esr# copy system:default-config system:candidate-config 
Entire candidate configuration will be reset to default, all settings will be lost upon commit.     
Do you really want to continue? (y/N): y
|******************************************| 100% (59B) Default configuration loaded successfully.  

esr# configure 
esr(config)# hostname ESR-1 unit 1
esr(config)# hostname ESR-2 unit 2

ESR-1# set unit id 1
Unit ID will be 1 after reboot
ESR-1# reload system 
Do you really want to reload system now? (y/N): y

ESR-1# show unit id
Unit ID is 1
Unit ID will be 1 after reboot

ESR-1(config)# security zone SYNC
ESR-1(config-security-zone)# exit
ESR-1(config)# security zone-pair SYNC self
ESR-1(config-security-zone-pair)# rule 1
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol vrrp
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

ESR-1(config)# bridge 1

ESR-1(config-bridge)# vlan 1
ESR-1(config-bridge)# security-zone SYNC

ESR-1(config-bridge)# ip address 198.51.100.254/24 unit 1
ESR-1(config-bridge)# ip address 198.51.100.253/24 unit 2

ESR-1(config-bridge)# vrrp 1
ESR-1(config-vrrp)# group 1
ESR-1(config-vrrp)# ip address 198.51.100.1/24

ESR-1(config-vrrp)# enable
ESR-1(config-vrrp)# exit  
ESR-1(config-bridge)# enable
ESR-1(config-bridge)# exit

ESR-1(config)# interface gigabitethernet 1/0/1
ESR-1(config-if-gi)# description "Network: SYNC"
ESR-1(config-if-gi)# mode switchport
ESR-1(config-if-gi)# exit
ESR-1(config)# interface gigabitethernet 2/0/1
ESR-1(config-if-gi)# description "Network: SYNC"
ESR-1(config-if-gi)# mode switchport
ESR-1(config-if-gi)# exit

esr-30# show vrrp 
Virtual router   Virtual IP                          Priority   Preemption   State    Inherit   Sync group ID   
--------------   ---------------------------------   --------   ----------   ------   -------   -----------   
1                198.51.100.1/24                     100        Disabled     Backup   --        1               

ESR-1(config)# cluster 

ESR-1(config-cluster)# unit 1
ESR-1(config-cluster-unit)# mac-address E4:5A:D4:A0:BE:35
ESR-1(config-cluster-unit)# exit
ESR-1(config-cluster)# unit 2
ESR-1(config-cluster-unit)# mac-address A8:F9:4B:AF:35:84
ESR-1(config-cluster-unit)# exit

ESR-1(config-cluster)# cluster-interface bridge 1
ESR-1(config-cluster)# enable 
ESR-1(config-cluster)# exit

ESR-1# show cluster status 
Unit   Hostname               Role         MAC address         State            IP address        
----   --------------------   ----------   -----------------   --------------   ---------------   
1*     ESR-1                  Active       e4:5a:d4:a0:be:35   Joined           198.51.100.254       
2      ESR-2                  Standby      a8:f9:4b:af:35:84   Joined           198.51.100.253 

ESR-1# show cluster sync status 
System part              Synced   
----------------------   ------   
candidate-config         Yes      
running-config           Yes      
SW version               Yes      
licence                  Yes      
licence (After reboot)   Yes      
date                     Yes      

ESR-1# copy tftp://<IP_address>:/licence system:cluster-unit-licences
|*************************| 100% (680B) Licence loaded successfully.

ESR-1# copy tftp://<IP_address>:/licence system:cluster-unit-licences
|*************************| 100% (680B) Licence loaded successfully.
ESR-1#
ESR-1#
ESR-1#
ESR-1# show cluster-unit-licences 
Serial number     Features                                                       
---------------   ------------------------------------------------------------   
NP0B003634        BRAS,IPS,WIFI                       
NP0B009033        BRAS,IPS,WIFI
ESR-1# sync cluster system force

cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit
 
hostname ESR-1 unit 1
hostname ESR-2 unit 2
 
security zone SYNC
exit
 
bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit
 
interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
 
security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit

ESR-1# configure 
ESR-1(config)#

ESR-1(config)# system prompt '(Cluster: %s%)'

ESR-1(config)# system prompt '(Cluster: %s% | Unit: %u%)'

ESR-1(config)# system prompt '(Cluster: %s% | Unit: %u% | State: %r%)'

ESR-1(config)# system prompt '(Cluster: %s% | Unit: %u% | State: %r% | VRRP id 1: %v1%)'

ESR-1(config)# system prompt '(Cluster: %s% | Unit: %u% | State: %r% | VRRP id 1: %v1%)|%h%'

ESR-1# commit
Configuration has been successfully applied and saved to flash. Commit timer started, changes will be.
ESR-1# confirm
Configuration has been confirmed. Commit timer canceled.
ESR-1# exit

ESR-1 login: admin
Password: 

********************************************
*            Welcome to ESR                *
********************************************

(Cluster: Yes | Unit: 1 | State: Active | VRRP id 1: Master)|ESR-1#

ESR-2# 2024-12-27T15:25:04+00:00 %CLUSTER-I-SYNC_CONFIG_INFO: unit 1 'ESR-1' starts a synchronous operation 'commit'
2024-12-27T15:25:09+00:00 %CLUSTER-I-SYNC_CONFIG_INFO: 'commit' successful performed
ESR-2# exit

ESR-2 login: admin
Password: 

********************************************
*            Welcome to ESR                *
********************************************

(Cluster: Yes | Unit: 2 | State: Standby | VRRP id 1: Backup)|ESR-2# 

cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2.3
  security-zone WAN
  ip address 128.66.0.6/30
  vrrp 3
    ip address 128.66.0.2/30
    group 1
    enable
  exit
exit
interface gigabitethernet 1/0/2.4
  security-zone WAN
  ip address 128.66.0.10/30
  vrrp 4
    ip address 128.66.0.14/30
    group 1
    enable
  exit
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2.3
  security-zone WAN
  ip address 128.66.0.5/30
  vrrp 3
    ip address 128.66.0.2/30
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/2.4
  security-zone WAN
  ip address 128.66.0.9/30
  vrrp 4
    ip address 128.66.0.14/30
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

ESR-1(config)# wan load-balance target-list WAN
ESR-1(config-wan-target-list)# target 1
ESR-1(config-wan-target)# ip address 128.66.0.17
ESR-1(config-wan-target)# enable
ESR-1(config-wan-target)# exit
ESR-1(config-wan-target-list)# exit

ESR-1(config)# interface gigabitethernet 1/0/2.3
ESR-1(config-if-sub)# wan load-balance nexthop 128.66.0.1
ESR-1(config-if-sub)# wan load-balance target-list WAN
ESR-1(config-if-sub)# wan load-balance enable
ESR-1(config-if-sub)# exit
ESR-1(config)# interface gigabitethernet 2/0/2.3
ESR-1(config-if-sub)# wan load-balance nexthop 128.66.0.1
ESR-1(config-if-sub)# wan load-balance target-list WAN
ESR-1(config-if-sub)# wan load-balance enable
ESR-1(config-if-sub)# exit

ESR-1(config)# interface gigabitethernet 1/0/2.4
ESR-1(config-if-sub)# wan load-balance nexthop 128.66.0.13
ESR-1(config-if-sub)# wan load-balance target-list WAN
ESR-1(config-if-sub)# wan load-balance enable
ESR-1(config-if-sub)# exit
ESR-1(config)# interface gigabitethernet 2/0/2.4
ESR-1(config-if-sub)# wan load-balance nexthop 128.66.0.13
ESR-1(config-if-sub)# wan load-balance target-list WAN
ESR-1(config-if-sub)# wan load-balance enable
ESR-1(config-if-sub)# exit

ESR-1(config)# ip route 0.0.0.0/0 wan load-balance rule 1 10
ESR-1(config)# wan load-balance rule 1
ESR-1(config-wan-rule)# outbound interface gigabitethernet 1/0/2.3 70
ESR-1(config-wan-rule)# outbound interface gigabitethernet 1/0/2.4 30
ESR-1(config-wan-rule)# outbound interface gigabitethernet 2/0/2.3 70
ESR-1(config-wan-rule)# outbound interface gigabitethernet 2/0/2.4 30
ESR-1(config-wan-rule)# enable
ESR-1(config-wan-rule)# exit

ESR-1# show wan rules 
Rule 1 detailed information:
    VRF:          default
    Failover:     Disabled
    Network: 0.0.0.0/0 Metric: 10
        gi1/0/2.3 Weight: 70 Nexthop: 128.66.0.1 [Active]
        gi1/0/2.4 Weight: 30 Nexthop: 128.66.0.13 [Active]

ESR-1# show wan interfaces status 
Interface              Nexthop                   Status     Uptime/Downtime        
                                                            (d,h:m:s)              
--------------------   -----------------------   --------   --------------------   
gi1/0/2.3              128.66.0.1                Active     00,00:00:44            
gi1/0/2.4              128.66.0.13               Active     00,00:00:45            

cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone WAN
exit
security zone LAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone WAN
  ip address 128.66.0.2/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit 
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone WAN
  ip address 128.66.0.1/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

ESR-1(config)# object-group service ISAKMP
ESR-1(config-object-group-service)# port-range 500
ESR-1(config-object-group-service)# port-range 4500
ESR-1(config-object-group-service)# exit

ESR-1(config)# security zone-pair WAN self
ESR-1(config-security-zone-pair)# rule 2
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol udp
ESR-1(config-security-zone-pair-rule)# match destination-port object-group ISAKMP
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# rule 3
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol esp
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

ESR-1(config)# security zone IPSEC
ESR-1(config-security-zone)# exit
ESR-1(config)# tunnel vti 1
ESR-1(config-vti)# security-zone IPSEC
ESR-1(config-vti)# local address 203.0.113.2
ESR-1(config-vti)# remote address 203.0.113.6
ESR-1(config-vti)# ip address 128.66.0.6/30
ESR-1(config-vti)# enable
ESR-1(config-vti)# exit

