Introduction
This document describes how to install the Cisco® Virtual Office head-end routers and management server. It is intended for IT administrators.
The installation process involves the following steps:
1. Assign hostnames and IP addresses to all head-end devices.
2. Open firewall rules in the corporate firewall to allow Cisco Virtual Office spokes to establish IP Security (IPSec) tunnels and be securely provisioned.
3. Configure the VPN head ends and management servers.
The configuration examples in this guide use Dynamic Multipoint VPN (DMVPN) for the Cisco Virtual Office data traffic, but they do not show how head ends are installed. For information on how to deploy the various types of head ends, visit http://www.cisco.com/go/cvo and look for the "CVO Converged VPN" white paper.
Cisco Virtual Office uses a Cisco IOS® Secure Device Provisioning (SDP) server, called a registrar, to securely deploy remote devices. The management console for Cisco Virtual Office is Cisco Security Manager. This management tool is complemented by Cisco Configuration Engine (CE), which interacts with remote devices and provides a "pull" based configuration.
For more information about Cisco Virtual Office, how to manage the converged VPN, and how to add new security features, visit http://www.cisco.com/go/cvo and look for "Converged VPN" and "Advanced Layered Identity."
Network Architecture
Figure 1 shows the Cisco Virtual Office network topology that is deployed internally at Cisco. We recommend having three tunnels available for any remote Cisco Virtual Office router at all times:
• One to access the management network
• One for primary data traffic
• One for failover
Public key infrastructure (PKI) is recommended instead of preshared keys (PSK) for ISAMKP, as it is more secure and is easier to manage, although PSK also works perfectly well.
Cisco recommends using the Cisco Security Manager management tool for large enterprise provisioning. This tool allows IT administrators to do zero-touch deployments, making day-to-day ongoing management activities very convenient, as it provides a framework for easily and quickly updating security policies for thousands of remote routers with centralized management.
Figure 1. Cisco Virtual Office Network Topology
Platforms and Images
Typical small office/home office (SOHO) user: Cisco 871W or Cisco 881W Integrated Services Router
Cisco Unified IP Phone 7965G
Data VPN head end: Cisco 7206 Router with Cisco 7200 Series NPE-G2 Network Processing Engine and VSA encryption card
Cisco IOS Software Release 12.4(15)T6 for VPN head ends and 12.4(20)T for SOHO boxes
PKI server: Cisco 2821 Integrated Services Router
Management gateway: Cisco 3845 Integrated Services Router (for up to 1500 sites) or a Cisco Catalyst® 6500 Series Switch with VPN SPA for many thousands of sites Cisco Secure ACS AAA Version 4.2 (optional, in case a RADIUS server exists already in the company)
Cisco Security Manager 3.2.1
Cisco Configuration Engine 2.0
Cisco Unified Communications Manager 6.x (optional)
Preparing for Cisco Virtual Office
1. Assign an Internet-facing IP address to the VPN gateways and SDP server.
2. Open ports on the corporate firewall.
VPN gateways need UDP 500, 4500, and ESP (IP 50).
SDP server needs SSL (443) and HTTP (can be 80, but it is better for it to be another one, such as TCP 8000).
3. Reserve the IP address for the Cisco Virtual Office remote routers.
For DMVPN, you need to have individual /29 subnets for each of the spokes (or whatever subnet makes more sense). These subnets need to be routed, companywide, to the respective DMVPN hub.
You also need to have unique multipoint generic routing encapsulation (mGRE) IP addresses for every router that is part of the domain. This pool of addresses is internal to the DMVPN domain and does not need to be routable back to the company. It can be any available private pool of addresses: 10net, 192.168net, 172.16net.
4. Choose a routing protocol for DMVPN. The recommended one is Enhanced Interior Gateway Routing Protocol (EIGRP). This routing system runs only between the DMVPN hub and spokes, and can be distributed into the corporate routing protocol.
