История страницы

hostname ESR-Spoke-1
 
ip vrf ISP
exit
 
 
route-map LAN_nets
  rule 1
    match ip address 172.16.0.0/24
  exit
exit
 
router bgp log-neighbor-changes
 
router bgp 65002
  router-id 10.2.0.10
  neighbor 10.0.2.1
    remote-as 65001
    update-source gre 1
    address-family ipv4 unicast
      route-map LAN_nets out
      enable
    exit
    enable
  exit
  address-family ipv4 unicast
    redistribute connected route-map LAN_nets
  exit
  enable
exit
 
interface gigabitethernet 1/0/1
  ip vrf forwarding ISP
  ip firewall disable
  ip address 203.0.113.10/24
exit
interface gigabitethernet 1/0/2.100
  ip firewall disable
  ip address 172.16.0.1/24
exit
 
tunnel gre 1
  key 1001
  ttl 255
  mtu 1400
  multipoint
  ip firewall disable
  tunnel-source vrf ISP
  local address 203.0.113.10
  ip address 10.0.2.10/24
  ip tcp adjust-mss 1360
  ip nhrp holding-time 300
  ip nhrp shortcut
  ip nhrp map 10.0.2.1 192.0.2.10
  ip nhrp nhs 10.0.2.1
  ip nhrp ipsec Hub_Cloud_1 static
  ip nhrp ipsec spokes dynamic
  ip nhrp multicast nhs
  ip nhrp enable
  enable
exit
 
security ike proposal prop1
  authentication algorithm sha2-256
  encryption algorithm aes256
  dh-group 19
exit
 
security ike policy pol1
  pre-shared-key ascii-text encrypted B9B81768A85D18A965
  proposal prop1
exit
 
security ike gateway Hub
  version v2-only
  ike-policy pol1
  local address 203.0.113.10
  local network 203.0.113.10/32 protocol gre
  remote address 192.0.2.10
  remote network 192.0.2.10/32 protocol gre
  mode policy-based
  mobike disable
  dead-peer-detection action clear
  dead-peer-detection interval 10
  dead-peer-detection retransmit timeout 5
  dead-peer-detection retransmit tries 2
exit
 
security ike gateway Spokes
  version v2-only
  ike-policy pol1
  local address 203.0.113.10
  local network 203.0.113.10/32 protocol gre
  remote address any
  remote network any protocol gre
  mode policy-based
  mobike disable
  dead-peer-detection action clear
  dead-peer-detection interval 10
  dead-peer-detection retransmit timeout 5
  dead-peer-detection retransmit tries 2
exit
 
security ipsec proposal prop1
  authentication algorithm sha2-256
  encryption algorithm aes256
exit
 
security ipsec policy pol1
  proposal prop1
exit
 
security ipsec vpn Hub
  type transport
  ip vrf forwarding ISP
  ike establish-tunnel route
  ike gateway Hub
  ike ipsec-policy pol1
  enable
exit
 
security ipsec vpn spokes
  type transport
  ip vrf forwarding ISP
  ike establish-tunnel route
  ike gateway Spokes
  ike ipsec-policy pol1
  enable
exit
 