ESR-1(config)# security zone-pair LAN IPSEC
ESR-1(config-security-zone-pair)# rule 1
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit
ESR-1(config)# security zone-pair IPSEC LAN
ESR-1(config-security-zone-pair)# rule 1
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

ESR-1(config)# security ike proposal ike_prop
ESR-1(config-ike-proposal)# dh-group 2
ESR-1(config-ike-proposal)# authentication algorithm md5 
ESR-1(config-ike-proposal)# encryption algorithm aes128
ESR-1(config-ike-proposal)# exit

ESR-1(config)# security ike policy ike_pol
ESR-1(config-ike-policy)# pre-shared-key ascii-text password
ESR-1(config-ike-policy)# proposal ike_prop
ESR-1(config-ike-policy)# exit

ESR-1(config)# security ike gateway ike_gw
ESR-1(config-ike-gw)# version v2-only
ESR-1(config-ike-gw)# ike-policy ike_pol 
ESR-1(config-ike-gw)# mode route-based 
ESR-1(config-ike-gw)# mobike disable
ESR-1(config-ike-gw)# bind-interface vti 1
ESR-1(config-ike-gw)# exit

ESR-1(config)# security ipsec proposal ipsec_prop
ESR-1(config-ipsec-proposal)# authentication algorithm md5 
ESR-1(config-ipsec-proposal)# encryption algorithm aes128
ESR-1(config-ipsec-proposal)# exit

ESR-1(config)# security ipsec policy ipsec_pol
ESR-1(config-ipsec-policy)# proposal ipsec_prop
ESR-1(config-ipsec-policy)# exit

ESR-1(config)# security ipsec vpn ipsec
ESR-1(config-ipsec-vpn)# ike establish-tunnel route 
ESR-1(config-ipsec-vpn)# ike gateway ike_gw
ESR-1(config-ipsec-vpn)# ike ipsec-policy ipsec_pol
ESR-1(config-ipsec-vpn)# enable 
ESR-1(config-ipsec-vpn)# exit

ESR-1(config)# ip route 128.66.1.0/24 128.66.0.5

ESR-1# show tunnels status 
Tunnel             Admin   Link    MTU      Local IP           Remote IP          Last change     
                   state   state                                                  (d,h:m:s)       
----------------   -----   -----   ------   ----------------   ----------------   -------------   
vti 1              Up      Up      1500     203.0.113.2        203.0.113.6        00,00:05:59     

ESR-1# show security ipsec vpn status 
Name                              Local host        Remote host       Initiator spi        Responder spi        State         
-------------------------------   ---------------   ---------------   ------------------   ------------------   -----------   
ipsec                             203.0.113.2       203.0.113.6       0x65212b7585c59b50   0x53028e1afc23a024   Established   

cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone WAN
exit
security zone LAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone WAN
  ip address 128.66.0.2/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit 
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone WAN
  ip address 128.66.0.1/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

ESR-1(config)# object-group service ISAKMP
ESR-1(config-object-group-service)# port-range 500
ESR-1(config-object-group-service)# port-range 4500
ESR-1(config-object-group-service)# exit

ESR-1(config)# security zone-pair WAN self
ESR-1(config-security-zone-pair)# rule 2
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol udp
ESR-1(config-security-zone-pair-rule)# match destination-port object-group ISAKMP
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# rule 3
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol esp
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

ESR-1(config)# object-group network LAN
ESR-1(config-object-group-network)# ip prefix 192.0.2.0/24
ESR-1(config-object-group-network)# exit
ESR-1(config)# object-group network IPSEC
ESR-1(config-object-group-network)# ip prefix 128.66.1.0/24
ESR-1(config-object-group-network)# exit
ESR-1(config)# security zone-pair LAN WAN
ESR-1(config-security-zone-pair)# rule 1
ESR-1(config-security-zone-pair-rule)# match source-address object-group network LAN 
ESR-1(config-security-zone-pair-rule)# match destination-address object-group network IPSEC 
ESR-1(config-security-zone-pair-rule)# action permit 
ESR-1(config-security-zone-pair-rule)# enable 
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit
ESR-1(config)# security zone-pair WAN LAN 
ESR-1(config-security-zone-pair)# rule 1
ESR-1(config-security-zone-pair-rule)# match source-address object-group network IPSEC 
ESR-1(config-security-zone-pair-rule)# match destination-address object-group network LAN 
ESR-1(config-security-zone-pair-rule)# action permit 
ESR-1(config-security-zone-pair-rule)# enable 
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

ESR-1(config)# security ike proposal ike_prop
ESR-1(config-ike-proposal)# dh-group 2
ESR-1(config-ike-proposal)# authentication algorithm md5 
ESR-1(config-ike-proposal)# encryption algorithm aes128
ESR-1(config-ike-proposal)# exit

ESR-1(config)# security ike policy ike_pol
ESR-1(config-ike-policy)# pre-shared-key ascii-text password
ESR-1(config-ike-policy)# proposal ike_prop
ESR-1(config-ike-policy)# exit

ESR-1(config)# security ike gateway ike_gw
ESR-1(config-ike-gw)# ike-policy ike_pol
ESR-1(config-ike-gw)# local address 203.0.113.2
ESR-1(config-ike-gw)# local network 192.0.2.0/24
ESR-1(config-ike-gw)# remote address 203.0.113.6
ESR-1(config-ike-gw)# remote network 128.66.1.0/24
ESR-1(config-ike-gw)# mode policy-based
ESR-1(config-ike-gw)# exit

ESR-1(config)# security ipsec proposal ipsec_prop
ESR-1(config-ipsec-proposal)# authentication algorithm md5 
ESR-1(config-ipsec-proposal)# encryption algorithm aes128
ESR-1(config-ipsec-proposal)# exit

ESR-1(config)# security ipsec policy ipsec_pol
ESR-1(config-ipsec-policy)# proposal ipsec_prop
ESR-1(config-ipsec-policy)# exit

ESR-1(config)# security ipsec vpn ipsec
ESR-1(config-ipsec-vpn)# ike establish-tunnel route 
ESR-1(config-ipsec-vpn)# ike gateway ike_gw
ESR-1(config-ipsec-vpn)# ike ipsec-policy ipsec_pol
ESR-1(config-ipsec-vpn)# enable
ESR-1(config-ipsec-vpn)# exit

ESR-1(config)# ip route 128.66.1.0/24 203.0.113.1

ESR-1# show security ipsec vpn status 
Name                              Local host        Remote host       Initiator spi        Responder spi        State         
-------------------------------   ---------------   ---------------   ------------------   ------------------   -----------   
ipsec                             203.0.113.2       203.0.113.6       0x201602ebcafb809b   0x4556a21a7012d2c0   Established   

cluster
  cluster-interface bridge 1
  unit 1
    mac-address cc:9d:a2:71:83:78
  exit
  unit 2
    mac-address cc:9d:a2:71:82:38
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone WAN
exit
security zone LAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone WAN
  ip address 128.66.0.6/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit 
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 128.66.0.2/30
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone WAN
  ip address 128.66.0.5/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit 
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 128.66.0.1/30
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit 

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN WAN
  rule 1
    action permit
    enable
  exit
exit

ip route 0.0.0.0/0 203.0.113.1

ESR-1(config)# object-group network SYNC_SRC
ESR-1(config-object-group-network)# ip address-range 198.51.100.254 unit 1
ESR-1(config-object-group-network)# ip address-range 198.51.100.253 unit 2
ESR-1(config-object-group-network)# exit
ESR-1(config)# object-group network SYNC_DST
ESR-1(config-object-group-network)# ip address-range 198.51.100.253 unit 1
ESR-1(config-object-group-network)# ip address-range 198.51.100.254 unit 2
ESR-1(config-object-group-network)# exit

ESR-1(config)# ip failover
ESR-1(config-failover)# local-address object-group SYNC_SRC
ESR-1(config-failover)# remote-address object-group SYNC_DST
ESR-1(config-failover)# vrrp-group 1
ESR-1(config-failover)# exit

ESR-1(config)# object-group service FAILOVER
ESR-1(config-object-group-service)# port-range 9999
ESR-1(config-object-group-service)# exit

ESR-1(config)# security zone-pair SYNC self 
ESR-1(config-security-zone-pair)# rule 4
ESR-1(config-security-zone-pair-rule)# action permit 
ESR-1(config-security-zone-pair-rule)# match protocol udp 
ESR-1(config-security-zone-pair-rule)# match destination-port object-group FAILOVER
ESR-1(config-security-zone-pair-rule)# enable 
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

ESR-1(config)# ip firewall failover
ESR-1(config-firewall-failover)# sync-type unicast
ESR-1(config-firewall-failover)# port 9999
ESR-1(config-firewall-failover)# enable 
ESR-1(config-firewall-failover)# exit

ESR-1# show ip firewall failover 
Communication interface:                    bridge 1
Status:                                     Running
Bytes sent:                                 3420
Bytes received:                             3320
Packets sent:                               209
Packets received:                           209
Send errors:                                0
Receive errors:                             0
Resend queue: 
    Active entries:                         1
    Errors: 
        No space left:                      0
Hold queue: 
    Active entries:                         0
    Errors: 
        No space left:                      0

ESR-1# show high-availability state 
AP Tunnels:
    State:                         Disabled
    Last state change:             --
DHCP option 82 table:
    State:                         Disabled
    Last state change:             --
DHCP server:
    State:                         Disabled
    Last state change:             --
crypto-sync:
    State:                         Disabled
Firewall sessions and NAT translations:
VRF:                               --
    Tracking VRRP Group            1
    Tracking VRRP Group state:     Master
    State:                         Successful synchronization
    Fault Reason:                  --
    Last synchronization:          2025-02-12 07:05:47

ESR-1# show ip firewall sessions failover internal 
 Codes: E - expected, U - unreplied,
        A - assured, C - confirmed