Setting Up the Head Ends and Servers
1. Install the routers according to the list given earlier, with the correct versions (see Figure 1).
2. Install Cisco Security Manager:
A. download
3. Install Cisco Networking Services Configuration Engine version 2.0:
A. part number
Make sure you enable cryptographic communication between the Configuration Engine and devices, to allow Cisco Security Manager to connect to Configuration Engine using its respective APIs. You will need to generate private RSA keys using Cisco OpenSSL in the Configuration Engine.
4. Enable Cisco Security Manager to talk to the Configuration Engine.
a. Start Cisco Security Manager.
b. Create a device on Cisco Security Manager.
c. Edit the device properties by double-clicking the device.
d. Under CNS-Configuration Engine, click "Add Configuration Engine" (Figure 2).
Figure 2. Adding a Configuration Engine to Cisco Security Manager
Enter the Cisco Networking Services access properties (Figure 3). Note that Cisco Security Manager will use only https, port 443, to talk to CE.
Figure 3. Entering Configuration Engine Properties in Cisco Security Manager
5. Install SDP (Cisco IOS Router) and its respective PKI CA server.
6. Create a bootstrap FlexConfig in Cisco Security Manager. This will be the Cisco Virtual Office bootstrap config. It will do the following:
A. Create the management tunnel config for the new SOHO router.
B. Install a PKI certificate in the new SOHO router.
C. Configure the Cisco Networking Services agent on the SOHO router. This will cause the router to do a "call-home" and get its full config from the Configuration Engine, over the management tunnel.
7. Enable the SDP registrar to grab the Cisco Virtual Office bootstrap config from Cisco Security Manager. Note that Cisco Security Manager allows only https to be used to get an instantiated FlexConfig.
Create Templates/Parameters for Spokes in Cisco Security Manager
Go to Tools -> Object Manager, create a "Network/Host," and call it "protected-subnet" (Figure 4). Give it a random network number. This value will need to be overridden for every spoke.
Figure 4. Creating a Protected Subnet
Now edit your device properties. Go to Interface Roles and create an override for external and internal interfaces (Figure 5). It should be:
External: FastEthernet4, Dialer1, Outside
Internal: BVI10, BVI20
Figure 5. Creating Overrides for Internal and External Interfaces
Creating a Master Device in Cisco Security Manager
There are two main ways of adding devices initially to Cisco Security Manager. The first is to create an empty device and define its policies, one by one.
A faster method is to start with an existing Cisco Virtual Office router config and import it, thus allowing Cisco Security Manager to create policies on the fly (Figure 6).
Figure 6. Importing an Existing Device Configuration File into Cisco Security Manager
You will find a sample Cisco 881 router spoke config in Appendix 1.
To add an already configured Cisco 881, go to Cisco Security Manager and click "Create Device." You can use a network or config file. After the policies have been imported, make them all shared (Figure 7).
Figure 7. Making Policies Shared
If you created a device from scratch, you need to add interfaces for BVI10 and BVI20 (corporate and guest) VLANs (Figure 8).
Figure 8. Creating Router Interfaces
If you imported your existing Cisco 871 and want to make it "template 871," make sure that its properties for Interface Roles list the correct BVI number in the internal network (Figure 9).
Figure 9. Mark BVI10 and VLAN10 as Internal Interfaces
Now add your DMVPN hubs from the network or config file.
Open the properties for these DMVPN hubs (double-click them) and make them unmanaged in Cisco Security Manager, since you have them working already (Figure 10).
Figure 10. Marking Hubs as Unmanaged
Create a DMVPN policy: Go to Tools -> Site-to-Site VPN > DMVPN (Figure 11).
Figure 11. Creating a New DMVPN Policy
Add the hubs and spokes (Figure 12).
Figure 12. Adding Hubs and Spokes
Discovering an Existing DMVPN
You can use the information in the config given in Appendix 2, or your own config if you already have it.
• Create your existing spokes and hubs from "network" Figure 12 (see 3 slides back) Go to Policy -> Discover VPN.