ip route vrf ISP 0.0.0.0/0 203.0.113.1

#
 sysname ar-Spoke-2
#
 ipsec authentication sha2 compatible enable
#
ipsec sa global-duration time-based 10800
ipsec invalid-spi-recovery enable
#
ip vpn-instance ISP
 ipv4-family
#
ipsec proposal prop1
 encapsulation-mode transport
 esp authentication-algorithm sha2-256
 esp encryption-algorithm aes-256
#
ike proposal 1
 encryption-algorithm aes-256
 dh group19
 authentication-algorithm sha2-256
 authentication-method pre-share
 integrity-algorithm hmac-sha2-256
 prf hmac-sha2-256
#
ike peer dmvpn
 pre-shared-key cipher %^%#|~\f>5J63Hm*}y:A8`mHfydGD`rkF/rv7&N"QUmT%^%#
 ike-proposal 1
 dpd type periodic
 dpd idle-time 40
 dpd retransmit-interval 10
 rsa encryption-padding oaep
 rsa signature-padding pss
 ikev2 authentication sign-hash sha2-256
#
ipsec profile dmvpn
 ike-peer dmvpn
 proposal prop1
 sa duration time-based 10800
#
interface GigabitEthernet0/0/0
 ip binding vpn-instance ISP
 ip address 198.18.0.10 255.255.255.0
#
interface GigabitEthernet0/0/2
#
interface GigabitEthernet0/0/2.200
 dot1q termination vid 200
 ip address 172.16.254.1 255.255.255.0
#
interface Tunnel0/0/1
 mtu 1400
 tcp adjust-mss 1360
 ip address 10.0.2.20 255.255.255.0
 tunnel-protocol gre p2mp
 source vpn-instance ISP 198.18.0.10
 gre key cipher %^%#Btj9K_(dn~[PJ,;mUv[={[E8Cx(fF5C!Ik.S["uC%^%#
 ipsec profile dmvpn
 nhrp shortcut
 nhrp registration no-unique
 nhrp registration interval 100
 nhrp entry holdtime seconds 300
 nhrp entry 10.0.2.1 192.0.2.10 register
#
bgp 65002
 router-id 10.2.0.20
 peer 10.0.2.1 as-number 65001
 peer 10.0.2.1 connect-interface Tunnel0/0/1
 #
 ipv4-family unicast
  undo synchronization
  network 172.16.254.0 255.255.255.0
  peer 10.0.2.1 enable
#
ip route-static vpn-instance ISP 0.0.0.0 0.0.0.0 198.18.0.1
#
return

#
 sysname ar-Hub
#
 ipsec authentication sha2 compatible enable
#
ipsec sa global-duration time-based 10800
ipsec invalid-spi-recovery enable
#
ip vpn-instance ISP
 ipv4-family
#
ipsec proposal prop1
 encapsulation-mode transport
 esp authentication-algorithm sha2-256
 esp encryption-algorithm aes-256
#
ike proposal 1
 encryption-algorithm aes-256
 dh group19
 authentication-algorithm sha2-256
 authentication-method pre-share
 integrity-algorithm hmac-sha2-256
 prf hmac-sha2-256
#
ike peer dmvpn
 pre-shared-key cipher %^%#|~\f>5J63Hm*}y:A8`mHfydGD`rkF/rv7&N"QUmT%^%#
 ike-proposal 1
 dpd type periodic
 dpd idle-time 40
 dpd retransmit-interval 10
 rsa encryption-padding oaep
 rsa signature-padding pss
 ikev2 authentication sign-hash sha2-256
#
ipsec profile dmvpn
 ike-peer dmvpn
 proposal prop1
 sa duration time-based 10800
#
interface GigabitEthernet0/0/0
 ip binding vpn-instance ISP
 ip address 198.51.100.10 255.255.255.0
#
interface Tunnel0/0/1
 mtu 1400
 tcp adjust-mss 1360
 ip address 10.0.2.1 255.255.255.0
 tunnel-protocol gre p2mp
 source vpn-instance ISP 198.51.100.10
 gre key cipher %^%#GXwI);@{KFc.M/#M*Sr"zP'&7>t:)&N1A9.Bv~5C%^%#
 ipsec profile dmvpn
 nhrp redirect
 nhrp entry multicast dynamic
#
bgp 65001
 router-id 10.2.0.1
 group DMVPN_cloud external
 peer DMVPN_cloud as-number 65002
 peer DMVPN_cloud connect-interface Tunnel0/0/1
 peer DMVPN_cloud listen-net 10.0.2.0 24
 #
 ipv4-family unicast
  undo synchronization
  peer DMVPN_cloud enable
  peer DMVPN_cloud default-route-advertise route-policy 1
#
route-policy 1 permit node 10
#
ip route-static vpn-instance ISP 0.0.0.0 0.0.0.0 198.51.100.1
#
return