Prot    Aging        Inside source           Inside destination      Outside source          Outside destination     Pkts         Bytes        Status   
-----   ----------   ---------------------   ---------------------   ---------------------   ---------------------   ----------   ----------   ------   
tcp     0            192.0.2.10:44812        128.66.1.1:22           128.66.1.1:22           192.0.2.10:44812        --           --           AC       

ESR-1# show ip firewall sessions failover external 
  Codes: E - expected, U - unreplied,
        A - assured, C - confirmed

Prot    Aging        Inside source           Inside destination      Outside source          Outside destination     Pkts         Bytes        Status   
-----   ----------   ---------------------   ---------------------   ---------------------   ---------------------   ----------   ----------   ------   
tcp     0            192.0.2.10:44812        128.66.1.1:22           128.66.1.1:22           192.0.2.10:44812        --           --           AC       

ESR-1# show ip firewall failover cache 
Internal sessions cache counters:
    Active entries:                         1
    Added:                                  5
    Deleted:                                4
    Updated:                                4
    Failed adding:                          0
        No memory left:                     0
        No space left:                      0
    Failed deleting:                        0
        No entry found:                     0
    Failed updating:                        0
        No entry found:                     0
External sessions cache counters:
    Active entries:                         0
    Added:                                  0
    Deleted:                                0
    Updated:                                0
    Installed to Kernel:                    0
    Failed adding:                          0
        No memory left:                     0
        No space left:                      0
    Failed deleting:                        0
        No entry found:                     0
    Failed updating:                        0
        No entry found:                     0
    Failed installing to Kernel:            0

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

ip vrf PAIR_ONE
exit
ip vrf PAIR_TWO
exit

security zone SYNC
exit
security zone LAN_ONE
  ip vrf forwarding PAIR_ONE
exit
security zone LAN_TWO
  ip vrf forwarding PAIR_TWO
exit
security zone WAN_ONE
  ip vrf forwarding PAIR_ONE
exit
security zone WAN_TWO
  ip vrf forwarding PAIR_TWO
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
exit
interface gigabitethernet 1/0/2.2
  ip vrf forwarding PAIR_ONE
  security-zone LAN_ONE
  ip address 203.0.113.18/30
  vrrp 4
    ip address 192.0.2.1/24
    priority 120
    group 2
    enable
  exit
exit 
interface gigabitethernet 1/0/2.3
  ip vrf forwarding PAIR_TWO
  security-zone LAN_TWO
  ip address 203.0.113.22/30
  vrrp 5
    ip address 128.66.0.1/24
    priority 110
    group 3
    enable
  exit
exit 
interface gigabitethernet 1/0/3.2
  ip vrf forwarding PAIR_ONE
  security-zone WAN_ONE
  ip address 203.0.113.10/30
  vrrp 2
    ip address 203.0.113.2/30
    group 2
    enable
  exit
exit 
interface gigabitethernet 1/0/3.3
  ip vrf forwarding PAIR_TWO
  security-zone WAN_TWO
  ip address 203.0.113.14/30
  vrrp 3
    ip address 203.0.113.6/30
    group 3
    enable
  exit
exit 
interface gigabitethernet 2/0/1
  mode switchport
exit
interface gigabitethernet 2/0/2.2
  ip vrf forwarding PAIR_ONE
  security-zone LAN_ONE
  ip address 203.0.113.17/30
  vrrp 4
    ip address 192.0.2.1/24
    priority 110
    group 2
    enable
  exit
exit
interface gigabitethernet 2/0/2.3
  ip vrf forwarding PAIR_TWO
  security-zone LAN_TWO
  ip address 203.0.113.21/30
  vrrp 5
    ip address 128.66.0.1/24
    priority 120
    group 3
    enable
  exit
exit 
interface gigabitethernet 2/0/3.2
  ip vrf forwarding PAIR_ONE
  security-zone WAN_ONE
  ip address 203.0.113.9/30
  vrrp 2
    ip address 203.0.113.2/30
    group 2
    enable
  exit
exit
interface gigabitethernet 2/0/3.3
  ip vrf forwarding PAIR_TWO
  security-zone WAN_TWO
  ip address 203.0.113.13/30
  vrrp 3
    ip address 203.0.113.6/30
    group 3
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN_ONE self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN_TWO self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair WAN_ONE self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair WAN_TWO self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN_ONE WAN_ONE
  rule 1
    action permit
    enable
  exit
exit
security zone-pair LAN_TWO WAN_TWO
  rule 1
    action permit
    enable
  exit
exit

ESR-1(config)# object-group network DST_PAIR_ONE
ESR-1(config-object-group-network)# ip address-range 203.0.113.17 unit 1
ESR-1(config-object-group-network)# ip address-range 203.0.113.18 unit 2
ESR-1(config-object-group-network)# exit
ESR-1(config)# object-group network DST_PAIR_TWO
ESR-1(config-object-group-network)# ip address-range 203.0.113.21 unit 1
ESR-1(config-object-group-network)# ip address-range 203.0.113.22 unit 2
ESR-1(config-object-group-network)# exit
ESR-1(config)# object-group network SRC_PAIR_ONE
ESR-1(config-object-group-network)# ip address-range 203.0.113.18 unit 1
ESR-1(config-object-group-network)# ip address-range 203.0.113.17 unit 2
ESR-1(config-object-group-network)# exit
ESR-1(config)# object-group network SRC_PAIR_TWO
ESR-1(config-object-group-network)# ip address-range 203.0.113.22 unit 1
ESR-1(config-object-group-network)# ip address-range 203.0.113.21 unit 2
ESR-1(config-object-group-network)# exit

ESR-1(config)# ip failover vrf PAIR_ONE
ESR-1(config-failover)# local-address object-group SRC_PAIR_ONE
ESR-1(config-failover)# remote-address object-group DST_PAIR_ONE
ESR-1(config-failover)# vrrp-group 2
ESR-1(config-failover)# exit
ESR-1(config)# ip failover vrf PAIR_TWO
ESR-1(config-failover)# local-address object-group SRC_PAIR_TWO
ESR-1(config-failover)# remote-address object-group DST_PAIR_TWO
ESR-1(config-failover)# vrrp-group 3
ESR-1(config-failover)# exit

ESR-1(config)# ip firewall failover vrf PAIR_ONE
ESR-1(config-firewall-failover)# sync-type unicast
ESR-1(config-firewall-failover)# port 9999
ESR-1(config-firewall-failover)# enable
ESR-1(config-firewall-failover)# exit
ESR-1(config)# ip firewall failover vrf PAIR_TWO
ESR-1(config-firewall-failover)# sync-type unicast
ESR-1(config-firewall-failover)# port 9999
ESR-1(config-firewall-failover)# enable
ESR-1(config-firewall-failover)# exit

ESR-1(config)# object-group service FAILOVER
ESR-1(config-object-group-service)# port-range 9999
ESR-1(config-object-group-service)# exit
ESR-1(config)# security zone-pair LAN_ONE self
ESR-1(config-security-zone-pair)# rule 3
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol udp
ESR-1(config-security-zone-pair-rule)# match destination-port object-group FAILOVER
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit
ESR-1(config)# security zone-pair LAN_TWO self
ESR-1(config-security-zone-pair)# rule 3
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol udp
ESR-1(config-security-zone-pair-rule)# match destination-port object-group FAILOVER
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

ESR-1# show vrrp vrf PAIR_ONE 

   Unit 1* 'ESR-1'
   ---------------
Virtual router   Virtual IP                          Priority   Preemption   State    Inherit   Sync group ID   
--------------   ---------------------------------   --------   ----------   ------   -------   -------------   
2                203.0.113.2/30                      100        Enabled      Master   --        2               
4                192.0.2.1/24                        120        Enabled      Master   --        2               


   Unit 2 'ESR-2'
   --------------
Virtual router   Virtual IP                          Priority   Preemption   State    Inherit   Sync group ID   
--------------   ---------------------------------   --------   ----------   ------   -------   -------------   
2                203.0.113.2/30                      100        Enabled      Backup   --        2               
4                192.0.2.1/24                        110        Enabled      Backup   --        2               

ESR-1# show vrrp vrf PAIR_TWO

   Unit 1* 'ESR-1'
   ---------------
Virtual router   Virtual IP                          Priority   Preemption   State    Inherit   Sync group ID   
--------------   ---------------------------------   --------   ----------   ------   -------   -------------   
3                203.0.113.6/30                      100        Enabled      Backup   --        3               
5                128.66.0.1/24                       110        Enabled      Backup   --        3               


   Unit 2 'ESR-2'
   --------------
Virtual router   Virtual IP                          Priority   Preemption   State    Inherit   Sync group ID   
--------------   ---------------------------------   --------   ----------   ------   -------   -------------   
3                203.0.113.6/30                      100        Enabled      Master   --        3               
5                128.66.0.1/24                       120        Enabled      Master   --        3               

ESR-1# show ip firewall failover vrf PAIR_ONE 
Communication interface:                    gigabitethernet 1/0/2.2
Status:                                     Running
Bytes sent:                                 7420
Bytes received:                             7200
Packets sent:                               465
Packets received:                           460
Send errors:                                0
Receive errors:                             0
Resend queue: 
    Active entries:                         1
    Errors: 
        No space left:                      0
Hold queue: 
    Active entries:                         0
    Errors: 
        No space left:                      0
ESR-1# show ip firewall failover vrf PAIR_TWO 
Communication interface:                    gigabitethernet 1/0/2.3
Status:                                     Running
Bytes sent:                                 7320
Bytes received:                             7380
Packets sent:                               468
Packets received:                           464
Send errors:                                0
Receive errors:                             0
Resend queue: 
    Active entries:                         1
    Errors: 
        No space left:                      0
Hold queue: 
    Active entries:                         0
    Errors: 
        No space left:                      0

ESR-1# show high-availability state 
DHCP server:
    State:                         Disabled
    Last state change:             --
crypto-sync:
    State:                         Disabled
Firewall sessions and NAT translations:
VRF:                               PAIR_ONE
    State:                         Successful synchronization
    Fault Reason:                  --
    Last synchronization:          2025-02-18 08:51:34
VRF:                               PAIR_TWO
    State:                         Successful synchronization
    Fault Reason:                  --
    Last synchronization:          2025-02-18 08:51:34