• Select your hubs and spokes and discover them (Figure 13).
Figure 13. Adding Existing Head Ends
Edit and Change DMVPN Policies
• Edit hubs and select the actual interface for VPN external.
• Do the same for the spoke.
• Finish the DMVPN wizard.
• Unassign the preshared key policy.
• Edit the GRE Modes: Enter your correct routing protocol and the Tunnel Parameters on the network of your DMVPN internal cloud.
• Make the Protected Networks the "protected-subnet" you created before (Figure 14).
Figure 14. Specifying the Protected Network
Finally, click "Submit" to save the changes to the Cisco Security Manager database so that other users can see it.
Appendix 1: Cisco Virtual Office Spoke Config Sample
=============================================================================================
881 Router Part Config
=============================================================================================
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 881demo-cvo
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 65555
no logging cns-events
enable secret <removed>
!
aaa new-model
!
aaa group server radius corporate-aaa
server-private 172.16.0.1 auth-port 1812 acct-port 1813 key <removed>
ip radius source-interface Vlan10
!
aaa authentication login eap_methods group corporate-aaa
aaa authentication login module none
aaa authorization exec default local
!
!
aaa session-id common
clock timezone PST -8
clock summer-time PST recurring
service-module wlan-ap 0 bootimage autonomous
!
crypto pki trustpoint cert-server
enrollment mode ra
enrollment url http://cert-server:80
serial-number
ip-address none
password 7 02080B550E
revocation-check none
source interface Vlan10
auto-enroll 75
!
!
!
crypto pki certificate map check-crl 1
subject-name co management_gw.cisco.com
!
!
crypto pki certificate chain cert-server
certificate <removed>
certificate ca <removed>
no ip source-route
no ip gratuitous-arps
!
!
no ip dhcp use vrf connected
no ip dhcp conflict logging
ip dhcp excluded-address 10.99.229.162
!
ip dhcp pool corporate-user
import all
network 10.99.229.160 255.255.255.248
domain-name cisco.com
option 150 ip 172.16.112.211 172.16.196.221
netbios-name-server 171.69.2.87 172.16.235.228
dns-server 172.16.226.120 172.16.168.183
default-router 10.99.229.161
update arp
!
ip dhcp pool guest-user
import all
network 10.1.1.0 255.255.255.0
default-router 10.1.1.1
dns-server 208.67.222.222
!
!
ip cef
no ip bootp server
ip domain lookup source-interface Vlan10
ip domain name cisco.com
ip name-server 172.16.226.120
ip name-server 172.16.168.183
ip multicast-routing
ip ips notify SDEE
ip ips name stealth-ips
ip inspect name fw tcp
ip inspect name fw udp
ip inspect name fw realaudio
ip inspect name fw rtsp
ip inspect name fw tftp
ip inspect name fw ftp
ip inspect name fw h323
ip inspect name fw netshow
ip inspect name fw streamworks
ip inspect name fw esmtp
ip inspect name fw skinny
ip inspect name fw sip
ip inspect name fw sip-tls
ip inspect name voice_fw skinny
ip inspect name voice_fw sip
ip inspect name voice_fw tftp
ip inspect name voice_fw sip-tls
ip sdee subscriptions 3
ip sdee alerts 1000
no ip igmp snooping
login on-failure trap
login on-success log
!
!
dot1x system-auth-control
username admin privilege 15 secret <removed>
!
!
crypto isakmp policy 1
encr aes 256
crypto isakmp keepalive 10
crypto isakmp nat keepalive 10
!
crypto ipsec security-association lifetime kilobytes 530000000
crypto ipsec security-association lifetime seconds 14400
!
crypto ipsec transform-set stealth-aes 256 esp-aes 256 esp-sha-hmac
crypto ipsec transform-set t1 esp-aes 256 esp-sha-hmac
mode transport
!
crypto ipsec profile cvo_profile
set transform-set t1
!
