA peer
NHS Status: E --> Expecting Replies, R --> Responding
UpDn Time --> Up or Down Time for a Tunnel
==========================================================================
Interface: Tunnel0, IPv4 NHRP Details
IPv4 NHS: 172.16.0.1 RE
Type:Spoke, Total NBMA Peers (v4/v6): 2
# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb Target Network
----- --------------- --------------- ----- -------- ----- -----------------
1 15.0.0.1 172.16.0.1 UP 00:00:23 S 172.16.0.1/32
R2-Spoke#ping 10.4.4.4 source lo 0
Sending 5, 100-byte ICMP Echos to 10.4.4.4, timeout is 2 seconds:
Packet sent with a source address of 10.2.2.2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 64/104/164 ms
R2-Spoke#show dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
N - NATed, L - Local, X - No Socket
# Ent --> Number of NHRP entries with same NBMA peer
NHS Status: E --> Expecting Replies, R --> Responding
UpDn Time --> Up or Down Time for a Tunnel
==========================================================================
Interface: Tunnel0, IPv4 NHRP Details
IPv4 NHS: 172.16.0.1 RE
Type:Spoke, Total NBMA Peers (v4/v6): 2
# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb Target Network
----- --------------- --------------- ----- -------- ----- -----------------
1 15.0.0.1 172.16.0.1 UP 00:00:23 S 172.16.0.1/32
1 45.0.0.4 172.16.0.4 UP 00:00:16 D 172.16.0.4/32
R2-Spoke#show ip nhrp
172.16.0.1/32 via 172.16.0.1
Tunnel0 created 00:33:03, never expire
Type: static, Flags: used
NBMA address: 15.0.0.1
172.16.0.2/32 via 172.16.0.2
Tunnel0 created 00:00:24, expire 01:59:35
Type: dynamic, Flags: router unique local
NBMA address: 25.0.0.2
(no-socket)
172.16.0.4/32 via 172.16.0.4
Tunnel0 created 00:00:25, expire 01:59:35
Type: dynamic, Flags: router implicit
NBMA address: 45.0.0.4
R2-Spoke#show dmvpn detail
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
N - NATed, L - Local, X - No Socket
# Ent --> Number of NHRP entries with same NBMA peer
NHS Status: E --> Expecting Replies, R --> Responding
UpDn Time --> Up or Down Time for a Tunnel
==========================================================================
Interface Tunnel0 is up/up, Addr. is 172.16.0.2, VRF ""
Tunnel Src./Dest. addr: 25.0.0.2/MGRE, Tunnel VRF ""
Protocol/Transport: "multi-GRE/IP", Protect "OUR_IPSec_PROFILE"
Interface State Control: Disabled
IPv4 NHS: 172.16.0.1 RE
Type:Spoke, Total NBMA Peers (v4/v6): 4
# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb Target Network
----- --------------- --------------- ----- -------- ----- -----------------
1 15.0.0.1 172.16.0.1 UP 00:12:49 S 172.16.0.1/32
1 25.0.0.2 172.16.0.2 UP 00:01:54 DLX 172.16.0.2/32
1 35.0.0.3 172.16.0.3 UP 00:01:54 D 172.16.0.3/32
1 45.0.0.4 172.16.0.4 UP 00:01:54 D 172.16.0.4/32
Crypto Session Details:
--------------------------------------------------------------------------------
Interface: Tunnel0
Session: [0x67C838DC]
IKE SA: local 25.0.0.2/500 remote 15.0.0.1/500 Active
Capabilities:(none) connid:1004 lifetime:23:47:09
Crypto Session Status: UP-ACTIVE
fvrf: (none), Phase1_id: 15.0.0.1
IPSEC FLOW: permit 47 host 25.0.0.2 host 15.0.0.1
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 155 drop 0 life (KB/Sec) 4411088/2830
Outbound: #pkts enc'ed 146 drop 0 life (KB/Sec) 4411090/2830
Outbound SPI : 0x62A0750D, transform : esp-256-aes esp-sha-hmac
Socket State: Open
Interface: Tunnel0
Session: [0x67C836FC]
IKE SA: local 25.0.0.2/500 remote 45.0.0.4/500 Active
Capabilities:(none) connid:1018 lifetime:23:58:04
Crypto Session Status: UP-ACTIVE
fvrf: (none), Phase1_id: 45.0.0.4
IPSEC FLOW: permit 47 host 25.0.0.2 host 45.0.0.4
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 2 drop 0 life (KB/Sec) 4579927/3485
Outbound: #pkts enc'ed 4 drop 0 life (KB/Sec) 4579927/3485
Outbound SPI : 0x37F51D9D, transform : esp-256-aes esp-sha-hmac <-- (Line ESP SPI In Wireshark Capture)
Socket State: Open
Pending DMVPN Sessions:
R2-Spoke#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
35.0.0.3 25.0.0.2 QM_IDLE 1017 ACTIVE
15.0.0.1 25.0.0.2 QM_IDLE 1004 ACTIVE
45.0.0.4 25.0.0.2 QM_IDLE 1018 ACTIVE
IPv6 Crypto ISAKMP SA
R2-Spoke#show crypto isakmp sa detail
Codes: C - IKE configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal
T - cTCP encapsulation, X - IKE Extended Authentication
psk - Preshared key, rsig - RSA signature
renc - RSA encryption
IPv4 Crypto ISAKMP SA
C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap.