ESR-1# show ip firewall sessions vrf PAIR_ONE protocol tcp 
 Codes: E - expected, U - unreplied,
        A - assured, C - confirmed

Prot    Aging        Inside source           Inside destination      Outside source          Outside destination     Pkts         Bytes        Status   
-----   ----------   ---------------------   ---------------------   ---------------------   ---------------------   ----------   ----------   ------   
tcp     110          192.0.2.10:47406        203.0.113.1:22          192.0.2.10:47406        203.0.113.1:22          --           --           AC       
ESR-1# show ip firewall sessions vrf PAIR_TWO protocol tcp 

ESR-2# show ip firewall sessions vrf PAIR_ONE protocol tcp
ESR-2# show ip firewall sessions vrf PAIR_TWO protocol tcp 
 Codes: E - expected, U - unreplied,
        A - assured, C - confirmed

Prot    Aging        Inside source           Inside destination      Outside source          Outside destination     Pkts         Bytes        Status   
-----   ----------   ---------------------   ---------------------   ---------------------   ---------------------   ----------   ----------   ------   
tcp     113          128.66.0.10:59108       203.0.113.5:22          128.66.0.10:59108       203.0.113.5:22          --           --           AC       

ESR-1# show ip firewall sessions failover external vrf PAIR_ONE 
ESR-1# show ip firewall sessions failover internal vrf PAIR_ONE 
 Codes: E - expected, U - unreplied,
        A - assured, C - confirmed

Prot    Aging        Inside source           Inside destination      Outside source          Outside destination     Pkts         Bytes        Status   
-----   ----------   ---------------------   ---------------------   ---------------------   ---------------------   ----------   ----------   ------   
tcp     0            192.0.2.10:47406        203.0.113.1:22          203.0.113.1:22          192.0.2.10:47406        --           --           AC       
ESR-1# show ip firewall sessions failover external vrf PAIR_TWO 
 Codes: E - expected, U - unreplied,
        A - assured, C - confirmed

Prot    Aging        Inside source           Inside destination      Outside source          Outside destination     Pkts         Bytes        Status   
-----   ----------   ---------------------   ---------------------   ---------------------   ---------------------   ----------   ----------   ------   
tcp     0            128.66.0.10:59108       203.0.113.5:22          203.0.113.5:22          128.66.0.10:59108       --           --           AC       
ESR-1# show ip firewall sessions failover internal vrf PAIR_TWO 

ESR-2# show ip firewall sessions failover external vrf PAIR_ONE 
 Codes: E - expected, U - unreplied,
        A - assured, C - confirmed

Prot    Aging        Inside source           Inside destination      Outside source          Outside destination     Pkts         Bytes        Status   
-----   ----------   ---------------------   ---------------------   ---------------------   ---------------------   ----------   ----------   ------   
tcp     0            192.0.2.10:47406        203.0.113.1:22          203.0.113.1:22          192.0.2.10:47406        --           --           AC       
ESR-2# show ip firewall sessions failover internal vrf PAIR_ONE 
ESR-2# show ip firewall sessions failover external vrf PAIR_TWO 
ESR-2# show ip firewall sessions failover internal vrf PAIR_TWO 
 Codes: E - expected, U - unreplied,
        A - assured, C - confirmed

Prot    Aging        Inside source           Inside destination      Outside source          Outside destination     Pkts         Bytes        Status   
-----   ----------   ---------------------   ---------------------   ---------------------   ---------------------   ----------   ----------   ------   
tcp     0            128.66.0.10:59108       203.0.113.5:22          203.0.113.5:22          128.66.0.10:59108       --           --           AC       

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

object-group service DHCP_SERVER
  port-range 67
exit
object-group service DHCP_CLIENT
  port-range 68
exit

security zone SYNC
exit
security zone LAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol udp
    match source-port object-group DHCP_CLIENT
    match destination-port object-group DHCP_SERVER
    enable
  exit
exit

ip dhcp-server
ip dhcp-server pool TRUSTED
  network 192.0.2.0/24
  address-range 192.0.2.10-192.0.2.100
  default-router 192.0.2.1
exit

ESR-1(config)# object-group network SYNC_SRC
ESR-1(config-object-group-network)# ip address-range 198.51.100.254 unit 1
ESR-1(config-object-group-network)# ip address-range 198.51.100.253 unit 2
ESR-1(config-object-group-network)# exit
ESR-1(config)# object-group network SYNC_DST
ESR-1(config-object-group-network)# ip address-range 198.51.100.253 unit 1
ESR-1(config-object-group-network)# ip address-range 198.51.100.254 unit 2
ESR-1(config-object-group-network)# exit

ESR-1(config)# ip failover
ESR-1(config-failover)# local-address object-group SYNC_SRC
ESR-1(config-failover)# remote-address object-group SYNC_DST
ESR-1(config-failover)# vrrp-group 1
ESR-1(config-failover)# exit

ESR-1(config)# ip dhcp-server failover 
ESR-1(config-dhcp-server-failover)# mode active-standby 
ESR-1(config-dhcp-server-failover)# enable
ESR-1(config-dhcp-server-failover)# exit

ESR-1(config)# object-group service SYNC
ESR-1(config-object-group-service)# port-range 873
ESR-1(config-object-group-service)# exit
ESR-1(config)# security zone-pair SYNC self
ESR-1(config-security-zone-pair)# rule 4
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol tcp
ESR-1(config-security-zone-pair-rule)# match destination-port object-group SYNC
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

ESR-1# show ip dhcp server failover 
VRF:                             --
    Mode:                        Active-Standby
    Role:                        Master
    State:                       Synchronized
    Last synchronization:        2025-02-12 07:56:40

ESR-1# show high-availability state 
AP Tunnels:
    State:                         Disabled
    Last state change:             --
DHCP option 82 table:
    State:                         Disabled
    Last state change:             --
DHCP server:
VRF:                               --
    Mode:                          Active-Standby
    State:                         Successful synchronization
    Last synchronization:          2025-02-12 07:56:36
crypto-sync:
    State:                         Disabled
Firewall sessions and NAT translations:
    State:                         Disabled

ESR-1# show ip dhcp binding 
IP address         MAC / Client ID                                                 Binding type   Lease expires at       
----------------   -------------------------------------------------------------   ------------   --------------------   
192.0.2.10         e4:5a:d4:01:18:04                                               active         2025-02-13 07:56:09    

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

object-group service DHCP_SERVER
  port-range 67
exit
object-group service DHCP_CLIENT
  port-range 68
exit

ip vrf LAN_ONE
exit
ip vrf LAN_TWO
exit

security zone SYNC
exit
security zone LAN_ONE
  ip vrf forwarding LAN_ONE
exit
security zone LAN_TWO
  ip vrf forwarding LAN_TWO
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
exit
interface gigabitethernet 1/0/2.2
  ip vrf forwarding LAN_ONE
  security-zone LAN_ONE
  ip address 192.0.2.254/24
  vrrp 4
    ip address 192.0.2.1/24
    priority 120
    group 2
    enable
  exit
exit
interface gigabitethernet 1/0/2.3
  ip vrf forwarding LAN_TWO
  security-zone LAN_TWO
  ip address 128.66.0.254/24
  vrrp 5
    ip address 128.66.0.1/24
    priority 110
    group 3
    enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
exit
interface gigabitethernet 2/0/2.2
  ip vrf forwarding LAN_ONE
  security-zone LAN_ONE
  ip address 192.0.2.253/24
  vrrp 4
    ip address 192.0.2.1/24
    priority 110
    group 2
    enable
  exit
exit
interface gigabitethernet 2/0/2.3
  ip vrf forwarding LAN_TWO
  security-zone LAN_TWO
  ip address 128.66.0.253/24
  vrrp 5
    ip address 128.66.0.1/24
    priority 120
    group 3
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN_ONE self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol udp
    match source-port object-group DHCP_CLIENT
    match destination-port object-group DHCP_SERVER
    enable
  exit
exit
security zone-pair LAN_TWO self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol udp
    match source-port object-group DHCP_CLIENT
    match destination-port object-group DHCP_SERVER
    enable
  exit
exit

ip dhcp-server vrf LAN_ONE
ip dhcp-server pool LAN_ONE vrf LAN_ONE
  network 192.0.2.0/24
  address-range 192.0.2.10-192.0.2.253
  default-router 192.0.2.1
exit
ip dhcp-server vrf LAN_TWO
ip dhcp-server pool LAN_TWO vrf LAN_TWO
  network 128.66.0.0/24
  address-range 128.66.0.10-128.66.0.253
  default-router 128.66.0.1
exit

ESR-1(config)# object-group network DST_LAN_ONE
ESR-1(config-object-group-network)# ip address-range 192.0.2.253 unit 1
ESR-1(config-object-group-network)# ip address-range 192.0.2.254 unit 2
ESR-1(config-object-group-network)# exit
ESR-1(config)# object-group network DST_LAN_TWO
ESR-1(config-object-group-network)# ip address-range 128.66.0.253 unit 1
ESR-1(config-object-group-network)# ip address-range 128.66.0.254 unit 2
ESR-1(config-object-group-network)# exit
ESR-1(config)# object-group network SRC_LAN_ONE
ESR-1(config-object-group-network)# ip address-range 192.0.2.254 unit 1
ESR-1(config-object-group-network)# ip address-range 192.0.2.253 unit 2
ESR-1(config-object-group-network)# exit
ESR-1(config)# object-group network SRC_LAN_TWO
ESR-1(config-object-group-network)# ip address-range 128.66.0.254 unit 1
ESR-1(config-object-group-network)# ip address-range 128.66.0.253 unit 2
ESR-1(config-object-group-network)# exit