!
crypto map VPNSC_CME 1 ipsec-isakmp
description Security Management Tunnel - SMG
set peer 172.16.200.75
set transform-set stealth-aes 256
match address smg_acl
!
archive
log config
hidekeys
!
!
ip ftp source-interface Vlan10
ip tftp source-interface Vlan10
!
class-map match-any call-setup
match ip dscp cs3
match ip precedence 3
class-map match-any internetwork-control
match access-group name isakmp_acl
match ip precedence 6
match ip precedence 7
class-map match-any voice
match access-group name voice_acl
match ip precedence 5
class-map match-any routing
match protocol eigrp
class-map match-all discover_signaling
match protocol skinny
class-map match-all discover_video
match protocol rtp video
class-map match-all discover_voip
match protocol rtp audio
class-map match-any video
match access-group name video_acl
match ip dscp af41
match ip precedence 4
class-map match-all non_voip
match access-group name non_voip_traffic_acl
!
policy-map mark_incoming_traffic
class discover_signaling
set dscp cs3
class discover_video
set dscp af41
class discover_voip
set dscp ef
class non_voip
set dscp default
!
policy-map voice_and_video
class voice
bandwidth 128
class call-setup
priority percent 5
class internetwork-control
priority percent 5
class routing
priority percent 5
class video
priority 384
class class-default
fair-queue
random-detect
policy-map shaper
class class-default
shape average 750000 7500
service-policy voice_and_video
!
bridge irb
!
!
interface Tunnel0
description DMVPN Phase 3
bandwidth 2000
ip address 10.200.13.98 255.255.254.0
ip access-group tidp-acl in
no ip redirects
ip mtu 1400
ip pim sparse-dense-mode
ip multicast rate-limit out 128
ip nhrp map multicast 172.16.200.67
ip nhrp map 10.200.12.1 172.16.200.67
ip nhrp map multicast 172.16.200.68
ip nhrp map 10.200.12.2 172.16.200.68
ip nhrp network-id 7860
ip nhrp holdtime 300
ip nhrp nhs 10.200.12.1
ip nhrp nhs 10.200.12.2
ip nhrp registration no-unique
ip nhrp shortcut
ip nhrp redirect
ip tcp adjust-mss 1360
load-interval 30
delay 2000
qos pre-classify
tunnel source FastEthernet4
tunnel mode gre multipoint
tunnel key 12345
tunnel protection ipsec profile cvo_profile
!
!
interface FastEthernet0
description inside interface
switchport access vlan 10
switchport voice vlan 11
dot1x pae authenticator
dot1x port-control auto
dot1x reauthentication
dot1x guest-vlan 20
spanning-tree portfast
!
interface FastEthernet1
switchport access vlan 10
switchport voice vlan 11
dot1x pae authenticator
dot1x port-control auto
dot1x reauthentication
dot1x guest-vlan 20
spanning-tree portfast
!
interface FastEthernet2
description inside interface
switchport access vlan 10
switchport voice vlan 11
dot1x pae authenticator
dot1x port-control auto
dot1x reauthentication
dot1x guest-vlan 20
spanning-tree portfast
!
interface FastEthernet3
description inside interface
switchport access vlan 10
switchport voice vlan 11
dot1x pae authenticator
dot1x port-control auto
dot1x reauthentication
dot1x guest-vlan 20
spanning-tree portfast
!
interface FastEthernet4
description outside interface
no ip dhcp client request tftp-server-address
ip address dhcp
ip access-group fw_acl in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip ips stealth-ips in
ip virtual-reassembly
duplex auto
speed auto
no cdp enable
crypto map VPNSC_CME
service-policy output shaper
!
interface wlan-ap0
description Service module interface to manage the embedded AP
ip address 10.0.0.2 255.255.255.255
arp timeout 0
!
