DMVPN Note+Lab
DMVPN----Dynamic Multipoint VPN
动态多点VPN (DMVPN) - 顾名思义：DMVPN应用在多点到多点的复杂VPN网络环境中。
DMVPN的动态连接关系是通过hub-spokes模式来实现，它可以在两个或多个DMVPN成员的各自子网间动态建立基于GRE over ipsec连接的路由路径。根据目的前缀和下一跳结合路由协议来推断调用的GRE隧道和相关ipsec保护策略。
DMVPN还要结合mGRE(Multipoint GRE interfaces)和NHRP（Next Hop Resolution Protocol）等相关知识。
大致流程：
1． 首先通过mGRE的封装代替p-t-p GRE封装来减少手动tunnel 数量及有效结合NHRP。
2． NHRP结合动态路由协议来支持mGRE的下一跳动态解析功能，以便根据路由协议动态建立保护网络间的临时tunnel.(保护网络要路由通告出去)
3． 在mGRE下采用ipsec profile 实现 ipsec automatic proxy 功能；保护gre封装流量，加密根据NHRP和动态路由协议建立起来的保护网络间的临时tunnel。（由于是动态方式，IKE isakmp remote peers 为 0.0.0.0）
Hub Configuration for DMVPN
crypto isakmp policy 1
authentication pre-share
crypto isakmp key ikecisco address 0.0.0.0
!
crypto ipsec transform-set myset esp-des esp-md5-hmac
mode transport
!
crypto ipsec profile vpnprof
set transform-set myset
!
interface Tunnel0
bandwidth 1000
ip address 10.0.0.1 255.255.255.0
ip mtu 1416（确保大包在加密之前分片，目的设备正常重组）
ip nhrp authentication nhrp-pwd（nhrp认证，在匹配后，调用mGRE属性）
ip nhrp map multicast dynamic（启用NHRP自动加入分支路由器到多播NHRP映射组中）
ip nhrp network-id 99（启用NHRP,在匹配后，调用mGRE属性）
ip nhrp holdtime 300
no ip split-horizon eigrp 1（当使用EIGRP协议时，屏蔽水平分割）
no ip next-hop-self eigrp 1 (当使用EIGRP时，直接建立动态SPOKE-TO-SPOKE隧道)
delay 1000
tunnel source Ethernet0
tunnel mode gre multipoint（设置隧道接口的封装模式为mGRE）
tunnel key cisco (tunnel 认证)
tunnel protection ipsec profile vpnprof(为隧道接口指定IPSEC模板)
!
interface Ethernet0
ip address 172.17.0.1 255.255.255.0
!
interface Ethernet1
ip address 192.168.0.1 255.255.255.0
!
router eigrp 1
network 10.0.0.0 0.0.0.255 area 0
network 192.168.0.0 0.0.0.255 area 0
Spoke Configuration for DMVPN
crypto isakmp policy 1
authentication pre-share
crypto isakmp key ikecisco address 0.0.0.0
!
crypto ipsec transform-set myset esp-des esp-md5-hmac
mode transport
!
crypto ipsec profile vpnprof
set transform-set myset
!
interface Tunnel0
bandwidth 1000
ip address 10.0.0.2 255.255.255.0
ip mtu 1416
ip nhrp authentication nhrp-pwd
ip nhrp map 10.0.0.1 172.17.0.1（为NHRP server hub 隧道地址10.0.0.1做物理地址绑定）
ip nhrp map multicast 172.17.0.1（在分支和HUB之间启动动态路由协议，并发送多播包到HUB路由器上）
ip nhrp network-of 99
ip nhrp holdtime 300
ip nhrp nhs 10.0.0.1（配置HUB路由器作为NHRP的下一跳服务器）
delay 1000
tunnel source Ethernet0
tunnel mode gre multipoint
tunnel key cisco
tunnel protection ipsec profile vpnprof
!
interface Ethernet0
ip address 172.16.0.2 255.255.255.0
!
interface Ethernet1
ip address 192.168.1.1 255.255.255.0
!
router eigrp 1
network 10.0.0.0 0.0.0.255
network 192.168.1.0 0.0.0.255
实验1:
第一步: 建立 Dynamic Multipoint
HUB-R3(config)#interface tunnel 0
HUB-R3(config-if)#ip address 172.16.1.3 255.255.255.0
HUB-R3(config-if)#tunnel source ethernet 0/0
HUB-R3(config-if)#tunnel mode gre multipoint <===点到多点(不需要配置:"tunnel"的"destination")
对比:
HUB-R3(config-if)#tunnel mode gre ip <===点到点,默认配置(需要配置:"tunnel"的"destination")
HUB-R3(config-if)#tunnel key 12345 <===在多点中:"key"是必配(在点到点中:"tunnel"的"key"可不配)
SPOKE-R1(config)#interface tunnel 0
SPOKE-R1(config-if)#ip address 172.16.1.1 255.255.255.0
SPOKE-R1(config-if)#tunnel source ethernet 0/0
SPOKE-R1(config-if)#tunnel mode gre multipoint
SPOKE-R1(config-if)#tunnel key 12345
NHRP配置:
HUB-R3(config)#interface tunnel 0
HUB-R3(config-if)#ip nhrp network-id 100 <===="network-id"号,可任意(但:HUB/SPOKE端要在同一个"network-id"里面)
---------------------------------------
SPOKE-R1(config)#interface tunnel 0
SPOKE-R1(config-if)#ip nhrp network-id 100
SPOKE-R1(config-if)#ip nhrp nhs 172.16.1.3 <===HUB的"tunnel"地址( nhs: nh server )
SPOKE-R1(config-if)#ip nhrp map 172.16.1.3 218.18.34.3 <==="tunnel"地址与公网地址的映射
"tunnel"地址 公网地址
----------------------------------------------
HUB-R3#show ip nhrp <====动态映射
172.16.1.1/32 via 172.16.1.1, Tunnel0 created 00:06:11, expire 01:53:48
Type: dynamic, Flags: authoritative unique registered
NBMA address: 61.1.14.1
----------------------------------------------
SPOKE-R1#show ip nhrp <====静态映射
172.16.1.3/32 via 172.16.1.3, Tunnel0 created 00:04:21, never expire
Type: static, Flags: authoritative used
NBMA address: 218.18.34.3 <===当"SPOKE"端的路由器重启后,就会到"SERVER"端的路由器上去注册,所以SERVER端的路由器的IP地址一定要是静态的IP地址.