ESR-1(config)# ip failover vrf LAN_ONE
ESR-1(config-failover)# local-address object-group SRC_LAN_ONE
ESR-1(config-failover)# remote-address object-group DST_LAN_ONE
ESR-1(config-failover)# vrrp-group 2
ESR-1(config-failover)# exit
ESR-1(config)# ip failover vrf LAN_TWO
ESR-1(config-failover)# local-address object-group SRC_LAN_TWO
ESR-1(config-failover)# remote-address object-group DST_LAN_TWO
ESR-1(config-failover)# vrrp-group 3
ESR-1(config-failover)# exit

ESR-1(config)# ip dhcp-server failover vrf LAN_ONE
ESR-1(config-dhcp-server-failover)# mode active-standby
ESR-1(config-dhcp-server-failover)# enable
ESR-1(config-dhcp-server-failover)# exit
ESR-1(config)# ip dhcp-server failover vrf LAN_TWO
ESR-1(config-dhcp-server-failover)# mode active-standby
ESR-1(config-dhcp-server-failover)# enable
ESR-1(config-dhcp-server-failover)# exit

ESR-1(config)# object-group service SYNC
ESR-1(config-object-group-service)# port-range 873
ESR-1(config-object-group-service)# exit
ESR-1(config)# security zone-pair LAN_ONE self
ESR-1(config-security-zone-pair)# rule 3
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol tcp
ESR-1(config-security-zone-pair-rule)# match destination-port object-group SYNC
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit
ESR-1(config)# security zone-pair LAN_TWO self
ESR-1(config-security-zone-pair)# rule 3
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol tcp
ESR-1(config-security-zone-pair-rule)# match destination-port object-group SYNC
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit
ESR-1(config)# exi

ESR-1# show ip dhcp server failover vrf LAN_ONE 
VRF:                             LAN_ONE
    Mode:                        Active-Standby
    Role:                        Master
    State:                       Synchronized
    Last synchronization:        2025-02-18 09:34:44
ESR-1# show ip dhcp server failover vrf LAN_TWO 
VRF:                             LAN_TWO
    Mode:                        Active-Standby
    Role:                        Backup
    State:                       Synchronized
    Last synchronization:        2025-02-18 09:34:46

ESR-1# show high-availability state 
DHCP server:
VRF:                               LAN_TWO
    Mode:                          Active-Standby
    State:                         Successful synchronization
    Last synchronization:          2025-02-18 09:34:30
VRF:                               LAN_ONE
    Mode:                          Active-Standby
    State:                         Successful synchronization
    Last synchronization:          2025-02-18 09:34:28
crypto-sync:
    State:                         Disabled
Firewall sessions and NAT translations:
    State:                         Disabled

ESR-1# show ip dhcp binding vrf LAN_ONE 
IP address         MAC / Client ID                                                 Binding type   Lease expires at       
----------------   -------------------------------------------------------------   ------------   --------------------   
192.0.2.10         50:52:e5:02:0c:00                                               active         2025-02-19 09:34:06    
ESR-1# show ip dhcp binding vrf LAN_TWO 
IP address         MAC / Client ID                                                 Binding type   Lease expires at       
----------------   -------------------------------------------------------------   ------------   --------------------   
128.66.0.10        50:6d:ae:02:0e:00                                               active         2025-02-19 09:34:09    

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone MGMT
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone MGMT
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone MGMT
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair MGMT self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

ESR-1(config)# object-group service SNMP
ESR-1(config-object-group-service)# port-range 161
ESR-1(config-object-group-service)# port-range 162
ESR-1(config-object-group-service)# exit

ESR-1(config)# security zone-pair MGMT self
ESR-1(config-security-zone-pair)# rule 2
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol udp
ESR-1(config-security-zone-pair-rule)# match destination-port object-group SNMP
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

ESR-1(config)# snmp-server 
ESR-1(config)# snmp-server community cluster rw

snmpset -v2c -c cluster 192.0.2.253 .1.3.6.1.2.1.1.5.0 s 'ESR-1'
SNMPv2-MIB::sysName.0 = STRING: ESR-1
snmpset -v2c -c cluster 192.0.2.254 .1.3.6.1.2.1.1.5.0 s 'ESR-2'
SNMPv2-MIB::sysName.0 = STRING: ESR-2
snmpset -v2c -c cluster 192.0.2.1 .1.3.6.1.2.1.1.5.0 s 'VRRP-Master'
SNMPv2-MIB::sysName.0 = STRING: VRRP-Master

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone WAN
  ip address 128.66.0.6/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 128.66.0.2/30
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone WAN
  ip address 128.66.0.5/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 128.66.0.1/30
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN WAN
  rule 1
    action permit
    enable
  exit
exit

ESR-1(config)# object-group network INTERNET_USERS
ESR-1(config-object-group-network)# ip address-range 192.0.2.2-192.0.2.255
ESR-1(config-object-group-network)# exit

ESR-1(config)# nat source
ESR-1(config-snat)# pool TRANSLATE_ADDRESS
ESR-1(config-snat-pool)# ip address-range 203.0.113.2
ESR-1(config-snat-pool)# exit

ESR-1(config-snat)# ruleset SNAT
ESR-1(config-snat-ruleset)# to zone WAN 
ESR-1(config-snat-ruleset)# rule 1
ESR-1(config-snat-rule)# match source-address object-group network INTERNET_USERS
ESR-1(config-snat-rule)# action source-nat pool TRANSLATE_ADDRESS
ESR-1(config-snat-rule)# enable 
ESR-1(config-snat-rule)# exit
ESR-1(config-snat-ruleset)# exit
ESR-1(config-snat)# exit

ESR-1# show ip nat translations 
Prot   Inside source           Inside destination      Outside source          Outside destination     Pkts         Bytes        
----   ---------------------   ---------------------   ---------------------   ---------------------   ----------   ----------   
tcp    192.0.2.10:45838        203.0.113.1:22          203.0.113.2:45838       203.0.113.1:22          --           --           

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone WAN
  ip address 128.66.0.6/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 128.66.0.2/30
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone WAN
  ip address 128.66.0.5/30
  vrrp 3
    ip address 203.0.113.2/30
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 128.66.0.1/30
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

ESR-1(config)# object-group network INTERNAL
ESR-1(config-object-group-network)# ip address-range 203.0.113.2
ESR-1(config-object-group-network)# exit

ESR-1(config)# object-group service SERVER_DMZ
ESR-1(config-object-group-service)# port-range 22
ESR-1(config-object-group-service)# exit

ESR-1(config)# nat destination 
ESR-1(config-dnat)# pool DMZ
ESR-1(config-dnat-pool)# ip address 192.0.2.10
ESR-1(config-dnat-pool)# exit

ESR-1(config-dnat)# ruleset DNAT_SERVER_DMZ
ESR-1(config-dnat-ruleset)# from zone WAN
ESR-1(config-dnat-ruleset)# rule 1
ESR-1(config-dnat-rule)# match protocol tcp
ESR-1(config-dnat-rule)# match destination-address object-group INTERNAL
ESR-1(config-dnat-rule)# match destination-port object-group SERVER_DMZ
ESR-1(config-dnat-rule)# action destination-nat pool DMZ
ESR-1(config-dnat-rule)# enable
ESR-1(config-dnat-rule)# exit
ESR-1(config-dnat-ruleset)# exit
ESR-1(config-dnat)# exit

ESR-1(config)# security zone-pair WAN LAN
ESR-1(config-security-zone-pair)# rule 1
ESR-1(config-security-zone-pair-rule)# action permit
ESR-1(config-security-zone-pair-rule)# match protocol tcp
ESR-1(config-security-zone-pair-rule)# match destination-port object-group SERVER_DMZ  
ESR-1(config-security-zone-pair-rule)# match destination-nat
ESR-1(config-security-zone-pair-rule)# enable
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

ESR-1# show ip nat translations 
Prot   Inside source           Inside destination      Outside source          Outside destination     Pkts         Bytes        
----   ---------------------   ---------------------   ---------------------   ---------------------   ----------   ----------   
tcp    203.0.113.1:41296       192.0.2.10:22           203.0.113.1:41296       203.0.113.2:22          --           --           

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit
interface gigabitethernet 1/0/3
  security-zone WAN
  ip address 128.66.0.2/30
  vrrp 3
    ip address 203.0.113.1/30
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit
interface gigabitethernet 2/0/3
  security-zone WAN
  ip address 128.66.0.1/30
  vrrp 3
    ip address 203.0.113.1/30
    group 1
    enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

ESR-1(config)# object-group service og_bgp
ESR-1(config-object-group-service)# port-range 179
ESR-1(config-object-group-service)# exit
ESR-1(config)# security zone WAN
ESR-1(config-security-zone)# exit
ESR-1(config)# security zone-pair WAN self 
ESR-1(config-security-zone-pair)# rule 2
ESR-1(config-security-zone-pair-rule)# match protocol tcp
ESR-1(config-security-zone-pair-rule)# match destination-port object-group og_bgp 
ESR-1(config-security-zone-pair-rule)# action permit 
ESR-1(config-security-zone-pair-rule)# enable 
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

ESR-1(config)# route-map bgp-out
ESR-1(config-route-map)# rule 1
ESR-1(config-route-map-rule)# match ip address 198.51.100.0/24
ESR-1(config-route-map-rule)# action deny
ESR-1(config-route-map-rule)# exit
ESR-1(config-route-map)# rule 2
ESR-1(config-route-map-rule)# action permit
ESR-1(config-route-map-rule)# exit
ESR-1(config-route-map)# exit

ESR-1(config)# router bgp 64500

ESR-1(config-bgp)# address-family ipv4 unicast 
ESR-1(config-bgp-af)# redistribute connected 
ESR-1(config-bgp-af)# exit

ESR-1(config-bgp)# neighbor 203.0.113.2
ESR-1(config-bgp-neighbor)# remote-as 64501
ESR-1(config-bgp-neighbor)# update-source 203.0.113.1

ESR-1(config-bgp-neighbor)# address-family ipv4 unicast
ESR-1(config-bgp-neighbor-af)# route-map bgp-out out
ESR-1(config-bgp-neighbor-af)# enable
ESR-1(config-bgp-neighbor-af)# exit