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
switchport mode trunk
!
interface Vlan1
no ip address
!
interface Vlan10
description Data VLAN to used with wireless
ip address 10.99.229.161 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
ip pim sparse-dense-mode
ip nat inside
ip inspect fw in
ip virtual-reassembly
ip tcp adjust-mss 1360
ip nbar protocol-discovery
service-policy input mark_incoming_traffic
no autostate
!
interface Vlan11
description Voice VLAN
ip unnumbered Vlan10
ip access-group allow_skinny_acl in
ip inspect voice_fw in
no autostate
!
interface Vlan20
description Guest VLAN
ip address 10.1.1.1 255.255.255.0
ip pim sparse-dense-mode
ip nat inside
ip inspect test in
ip virtual-reassembly
no autostate
!
!
router eigrp 7
network 10.200.12.0 0.0.1.255
network 10.99.229.160 0.0.0.7
distribute-list dmvpn_acl out
no auto-summary
no eigrp log-neighbor-changes
!
ip forward-protocol nd
ip route 172.16.200.0 255.255.255.0 dhcp
ip route 10.99.250.96 255.255.255.224 dhcp
ip http server
ip http authentication local
ip http secure-server
ip http client source-interface Vlan10
!
!
ip nat inside source list nat_acl interface FastEthernet4 overload
!
ip access-list standard dmvpn_acl
permit 10.99.229.160 0.0.0.7
!
ip access-list extended CSM_IP_NAT_DYNAMIC_ACL_1
deny ip any 10.99..250.96 0.0.0.31
permit ip 10.99.229.160 0.0.0.7 any
permit ip 10.1.1.0 0.0.0.255 any
ip access-list extended allow_skinny_acl
permit udp any any range bootps bootpc
permit udp any any eq domain
permit udp any any eq tftp
permit tcp any any eq 2000
permit udp any any range 24576 24656
permit udp any any eq 5445
permit udp any any range 2326 2373
deny ip any any log
ip access-list extended control_acl
permit udp any eq isakmp any eq isakmp
permit eigrp any any
ip access-list extended fw_acl
remark ---- DMVPN Firewall ----
permit esp any any
permit udp any any eq isakmp
permit udp any eq isakmp any
permit udp any eq non500-isakmp any
permit udp any any eq 848
permit udp host 192.5.41.40 eq ntp any
permit udp host 172.16.10.150 eq ntp any
permit udp host 198.123.30.132 eq ntp any
permit tcp 172.16.0.0 0.0.255.255 any eq 22
permit udp any any eq bootpc
permit icmp any any
deny ip any any
ip access-list extended isakmp_acl
permit udp any any eq isakmp
ip access-list extended nat_acl
deny ip any 10.99..250.96 0.0.0.31
permit ip 10.99.229.160 0.0.0.7 any
permit ip 10.1.1.0 0.0.0.255 any
ip access-list extended smg_acl
permit ip 10.99.229.160 0.0.0.7 10.99..250.96 0.0.0.31
ip access-list extended voice_acl
permit udp any any range 24576 24656
ip access-list extended non_voip_traffic_acl
permit ip any any
ip access-list extended video_acl
permit udp any any eq 5445
permit udp any any range 2326 2373
!
kron occurrence ips-job in 1:0:0 recurring
policy-list ips-job
!
kron policy-list ips-job
cli copy /erase http://management-http-server/attack-drop.sdf flash:
!
logging trap debugging
logging source-interface BVI1
logging 10.99..250.119
snmp-server community public RO
!
!
!
control-plane
!
