The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
You must have an Azure account for your Cisco Catalyst 8000V instance.
Ensure that your licenses are registered and valid.
Ensure that the hub is up and running before you configure the spokes.
You cannot deploy a Spoke VNet in another Cloud Service Provider.
You cannot configure the transit VNet solution for all locations. To view the list of locations that are supported, after you create an instance, see all the options in the Location field from the Configure Basic Settings page.
How to Deploy Azure Transit VNET DMVPN
This procedure is the first step in configuring the transit VNet solution. This is a very important part of the deployment where you have to configure the Transit VNet settings. These settings correspond to the DMVPN IPsec parameters that are stored as metadata in the Transit-VNet storage account with an Access-Key. When configuring the spoke templates, you need to configure the TVNET Storage account and the Access-key only. The relevant DMVPN IPsec parameters required for spokes are automatically selected from the device.
|
Step 1 |
Sign in to the Microsoft Azure portal. |
||
|
Step 2 |
Click Create a Resource, search for your Cisco Catalyst 8000V deployment, and press Enter. The system searches and displays the Transit VNET templates for DMVPN. |
||
|
Step 3 |
Select Transit VNET DMVPN > Create. |
||
|
Step 4 |
In the Basics screen, enter the name of the Virtual machine, the name for the Transit VNet hub, and your username.
|
||
|
Step 5 |
From the Authentication Type drop-down list, select the SSH Public Key option. |
||
|
Step 6 |
Specify a password and reenter the password to confirm. |
||
|
Step 7 |
Select the appropriate image version from the SKU drop-down list. |
||
|
Step 8 |
From the Location drop-down list, select one of the regions where TVNET hub can be deployed. |
||
|
Step 9 |
In the Cisco C8000V Settings page, configure the settings. For more information on configuring the Cisco Catalyst 8000V settings, see the Deploying the Cisco Catalyst 8000V on Microsoft Azure section. |
||
|
Step 10 |
In the Transit VNet Settings, configure the following settings: At this point, you don't have to configure subnets through the Configure Subnets section. |
||
|
Step 11 |
Verify the parameters in the Summary screen, and click OK. |
||
|
Step 12 |
From the Buy section, click Create to deploy the Transit VNet Hub solution. This step creates the following resources:
It takes several minutes for the deployment to be complete and for the resources to be created. You can monitor the deployment by clicking All Resources and choosing the Group By Type option. After the deployment is complete, the notification panel displays the message Deployment Succeeded. |
|
Step 1 |
From the Microsoft Azure Marketplace, search and select the Cisco CSR 1000V DMVPN Transit VNet template. |
||
|
Step 2 |
Click the template, and select the appropriate Spoke option that you want, from the drop-down list. |
||
|
Step 3 |
Click Create. |
||
|
Step 4 |
In the Basics settings screen, ensure that you specify the following configuration details:
|
||
|
Step 5 |
Configure the other values in the Basics Settings screen, and click OK. |
||
|
Step 6 |
In the Cisco Catalyst 8000V Settings screen, you can choose to either configure the fields or leave them as is (default values). For information about the parameters, see How to Deploy aCisco Catalyst 8000V on Microsoft Azure.
|
||
|
Step 7 |
Click the arrow next to Virtual Network to specify values for the virtual network and click OK. |
||
|
Step 8 |
In the Address Space field, enter the address of the virtual network using Classless Inter-Domain Routing (CIDR) notation.
|
||
|
Step 9 |
Click the arrow next to Configure the Subnets, and click OK. |
||
|
Step 10 |
In the Summary screen, review the configured parameters. After you validate the template, click OK. |
||
|
Step 11 |
Click Create to deploy the TVNet Spoke solution.
|
The following commands show that the spokes have successfully established DMVPN tunnels to Transit VNet Hub1 and are able to exchange EIGRP routes with the Transit VNet Hub1. The solution enables DMVPN-Phase 3 feature - NHRP Shortcut Switching. When these commands are run on Transit VNet Hub2, the command outputs are similar to Transit VNet Hub1. This indicates that the spokes have successfully established DMVPN tunnels to both the Cisco Catalyst 8000V in the Transit VNet hubs and have successfully exchanged EIGRP routes with both the hubs. The hubs are deployed in active-active mode for greater resiliency.
|
Step 1 |
Run the Example:Notice the higlighted portion in the configuration output. This indicates that the Tunnel is up. If the system does not display
the Tunnel in this configuration output, you must go to the guestshell and look at the TVNet logs. Run the |
|
Step 2 |
Run the Example: |
|
Step 3 |
Run the Example: |
|
Step 4 |
Run the Example: |
|
Step 5 |
Run the Example: |
|
Step 6 |
Run the Example: |
|
Step 7 |
Run the Example: |
The following commands show that the spokes are connected to both the Cisco Catalyst 8000V TVNET HUBs and have been able to exchange the EIGRP routes from both the hubs. As the DMVPN solution is deployed as DMVPN-Phase3 (NHRP shortcut-switching) and the hubs are deployed in the active-active mode, the EIGRP route towards SPOKE2 points to the tunnel-overlay ip-address of spoke2.
|
Step 1 |
Run the Example: |
|
Step 2 |
Run the Example:Notice the configuration output that is highlighted. This indicates that the spokes are up and have established a connection with the hub. |
|
Step 3 |
Run the Example: |
|
Step 4 |
Run the Example: |
|
Step 5 |
Run the Example: |
|
Step 6 |
Run the show ip route eigrp command to view the EIGRP route information. Example: |
The following commands help in testing connection between two spokes. As the feature supported is DMVPN-Phase 3, the traceroute command displays the packets sent from spoke 1 to spoke 2. However, the first packet is lost due to NHRP resolution as Spoke 1 sends the packet to the hub to obtain the address of Spoke 2. When Spoke 1 receives the address, a dynamic IPsec tunnel is established between Spoke 1 and Spoke 2.