ESR-1(config-bgp-neighbor)# enable
ESR-1(config-bgp-neighbor)# exit
ESR-1(config-bgp)# enable
ESR-1(config-bgp)# exit

ESR-1# show bgp neighbors 
BGP neighbor is 203.0.113.1
    BGP state:                          Established
    Type:                               Static neighbor
    Neighbor address:                   203.0.113.1
    Neighbor AS:                        64501
    Neighbor ID:                        203.0.113.1
    Neighbor caps:                      refresh enhanced-refresh restart-aware AS4
    Session:                            external AS4
    Source address:                     203.0.113.2
    Weight:                             0
    Hold timer:                         124/180
    Keepalive timer:                    27/60
    RR client:                          No
    Address family ipv4 unicast:       
      Send-label:                       No
      Default originate:                No
      Default information originate:    No
      Outgoing route-map:               bgp-out
      Preference:                       170
      Remove private AS:                No
      Next-hop self:                    No
      Next-hop unchanged:               No
    Uptime (d,h:m:s):                   00,00:03:13

ESR-2# show bgp neighbors 
BGP neighbor is 203.0.113.2
    BGP state:                          Active
    Type:                               Static neighbor
    Neighbor address:                   203.0.113.1
    Neighbor AS:                        64501
    Connect delay:                      2/5
    Last error:                         Socket: Network is unreachable

ESR-1# show bgp ipv4 unicast neighbor 203.0.113.1 advertise-routes 
Status codes: u - unicast, b - broadcast, m - multicast, a - anycast
              * - valid, > - best
Origin codes: i - IGP, e - EGP, ? - incomplete

     Network              Next Hop             Metric  LocPrf      Weight Path        
*> u 192.0.2.0/24         203.0.113.2          --      --          --     64500 ?
*  u 192.0.2.0/24         203.0.113.2          --      --          --     64500 ?
*> u 128.66.0.0/30        203.0.113.2          --      --          --     64500 ?
*> u 203.0.113.0/30       203.0.113.2          --      --          --     64500 ?
ESR-1# show bgp ipv4 unicast neighbor 203.0.113.1 routes 
Status codes: u - unicast, b - broadcast, m - multicast, a - anycast
              * - valid, > - best
Origin codes: i - IGP, e - EGP, ? - incomplete

     Network              Next Hop             Metric  LocPrf      Weight Path        
*> u 0.0.0.0/0            203.0.113.1          --      100         0      64501 ?

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp 1
    ip address 198.51.100.1/24
    group 1
    authentication key ascii-text encrypted 88B11079B51D
    authentication algorithm md5
    enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit

interface gigabitethernet 1/0/3
  security-zone WAN
  ip address 203.0.113.1/30
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp 2
    ip address 192.0.2.1/24
    group 1
    enable
  exit
exit

interface gigabitethernet 2/0/3
  security-zone WAN
  ip address 203.0.113.5/30
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

ESR-1(config)# object-group service og_bgp
ESR-1(config-object-group-service)# port-range 179
ESR-1(config-object-group-service)# exit
ESR-1(config)# security zone-pair WAN self 
ESR-1(config-security-zone-pair)# rule 2
ESR-1(config-security-zone-pair-rule)# match protocol tcp
ESR-1(config-security-zone-pair-rule)# match destination-port object-group og_bgp 
ESR-1(config-security-zone-pair-rule)# action permit 
ESR-1(config-security-zone-pair-rule)# enable 
ESR-1(config-security-zone-pair-rule)# exit
ESR-1(config-security-zone-pair)# exit

ESR-1(config)# track 1
ESR-1(config-track)# track vrrp id 1 state not master 
ESR-1(config-track)# enable 
ESR-1(config-track)# exit

ESR-1(config)# route-map bgp-out
ESR-1(config-route-map)# rule 1
ESR-1(config-route-map-rule)# match ip address 198.51.100.0/24
ESR-1(config-route-map-rule)# action deny 
ESR-1(config-route-map-rule)# exit
ESR-1(config-route-map)# rule 2
ESR-1(config-route-map-rule)# action set as-path prepend 64500 track 1
ESR-1(config-route-map-rule)# action permit 
ESR-1(config-route-map-rule)# exit
ESR-1(config-route-map)# exit

ESR-1(config)# router bgp 64500 unit 1

ESR-1(config-bgp)# address-family ipv4 unicast 
ESR-1(config-bgp-af)# redistribute connected 
ESR-1(config-bgp-af)# exit

ESR-1(config-bgp)# neighbor 203.0.113.2
ESR-1(config-bgp-neighbor)# remote-as 64501
ESR-1(config-bgp-neighbor)# update-source 203.0.113.1

ESR-1(config-bgp-neighbor)# address-family ipv4 unicast
ESR-1(config-bgp-neighbor-af)# route-map bgp-out out
ESR-1(config-bgp-neighbor-af)# enable
ESR-1(config-bgp-neighbor-af)# exit

ESR-1(config-bgp-neighbor)# enable
ESR-1(config-bgp-neighbor)# exit
ESR-1(config-bgp)# enable
ESR-1(config-bgp)# exit

ESR-1(config)# router bgp 64500 unit 2

ESR-1(config-bgp)# address-family ipv4 unicast 
ESR-1(config-bgp-af)# redistribute connected 
ESR-1(config-bgp-af)# exit

ESR-1(config-bgp)# neighbor 203.0.113.6
ESR-1(config-bgp-neighbor)# remote-as 64502
ESR-1(config-bgp-neighbor)# update-source 203.0.113.5

ESR-1(config-bgp-neighbor)# address-family ipv4 unicast
ESR-1(config-bgp-neighbor-af)# route-map bgp-out out
ESR-1(config-bgp-neighbor-af)# enable
ESR-1(config-bgp-neighbor-af)# exit

ESR-1(config-bgp-neighbor)# enable
ESR-1(config-bgp-neighbor)# exit
ESR-1(config-bgp)# enable
ESR-1(config-bgp)# exit

ESR-1# show bgp neighbors 
BGP neighbor is 203.0.113.2
    BGP state:                          Established
    Type:                               Static neighbor
    Neighbor address:                   203.0.113.2
    Neighbor AS:                        64501
    Neighbor ID:                        203.0.113.2
    Neighbor caps:                      refresh enhanced-refresh restart-aware AS4
    Session:                            external AS4
    Source address:                     203.0.113.1
    Weight:                             0
    Hold timer:                         107/180
    Keepalive timer:                    20/60
    RR client:                          No
    Address family ipv4 unicast:       
      Send-label:                       No
      Default originate:                No
      Default information originate:    No
      Outgoing route-map:               bgp-out
      Preference:                       170
      Remove private AS:                No
      Next-hop self:                    No
      Next-hop unchanged:               No
    Uptime (d,h:m:s):                   00,00:00:28

ESR-2# show bgp neighbors 
BGP neighbor is 203.0.113.6
    BGP state:                          Established
    Type:                               Static neighbor
    Neighbor address:                   203.0.113.6
    Neighbor AS:                        64502
    Neighbor ID:                        203.0.113.6
    Neighbor caps:                      refresh enhanced-refresh restart-aware AS4
    Session:                            external AS4
    Source address:                     203.0.113.5
    Weight:                             0
    Hold timer:                         144/180
    Keepalive timer:                    29/60
    RR client:                          No
    Address family ipv4 unicast:       
      Send-label:                       No
      Default originate:                No
      Default information originate:    No
      Outgoing route-map:               bgp-out
      Preference:                       170
      Remove private AS:                No
      Next-hop self:                    No
      Next-hop unchanged:               No
    Uptime (d,h:m:s):                   00,00:00:20

ESR-1# show bgp ipv4 unicast neighbor 203.0.113.2 advertise-routes 
Status codes: u - unicast, b - broadcast, m - multicast, a - anycast
              * - valid, > - best
Origin codes: i - IGP, e - EGP, ? - incomplete

     Network              Next Hop             Metric  LocPrf      Weight Path        
*> u 192.0.2.0/24         203.0.113.1          --      --          --     64500 ?
*  u 192.0.2.0/24         203.0.113.1          --      --          --     64500 ?
*> u 203.0.113.0/30       203.0.113.1          --      --          --     64500 ?
ESR-1# show bgp ipv4 unicast neighbor 203.0.113.2 routes 
Status codes: u - unicast, b - broadcast, m - multicast, a - anycast
              * - valid, > - best
Origin codes: i - IGP, e - EGP, ? - incomplete

     Network              Next Hop             Metric  LocPrf      Weight Path        
*> u 0.0.0.0/0            203.0.113.2          --      100         0      64501 ?

ESR-2# show bgp ipv4 unicast neighbor 203.0.113.6 advertise-routes 
Status codes: u - unicast, b - broadcast, m - multicast, a - anycast
              * - valid, > - best
Origin codes: i - IGP, e - EGP, ? - incomplete

     Network              Next Hop             Metric  LocPrf      Weight Path        
*> u 192.0.2.0/24         203.0.113.5          --      --          --     64500 64500 ?
*> u 203.0.113.4/30       203.0.113.5          --      --          --     64500 64500 ?
ESR-2# show bgp ipv4 unicast neighbor 203.0.113.6 routes 
Status codes: u - unicast, b - broadcast, m - multicast, a - anycast
              * - valid, > - best
Origin codes: i - IGP, e - EGP, ? - incomplete

     Network              Next Hop             Metric  LocPrf      Weight Path        
*> u 0.0.0.0/0            203.0.113.6          --      100         0      64502 ?