!
banner login ^CCisco Configuration Professional Version:1.0 Date:06/19/2008^C
privilege exec level 1 clock set
privilege exec level 1 clock
privilege exec level 1 reload
privilege exec level 1 show crypto isakmp sa
privilege exec level 1 show crypto isakmp
privilege exec level 1 show crypto ipsec sa
privilege exec level 1 show crypto ipsec
privilege exec level 1 show crypto engine connections active
privilege exec level 1 show crypto engine connections
privilege exec level 1 show crypto engine
privilege exec level 1 show crypto
privilege exec level 1 show ip inspect sessions
privilege exec level 1 show ip inspect
privilege exec level 1 show ip nat translations
privilege exec level 1 show ip nat
privilege exec level 1 show ip
privilege exec level 1 show
privilege exec level 1 clear crypto isakmp
privilege exec level 1 clear crypto sa
privilege exec level 1 clear crypto
privilege exec level 1 clear
!
line con 0
exec-timeout 120 0
logging synchronous
no modem enable
stopbits 1
line aux 0
line 2
password cisco
login authentication module
no activation-character
no exec
transport preferred none
transport input all
line vty 0 4
exec-timeout 0 0
logging synchronous
!
exception data-corruption buffer truncate
scheduler max-task-time 5000
ntp server 198.123.30.132
ntp server 172.16.10.150
ntp server 192.5.41.40
ntp server 172.16.10.80 source BVI1
ntp server 10.99..250.97 prefer source BVI1
cns trusted-server all-agents configuration-engine.cisco.com
cns event configuration-engine.cisco.com 11011 source 10.99.229.161 keepalive 180 3
cns config notify all interval 5
cns config partial configuration-engine.cisco.com 80 source 10.99.229.161
cns exec 80 source 10.99.229.161
cns image server http://configuration-engine.cisco.com/cns/HttpMsgDispatcher status http://configuration-engine.cisco.com/cns/HttpMsgDispatcher
end
Appendix 2: DMVPN Configuration
This configuration is for the case in which the corporate network runs the Open Shortest Path First (OSPF) protocol and DMVPN will run EIGRP internally.
This is a hub and spoke pair of configurations for your reference. Visit http://www.cisco.com/go/cvo and look for "CVO Converged VPN" for detailed information about how to converge DMVPN with other VPN types, and also for a "high concentration hub" design.
==========
DMVPN - hub 1
==========
!! set the pki-server to its correct ip address
aaa new-model
!
aaa group server radius pki-aaa-server
server-private 10.99.99.2 auth-port 1812 acct-port 1813 key <key>
!
aaa authorization network pkiaaa group pki-aaa-server
!
crypto pki trustpoint pki-server
enrollment url http://pki-server.cisco.com:80
serial-number
ip-address none
revocation-check crl
auto-enroll 80
authorization list pkiaaa
!
crypto isakmp policy 10
encr aes 256
!
crypto isakmp keepalive 20 5
crypto isakmp nat keepalive 20
!
crypto ipsec transform-set t1 esp-aes 256 esp-sha-hmac
mode transport require
!
crypto ipsec profile ect
set transform-set t1
!
ip multicast-routing
!
interface Tunnel1
bandwidth 2000
ip address 10.11.0.1 255.255.0.0
no ip redirects
ip mtu 1400
ip pim nbma-mode
ip pim sparse-dense-mode
ip multicast rate-limit out 768
ip nhrp map multicast dynamic
ip nhrp network-id 123456789
ip nhrp cache non-authoritative
ip nhrp redirect
ip summary-address eigrp 7 10.32.4.0 255.255.0.0 5
no ip mroute-cache
ip tcp adjust-mss 1360
delay 2000
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 12345
tunnel protection ipsec profile ect
!
interface GigabitEthernet0/0
ip address 172.16.0.1 255.255.255.0
!