1017 25.0.0.2 35.0.0.3 ACTIVE aes sha psk 14 23:53:26
Engine-id:Conn-id = SW:17
1004 25.0.0.2 15.0.0.1 ACTIVE aes sha psk 14 23:42:31
Engine-id:Conn-id = SW:4
1018 25.0.0.2 45.0.0.4 ACTIVE aes sha psk 14 23:53:26
Engine-id:Conn-id = SW:18
IPv6 Crypto ISAKMP SA
R2-Spoke#show crypto ipsec sa peer 45.0.0.4
interface: Tunnel0
Crypto map tag: Tunnel0-head-0, local addr 25.0.0.2
protected vrf: (none)
local ident (addr/mask/prot/port): (25.0.0.2/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (45.0.0.4/255.255.255.255/47/0)
current_peer 45.0.0.4 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 4, #pkts encrypt: 4, #pkts digest: 4
#pkts decaps: 2, #pkts decrypt: 2, #pkts verify: 2
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 25.0.0.2, remote crypto endpt.: 45.0.0.4
path mtu 1500, ip mtu 1500, ip mtu idb Serial1/0
current outbound spi: 0x37F51D9D(938810781)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0xBC9EB9E5(3164518885)
transform: esp-256-aes esp-sha-hmac ,
in use settings ={Transport, }
conn id: 33, flow_id: 33, sibling_flags 80000006, crypto map: Tunnel0-head-0
sa timing: remaining key lifetime (k/sec): (4579927/3119)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x37F51D9D(938810781)
transform: esp-256-aes esp-sha-hmac ,
in use settings ={Transport, }
conn id: 34, flow_id: 34, sibling_flags 80000006, crypto map: Tunnel0-head-0
sa timing: remaining key lifetime (k/sec): (4579927/3119)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
R2-Spoke#show dmvpn peer nbma 45.0.0.4 detail
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
N - NATed, L - Local, X - No Socket
# Ent --> Number of NHRP entries with same NBMA peer
NHS Status: E --> Expecting Replies, R --> Responding
UpDn Time --> Up or Down Time for a Tunnel
==========================================================================
Interface Tunnel0 is up/up, Addr. is 172.16.0.2, VRF ""
Tunnel Src./Dest. addr: 25.0.0.2/MGRE, Tunnel VRF ""
Protocol/Transport: "multi-GRE/IP", Protect "
Interface State Control: Disabled
IPv4 NHS: 172.16.0.1 RE
Type:Unknown, Total NBMA Peers (v4/v6): 1
# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb Target Network
----- --------------- --------------- ----- -------- ----- -----------------
1 45.0.0.4 172.16.0.4 UP 00:10:14 D 172.16.0.4/32
Crypto Session Details:
--------------------------------------------------------------------------------
Interface: Tunnel0
Session: [0x67C838DC]
IKE SA: local 25.0.0.2/500 remote 45.0.0.4/500 Active
Capabilities:(none) connid:1018 lifetime:23:49:44
Crypto Session Status: UP-ACTIVE
fvrf: (none), Phase1_id: 45.0.0.4
IPSEC FLOW: permit 47 host 25.0.0.2 host 45.0.0.4
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 2 drop 0 life (KB/Sec) 4579927/2985
Outbound: #pkts enc'ed 4 drop 0 life (KB/Sec) 4579927/2985
Outbound SPI : 0x37F51D9D, transform : esp-256-aes esp-sha-hmac
Socket State: Open
! Note: Now All Traffic is Encrypted
! Note: Wireshark Captured File Link: Here