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:a0:00
  exit
  unit 2
    mac-address a2:00:00:10:b0:00
  exit
  enable
exit
 
hostname HUB-1 unit 1
hostname HUB-2 unit 2
 
security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit
 
ip access-list extended LOCAL_1
  rule 1
    action permit
    match source-address 198.51.100.2 255.255.255.255
    enable
  exit
exit
ip access-list extended LOCAL_2
  rule 1
    action permit
    match source-address 198.51.100.6 255.255.255.255
    enable
  exit
exit
 
route-map PBR_LOCAL
  rule 1
    match ip access-group LOCAL_1
    action set ip next-hop verify-availability 198.51.100.1 1
  exit
  rule 2
    match ip access-group LOCAL_2
    action set ip next-hop verify-availability 198.51.100.5 1
  exit
exit
route-map DMVPN_BGP_OUT_CLOUD_TWO
  rule 1
    match ip address 0.0.0.0/0
    action set metric bgp 2000
  exit
exit
route-map DMVPN_BGP_OUT_CLOUD_ONE
  rule 1
    match ip address 0.0.0.0/0
    action set metric bgp 1000
  exit
exit
 
ip local policy route-map PBR_LOCAL
 
bridge 1
  vlan 1
  security-zone SYNC
  ip address 192.0.2.5/29 unit 1
  ip address 192.0.2.6/29 unit 2 
  vrrp 1
    ip address 192.0.2.1/29
    group 1
    enable
  exit
  enable
exit
 
interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2.100
  security-zone WAN
  ip address 192.0.2.9/29
  vrrp 2
    ip address 198.51.100.2/30
    group 1
    enable
  exit
  wan load-balance nexthop 198.51.100.1
  wan load-balance enable
exit
interface gigabitethernet 1/0/2.200
  security-zone WAN
  ip address 192.0.2.17/29
  vrrp 3
    ip address 198.51.100.6/30
    group 1
    enable
  exit 
  wan load-balance nexthop 198.51.100.5
  wan load-balance enable
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 128.66.0.2/24
  vrrp 4
    ip address 128.66.0.1/24
    group 1
    enable
  exit 
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2.100
  security-zone WAN
  ip address 192.0.2.10/29
  vrrp 2
    ip address 198.51.100.2/30
    group 1
    enable
  exit
  wan load-balance nexthop 198.51.100.1
  wan load-balance enable
exit
interface gigabitethernet 2/0/2.200
  security-zone WAN
  ip address 192.0.2.18/29
  vrrp 3
    ip address 198.51.100.6/30
    group 1
    enable
  exit 
  wan load-balance nexthop 198.51.100.5
  wan load-balance enable
exit
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 128.66.0.3/24
  vrrp 4
    ip address 128.66.0.1/24
    group 1
    enable
  exit 
exit
 
security zone-pair SYNC self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
  rule 3
    action permit
    match protocol icmp
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit
 
ip route 0.0.0.0/0 wan load-balance rule 1
 
wan load-balance rule 1
  outbound interface gigabitethernet 1/0/2.100
  outbound interface gigabitethernet 1/0/2.200
  outbound interface gigabitethernet 2/0/2.200
  outbound interface gigabitethernet 2/0/2.100
  enable
exit

hostname SPOKE-1

security zone LAN
exit
security zone WAN
exit

interface gigabitethernet 1/0/1
  security-zone WAN
  ip address 198.51.100.10/30
exit
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 128.66.1.1/24
exit

ip route 198.51.100.0/30 198.51.100.9
ip route 198.51.100.12/30 198.51.100.9
ip route 198.51.100.4/30 198.51.100.9

hostname SPOKE-2

security zone LAN
exit
security zone WAN
exit

interface gigabitethernet 1/0/1
  security-zone WAN
  ip address 198.51.100.14/30
exit
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 128.66.2.1/24
exit

ip route 198.51.100.0/30 198.51.100.13
ip route 198.51.100.4/30 198.51.100.13
ip route 198.51.100.8/30 198.51.100.13

HUB-1(config)# security zone DMVPN_C_ONE
HUB-1(config-security-zone)# exit
HUB-1(config)# security zone DMVPN_C_TWO
HUB-1(config-security-zone)# exit
HUB-1(config)# tunnel gre 1
HUB-1(config-gre)# key 1000
HUB-1(config-gre)# ttl 64
HUB-1(config-gre)# mtu 1400
HUB-1(config-gre)# multipoint
HUB-1(config-gre)# security-zone DMVPN_C_ONE
HUB-1(config-gre)# local address 198.51.100.2
HUB-1(config-gre)# ip address 203.0.113.1/25
HUB-1(config-gre)# ip tcp adjust-mss 1360
HUB-1(config-gre)# ip nhrp redirect
HUB-1(config-gre)# ip nhrp multicast dynamic
HUB-1(config-gre)# ip nhrp enable
HUB-1(config-gre)# enable
HUB-1(config-gre)# exit
HUB-1(config)# tunnel gre 2
HUB-1(config-gre)# key 2000
HUB-1(config-gre)# ttl 64
HUB-1(config-gre)# mtu 1400
HUB-1(config-gre)# multipoint
HUB-1(config-gre)# security-zone DMVPN_C_TWO
HUB-1(config-gre)# local address 198.51.100.6
HUB-1(config-gre)# ip address 203.0.113.129/25
HUB-1(config-gre)# ip tcp adjust-mss 1360
HUB-1(config-gre)# ip nhrp redirect
HUB-1(config-gre)# ip nhrp multicast dynamic
HUB-1(config-gre)# ip nhrp enable
HUB-1(config-gre)# enable
HUB-1(config-gre)# exit

HUB-1(config)# route-map DMVPN_BGP_OUT_CLOUD_ONE
HUB-1(config-route-map)# rule 1
HUB-1(config-route-map-rule)# match ip address 0.0.0.0/0
HUB-1(config-route-map-rule)# action set metric bgp 1000
HUB-1(config-route-map-rule)# exit
HUB-1(config-route-map)# exit
HUB-1(config)# route-map DMVPN_BGP_OUT_CLOUD_TWO
HUB-1(config-route-map)# rule 1
HUB-1(config-route-map-rule)# match ip address 0.0.0.0/0
HUB-1(config-route-map-rule)# action set metric bgp 2000
HUB-1(config-route-map-rule)# exit
HUB-1(config-route-map)# exit
HUB-1(config)# router bgp 64500
HUB-1(config-bgp)# default-information-originate
HUB-1(config-bgp)# timers error-wait 5 10
HUB-1(config-bgp)# peer-group DMVPN_CLOUD_ONE
HUB-1(config-bgp-group)# remote-as 64501
HUB-1(config-bgp-group)# update-source 203.0.113.1
HUB-1(config-bgp-group)# fall-over bfd
HUB-1(config-bgp-group)# address-family ipv4 unicast
HUB-1(config-bgp-group-af)# route-map DMVPN_BGP_OUT_CLOUD_ONE out
HUB-1(config-bgp-group-af)# next-hop-self
HUB-1(config-bgp-group-af)# enable
HUB-1(config-bgp-group-af)# exit
HUB-1(config-bgp-group)# exit
HUB-1(config-bgp)# peer-group DMVPN_CLOUD_TWO
HUB-1(config-bgp-group)# remote-as 64501
HUB-1(config-bgp-group)# update-source 203.0.113.129
HUB-1(config-bgp-group)# fall-over bfd
HUB-1(config-bgp-group)# address-family ipv4 unicast
HUB-1(config-bgp-group-af)# route-map DMVPN_BGP_OUT_CLOUD_TWO out
HUB-1(config-bgp-group-af)# next-hop-self
HUB-1(config-bgp-group-af)# enable
HUB-1(config-bgp-group-af)# exit
HUB-1(config-bgp-group)# exit
HUB-1(config-bgp)# listen-range 203.0.113.0/25
HUB-1(config-bgp-listen)# peer-group DMVPN_CLOUD_ONE
HUB-1(config-bgp-listen)# enable
HUB-1(config-bgp-listen)# exit
HUB-1(config-bgp)# listen-range 203.0.113.128/25
HUB-1(config-bgp-listen)# peer-group DMVPN_CLOUD_TWO
HUB-1(config-bgp-listen)# enable
HUB-1(config-bgp-listen)# exit
HUB-1(config-bgp)# address-family ipv4 unicast
HUB-1(config-bgp-af)# redistribute static
HUB-1(config-bgp-af)# exit
HUB-1(config-bgp)# enable
HUB-1(config-bgp)# exit

HUB-1(config)# security ike proposal ike_proposal
HUB-1(config-ike-proposal)# authentication algorithm sha2-256
HUB-1(config-ike-proposal)# encryption algorithm aes256
HUB-1(config-ike-proposal)# dh-group 19
HUB-1(config-ike-proposal)# exit
HUB-1(config)# 
HUB-1(config)# security ike policy ike_policy
HUB-1(config-ike-policy)# pre-shared-key ascii-text encrypted 8CB5107EA7005AFF
HUB-1(config-ike-policy)# proposal ike_proposal
HUB-1(config-ike-policy)# exit
HUB-1(config)# security ike gateway ike_gateway_cloud_one
HUB-1(config-ike-gw)# version v2-only
HUB-1(config-ike-gw)# ike-policy ike_policy
HUB-1(config-ike-gw)# local address 198.51.100.2
HUB-1(config-ike-gw)# local network 198.51.100.2/32 protocol gre 
HUB-1(config-ike-gw)# remote address any
HUB-1(config-ike-gw)# remote network any protocol gre 
HUB-1(config-ike-gw)# mode policy-based
HUB-1(config-ike-gw)# mobike disable
HUB-1(config-ike-gw)# dead-peer-detection action clear
HUB-1(config-ike-gw)# dead-peer-detection interval 10
HUB-1(config-ike-gw)# dead-peer-detection retransmit timeout 5
HUB-1(config-ike-gw)# dead-peer-detection retransmit tries 2
HUB-1(config-ike-gw)# exit
HUB-1(config)# security ike gateway ike_gateway_cloud_two
HUB-1(config-ike-gw)# version v2-only
HUB-1(config-ike-gw)# ike-policy ike_policy
HUB-1(config-ike-gw)# local address 198.51.100.6
HUB-1(config-ike-gw)# local network 198.51.100.6/32 protocol gre 
HUB-1(config-ike-gw)# remote address any
HUB-1(config-ike-gw)# remote network any protocol gre 
HUB-1(config-ike-gw)# mode policy-based
HUB-1(config-ike-gw)# mobike disable
HUB-1(config-ike-gw)# dead-peer-detection action clear
HUB-1(config-ike-gw)# dead-peer-detection interval 10
HUB-1(config-ike-gw)# dead-peer-detection retransmit timeout 5
HUB-1(config-ike-gw)# dead-peer-detection retransmit tries 2
HUB-1(config-ike-gw)# exit
HUB-1(config)# 
HUB-1(config)# security ike session uniqueids replace