!! DMVPN internal routing protocol
!
router eigrp 7
redistribute ospf 5 metric 2000 2000 255 200 1000
network 10.11.0.0 0.0.255.255
default-metric 1900 1000 255 1 1500
no auto-summary
no eigrp log-neighbor-changes
!! Corporate routing protocol
!
router ospf 5
log-adjacency-changes
redistribute eigrp 7 metric 40 subnets
network 172.16.0.0 0.0.0.255 area 5
!
ntp server 192.5.41.40
ntp server 198.123.30.132
==========
DMVPN - Hub 2
==========
aaa new-model
!
aaa group server radius pki-aaa-server
server-private 10.99.99.2 auth-port 1812 acct-port 1813 key <key>
!
aaa authorization network pkiaaa group pki-aaa-server
!
crypto pki trustpoint pki-server
enrollment url http://pki-server.cisco.com:80
serial-number
ip-address none
revocation-check crl
auto-enroll 80
authorization list pkiaaa
!
crypto isakmp policy 10
encr aes 256
!
crypto isakmp keepalive 20 5
crypto isakmp nat keepalive 20
!
crypto ipsec transform-set t1 esp-aes 256 esp-sha-hmac
mode transport require
!
crypto ipsec profile ect
set transform-set t1
!
ip multicast-routing
!
interface Tunnel1
bandwidth 2000
ip address 10.11.0.2 255.255.0.0
no ip redirects
ip mtu 1400
ip pim nbma-mode
ip pim sparse-dense-mode
ip multicast rate-limit out 768
ip nhrp map multicast dynamic
ip nhrp network-id 123456789
ip nhrp cache non-authoritative
ip nhrp redirect
ip summary-address eigrp 7 10.32.4.0 255.255.0.0 5
no ip mroute-cache
ip tcp adjust-mss 1360
delay 2000
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 12345
tunnel protection ipsec profile ect
!
interface GigabitEthernet0/0
ip address 172.16.0.2 255.255.255.0
!
!! DMVPN internal routing protocol
!
router eigrp 7
redistribute ospf 5 metric 2000 2000 255 200 1000
network 10.11.0.0 0.0.255.255
default-metric 1900 1000 255 1 1500
no auto-summary
no eigrp log-neighbor-changes
!! Corporate routing protocol
!
router ospf 5
log-adjacency-changes
redistribute eigrp 7 metric 40 subnets
network 172.16.0.0 0.0.0.255 area 5
!
ntp server 192.5.41.40
ntp server 198.123.30.132
==========
DMVPN SPOKE config sample
==========
crypto pki trustpoint pki-server
enrollment url http://pki-server.cisco.com:80
serial-number
ip-address none
revocation-check none
auto-enroll 80
!
crypto isakmp policy 1
encr aes 256
!
crypto isakmp keepalive 20 5
crypto isakmp nat keepalive 20
!
crypto ipsec transform-set t1 esp-aes 256 esp-sha-hmac
mode transport require
!
crypto ipsec profile ect
set transform-set t1
!
ip multicast-routing
!
interface Tunnel1
bandwidth 2000
ip address 10.11.0.22 255.255.0.0
no ip redirects
ip mtu 1400
ip pim sparse-dense-mode
ip multicast rate-limit out 128
ip nhrp map multicast 172.16.0.1
ip nhrp map 10.11.0.1 172.16.0.1
ip nhrp map multicast 172.16.0.2
ip nhrp map 10.11.0.2 172.16.0.2
ip nhrp network-id 123456789
ip nhrp holdtime 300
ip nhrp nhs 10.11.0.1
ip nhrp nhs 10.11.0.2
ip nhrp registration no-unique
ip nhrp cache non-authoritative
ip nhrp shortcut
ip nhrp redirect
ip tcp adjust-mss 1360
delay 2000
tunnel source FastEthernet4
tunnel mode gre multipoint
tunnel key 12345
tunnel protection ipsec profile ect
!
interface VLAN10
description local protected network
10.32.0.1 255.255.255.240
ip inspect firewall in
ip nat inside
!
router eigrp 7
network 10.11.0.0 0.0.255.255
network 10.32.0.0 0.0.0.15
no auto-summary
no eigrp log-neighbor-changes
!
ntp server 192.5.41.40
ntp server 198.123.30.132
References
• Cisco Virtual Office solution guides and information: http://www.cisco.com/go/ect
• Cisco Security Manager: http://cisco.com/go/csmanager
• DMVPN: http://cisco.com/go/dmvpn