Spoke1# clear crypto sa counters
Spoke1# ping 12.1.1.4 source gigabitEthernet 2 repeat 100
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 12.1.1.4, timeout is 2 seconds:
Packet sent with a source address of 11.1.1.4
.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 99 percent (99/100), round-trip min/avg/max = 1/1/6 ms
Spoke# show dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
N - NATed, L - Local, X - No Socket
T1 - Route Installed, T2 - Nexthop-override
C - CTS Capable, I2 - Temporary
# Ent --> Number of NHRP entries with same NBMA peer
NHS Status: E --> Expecting Replies, R --> Responding, W --> Waiting
UpDn Time --> Up or Down Time for a Tunnel
==========================================================================
Interface: Tunnel11, IPv4 NHRP Details
Type:Spoke, NHRP Peers:3,
# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb
----- --------------- --------------- ----- -------- -----
1 40.117.131.133 172.16.1.1 UP 1w3d S
1 40.117.128.85 172.16.1.2 UP 1w3d S
1 40.114.69.24 172.16.1.137 UP 00:00:07 DN
Spoke# traceroute 12.1.1.4 source gigabitEthernet 2
Type escape sequence to abort.
Tracing the route to 12.1.1.4
VRF info: (vrf in name/id, vrf out name/id)
1 172.16.1.137 2 msec * 3 msec
p1spoke1#
p1spoke1#
p1spoke1#sh crypto sess detail | i pkts
Inbound: #pkts dec'ed 101 drop 0 life (KB/Sec) 4607985/3581
Outbound: #pkts enc'ed 100 drop 0 life (KB/Sec) 4607989/3581
Inbound: #pkts dec'ed 12 drop 0 life (KB/Sec) 4607924/621
Outbound: #pkts enc'ed 14 drop 0 life (KB/Sec) 4607955/621
Inbound: #pkts dec'ed 13 drop 0 life (KB/Sec) 4607957/1941
Outbound: #pkts enc'ed 13 drop 0 life (KB/Sec) 4607975/1941
Spoke# show crypto session detail
Crypto session current status
Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
X - IKE Extended Authentication, F - IKE Fragmentation
R - IKE Auto Reconnect, U - IKE Dynamic Route Update
Interface: Tunnel11
Uptime: 00:00:36
Session status: UP-ACTIVE
Peer: 40.114.69.24 port 4500 fvrf: (none) ivrf: (none)
Phase1_id: 12.1.0.4
Desc: (none)
Session ID: 0
IKEv1 SA: local 11.1.0.4/4500 remote 40.114.69.24/4500 Active
Capabilities:DN connid:1027 lifetime:23:59:23
IPSEC FLOW: permit 47 host 11.1.0.4 host 40.114.69.24
Active SAs: 4, origin: crypto map
Inbound: #pkts dec'ed 101 drop 0 life (KB/Sec) 4607985/3563
Outbound: #pkts enc'ed 100 drop 0 life (KB/Sec) 4607989/3563
Interface: Tunnel11
Uptime: 1w3d
Session status: UP-ACTIVE
Peer: 40.117.131.133 port 4500 fvrf: (none) ivrf: (none)
Phase1_id: 10.1.0.4
Desc: (none)
Session ID: 0
IKEv1 SA: local 11.1.0.4/4500 remote 40.117.131.133/4500 Active
Capabilities:DN connid:1025 lifetime:17:31:38
IPSEC FLOW: permit 47 host 11.1.0.4 host 40.117.131.133
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 16 drop 0 life (KB/Sec) 4607923/603
Outbound: #pkts enc'ed 18 drop 0 life (KB/Sec) 4607955/603
Interface: Tunnel11
Uptime: 1w3d
Session status: UP-ACTIVE
Peer: 40.117.128.85 port 4500 fvrf: (none) ivrf: (none)
Phase1_id: 10.1.0.5
Desc: (none)
Session ID: 0
IKEv1 SA: local 11.1.0.4/4500 remote 40.117.128.85/4500 Active
Capabilities:DN connid:1026 lifetime:17:31:41
IPSEC FLOW: permit 47 host 11.1.0.4 host 40.117.128.85
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 17 drop 0 life (KB/Sec) 4607957/1923
Outbound: #pkts enc'ed 17 drop 0 life (KB/Sec) 4607975/1923To view the status of your deployment, log in to your Cisco Catalyst 8000V instance and run the show log command. If your depolyment is successful you should see the [AzureTransitVNET] Success. Configured all the required IOS configs message.
If you do not see this message and experience any errors while configuring the Transit VNet solution, check whether:
The DMVPN tunnel is established between the hub and the spoke. In most cases, there might be a problem with the following values: TransitVNETname, TransitVNETStoragename or TransitVNETStoragekey.
The Guestshell is up and running for the TVNet packages that are to be installed.
Feedback