------------------------------------------------------------------------
SPOKE-R1#show ip nhrp nhs <===查映射(只能在"SPOKE"端使用)
Legend:
E=Expecting replies
R=Responding
Tunnel0:
172.16.1.3 RE <===有响应
------------------------------------------------------------------------
宣告:
SPOKE-R1(config)#router eigrp 100
SPOKE-R1(config-router)#no auto-summary
SPOKE-R1(config-router)#network 192.168.1.0 0.0.0.255
SPOKE-R1(config-router)#network 172.16.1.0 0.0.0.255
------------------------------------------------------
HUB-R3(config-if)#router eigrp 100
HUB-R3(config-router)#no auto-summary
HUB-R3(config-router)#net 192.168.3.0 0.0.0.255
HUB-R3(config-router)#net 172.16.1.0 0.0.0.255
发组播包:
HUB-R3(config)#interface tunnel 0
HUB-R3(config-if)#ip nhrp map multicast dynamic <===动态地发组播包(HUB)
SPOKE-R1(config)#interface tunnel 0
SPOKE-R1(config-if)#ip nhrp map multicast 218.18.34.3 <====静态地发组播包(SPOKE)
------------------------------------------------------------
出现问题:"HUB-R3"有neighbor,但"SPOKE-R1"没有neighbor ??
HUB-R3(config-if)#
*Mar 1 00:44:49.071: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 172.16.1.1 (Tunnel0) is up: new adjacency
HUB-R3#show ip eigrp neighbors
IP-EIGRP neighbors for process 100
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 172.16.1.1 Tu0 14 00:00:38 1 5000 1 0
SPOKE-R1#show ip eigrp neighbors
IP-EIGRP neighbors for process 100
解决: 1. 先将"HUB"和"SPOKE"端的TUNNEL接口"shut down"
2. 然后"no shut down"HUB端的接口
3. 再"no shut down"SPOKE端的接口
SPOKE-R1#show ip route eigrp
D 192.168.3.0/24 [90/297372416] via 172.16.1.3, 00:00:19, Tunnel0
-------------------------------------------------------------
关闭HUB的"tunnel"接口的水平分割:
HUB-R3(config)#interface tunnel 0
HUB-R3(config-if)#no ip split-horizon eigrp 100 <===关闭EIGRP的"tunnel"接口的水平分割
或者 HUB-R3(config-if)#no ip split-horizon <===这是关闭RIP的水平分割
----------------------------------------------------------------------------------------
出现问题: 在"SPOKE-R1"路由器上去往"SPOKE-R2"路由器的数据包要经过"HUB-R3"路由器 ??
SPOKE-R1#show ip route eigrp 下一跳
D 192.168.2.0/24 [90/310172416] via 172.16.1.3, 00:31:09, Tunnel0 <===在"SPOKE-R1"路由器上去往"SPOKE-R2"路由器的数据包要经过"HUB-R3"路由器
D 192.168.3.0/24 [90/297372416] via 172.16.1.3, 00:31:09, Tunnel0
解决:
HUB-R3(config)#interface tunnel 0
HUB-R3(config-if)#no ip next-hop-self eigrp 100 <===只有12.3以上版本的路由器才有此命令
SPOKE-R2#show ip route eigrp
D 192.168.1.0/24 [90/310172416] via 172.16.1.1, 00:03:46, Tunnel0
D 192.168.3.0/24 [90/297372416] via 172.16.1.3, 00:03:47, Tunnel0
SPOKE-R2#show ip nhrp
172.16.1.1/32 via 172.16.1.1, Tunnel0 created 00:00:17, expire 01:47:40 <===PING了之后才会出现
Type: dynamic, Flags: router
NBMA address: 61.1.14.1
172.16.1.3/32 via 172.16.1.3, Tunnel0 created 00:52:16, never expire
Type: static, Flags: authoritative used
NBMA address: 218.18.34.3
----------------------------------------------------------------------------------------
第二步: 建立 VPN
IKE Phase I Policy:
HUB-R3(config)#crypto isakmp policy 1
HUB-R3(config-isakmp)#authentication pre-share
HUB-R3(config)#crypto isakmp key 0 wolf address 0.0.0.0 0.0.0.0
IPSec Phase II Policy:
HUB-R3(config)#crypto ipsec transform-set cisco esp-des esp-sha-hmac
HUB-R3(cfg-crypto-trans)#mode transport
HUB-R3(config)#crypto ipsec profile huawei
HUB-R3(config-crypto-map)#set transform-set cisco
接口调用:
HUB-R3(config)#interface tunnel 0
HUB-R3(config-if)#tunnel protection ipsec profile huawei
更改MTU值:
SPOKE-R1(config)#int tunnel 0
SPOKE-R1(config-if)#ip mtu 1436 <===更改"tunnel"的MTU值(MTU大于1436将会分片),CISCO建议为:1400