HUB-1(config)# security ipsec proposal ipsec_proposal
HUB-1(config-ipsec-proposal)# authentication algorithm sha2-256
HUB-1(config-ipsec-proposal)# encryption algorithm aes256
HUB-1(config-ipsec-proposal)# pfs dh-group 19
HUB-1(config-ipsec-proposal)# exit
HUB-1(config)# security ipsec policy ipsec_policy
HUB-1(config-ipsec-policy)# proposal ipsec_proposal
HUB-1(config-ipsec-policy)# exit
HUB-1(config)# security ipsec vpn ipsec_dynamic_cloud_one
HUB-1(config-ipsec-vpn)# type transport
HUB-1(config-ipsec-vpn)# ike establish-tunnel route
HUB-1(config-ipsec-vpn)# ike gateway ike_gateway_cloud_one
HUB-1(config-ipsec-vpn)# ike ipsec-policy ipsec_policy
HUB-1(config-ipsec-vpn)# enable
HUB-1(config-ipsec-vpn)# exit
HUB-1(config)# security ipsec vpn ipsec_dynamic_cloud_two
HUB-1(config-ipsec-vpn)# type transport
HUB-1(config-ipsec-vpn)# ike establish-tunnel route
HUB-1(config-ipsec-vpn)# ike gateway ike_gateway_cloud_two
HUB-1(config-ipsec-vpn)# ike ipsec-policy ipsec_policy
HUB-1(config-ipsec-vpn)# enable
HUB-1(config-ipsec-vpn)# exit

HUB-1(config)# object-group service ISAKMP_PORT
HUB-1(config-object-group-service)# port-range 500
HUB-1(config-object-group-service)# port-range 4500
HUB-1(config-object-group-service)# exit
HUB-1(config)# security zone-pair WAN self 
HUB-1(config-security-zone-pair)# rule 3
HUB-1(config-security-zone-pair-rule)# action permit 
HUB-1(config-security-zone-pair-rule)# match protocol udp 
HUB-1(config-security-zone-pair-rule)# match destination-port object-group ISAKMP_PORT 
HUB-1(config-security-zone-pair-rule)# enable 
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# rule 4
HUB-1(config-security-zone-pair-rule)# action permit 
HUB-1(config-security-zone-pair-rule)# match protocol esp 
HUB-1(config-security-zone-pair-rule)# enable 
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# rule 5
HUB-1(config-security-zone-pair-rule)# action permit 
HUB-1(config-security-zone-pair-rule)# match protocol gre 
HUB-1(config-security-zone-pair-rule)# enable 
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# exit

HUB-1(config)# object-group service BGP
HUB-1(config-object-group-service)# port-range 179
HUB-1(config-object-group-service)# exit
HUB-1(config)# object-group service BFD
HUB-1(config-object-group-service)# port-range 3784
HUB-1(config-object-group-service)# exit
HUB-1(config)# security zone-pair DMVPN_C_ONE self
HUB-1(config-security-zone-pair)# rule 1
HUB-1(config-security-zone-pair-rule)# action permit
HUB-1(config-security-zone-pair-rule)# match protocol icmp
HUB-1(config-security-zone-pair-rule)# enable
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# rule 2
HUB-1(config-security-zone-pair-rule)# action permit
HUB-1(config-security-zone-pair-rule)# match protocol tcp
HUB-1(config-security-zone-pair-rule)# match destination-port object-group BGP 
HUB-1(config-security-zone-pair-rule)# enable 
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# rule 3
HUB-1(config-security-zone-pair-rule)# action permit 
HUB-1(config-security-zone-pair-rule)# match protocol udp 
HUB-1(config-security-zone-pair-rule)# match destination-port object-group BFD 
HUB-1(config-security-zone-pair-rule)# enable 
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# exit
HUB-1(config)# security zone-pair DMVPN_C_TWO self
HUB-1(config-security-zone-pair)# rule 1
HUB-1(config-security-zone-pair-rule)# action permit
HUB-1(config-security-zone-pair-rule)# match protocol icmp
HUB-1(config-security-zone-pair-rule)# enable
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# rule 2
HUB-1(config-security-zone-pair-rule)# action permit
HUB-1(config-security-zone-pair-rule)# match protocol tcp
HUB-1(config-security-zone-pair-rule)# match destination-port object-group BGP
HUB-1(config-security-zone-pair-rule)# enable 
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# rule 3
HUB-1(config-security-zone-pair-rule)# action permit 
HUB-1(config-security-zone-pair-rule)# match protocol udp
HUB-1(config-security-zone-pair-rule)# match destination-port object-group BFD
HUB-1(config-security-zone-pair-rule)# enable 
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# exit

HUB-1(config)# security zone-pair LAN DMVPN_C_ONE
HUB-1(config-security-zone-pair)# rule 1
HUB-1(config-security-zone-pair-rule)# action permit
HUB-1(config-security-zone-pair-rule)# enable
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# exit
HUB-1(config)# security zone-pair LAN DMVPN_C_TWO
HUB-1(config-security-zone-pair)# rule 1
HUB-1(config-security-zone-pair-rule)# action permit
HUB-1(config-security-zone-pair-rule)# enable
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# exit
HUB-1(config)# security zone-pair DMVPN_C_ONE LAN
HUB-1(config-security-zone-pair)# rule 1
HUB-1(config-security-zone-pair-rule)# action permit
HUB-1(config-security-zone-pair-rule)# enable
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# exit
HUB-1(config)# security zone-pair DMVPN_C_TWO LAN
HUB-1(config-security-zone-pair)# rule 1
HUB-1(config-security-zone-pair-rule)# action permit
HUB-1(config-security-zone-pair-rule)# enable
HUB-1(config-security-zone-pair-rule)# exit
HUB-1(config-security-zone-pair)# exit

SPOKE-1(config)# security zone DMVPN_C_TWO
SPOKE-1(config-security-zone)# exit
SPOKE-1(config)# security zone DMVPN_C_ONE
SPOKE-1(config-security-zone)# exit
SPOKE-1(config)# tunnel gre 1
SPOKE-1(config-gre)# key 1000
SPOKE-1(config-gre)# ttl 64
SPOKE-1(config-gre)# mtu 1400
SPOKE-1(config-gre)# multipoint
SPOKE-1(config-gre)# security-zone DMVPN_C_ONE
SPOKE-1(config-gre)# local address 198.51.100.10
SPOKE-1(config-gre)# ip address 203.0.113.2/25
SPOKE-1(config-gre)# ip tcp adjust-mss 1360
SPOKE-1(config-gre)# ip nhrp holding-time 60
SPOKE-1(config-gre)# ip nhrp shortcut
SPOKE-1(config-gre)# ip nhrp map 203.0.113.1 198.51.100.2
SPOKE-1(config-gre)# ip nhrp nhs 203.0.113.1
SPOKE-1(config-gre)# ip nhrp multicast nhs
SPOKE-1(config-gre)# ip nhrp enable
SPOKE-1(config-gre)# enable
SPOKE-1(config-gre)# exit
SPOKE-1(config)# tunnel gre 2
SPOKE-1(config-gre)# key 2000
SPOKE-1(config-gre)# ttl 64
SPOKE-1(config-gre)# mtu 1400
SPOKE-1(config-gre)# multipoint
SPOKE-1(config-gre)# security-zone DMVPN_C_TWO
SPOKE-1(config-gre)# local address 198.51.100.10
SPOKE-1(config-gre)# ip address 203.0.113.130/25
SPOKE-1(config-gre)# ip tcp adjust-mss 1360
SPOKE-1(config-gre)# ip nhrp holding-time 60
SPOKE-1(config-gre)# ip nhrp shortcut
SPOKE-1(config-gre)# ip nhrp map 203.0.113.129 198.51.100.6
SPOKE-1(config-gre)# ip nhrp nhs 203.0.113.129
SPOKE-1(config-gre)# ip nhrp multicast nhs
SPOKE-1(config-gre)# ip nhrp enable
SPOKE-1(config-gre)# enable
SPOKE-1(config-gre)# exit

SPOKE-1(config)# route-map DMVPN_BGP_OUT
SPOKE-1(config-route-map)# rule 1
SPOKE-1(config-route-map-rule)# exit
SPOKE-1(config-route-map)# exit
SPOKE-1(config)# router bgp 64501
SPOKE-1(config-bgp)# timers error-wait 5 10
SPOKE-1(config-bgp)# neighbor 203.0.113.1
SPOKE-1(config-bgp-neighbor)# remote-as 64500
SPOKE-1(config-bgp-neighbor)# allow-local-as 10
SPOKE-1(config-bgp-neighbor)# update-source 203.0.113.2
SPOKE-1(config-bgp-neighbor)# fall-over bfd
SPOKE-1(config-bgp-neighbor)# address-family ipv4 unicast
SPOKE-1(config-bgp-neighbor-af)# route-map DMVPN_BGP_OUT out
SPOKE-1(config-bgp-neighbor-af)# enable
SPOKE-1(config-bgp-neighbor-af)# exit
SPOKE-1(config-bgp-neighbor)# enable
SPOKE-1(config-bgp-neighbor)# exit
SPOKE-1(config-bgp)# neighbor 203.0.113.129
SPOKE-1(config-bgp-neighbor)# remote-as 64500
SPOKE-1(config-bgp-neighbor)# allow-local-as 10
SPOKE-1(config-bgp-neighbor)# update-source 203.0.113.130
SPOKE-1(config-bgp-neighbor)# fall-over bfd
SPOKE-1(config-bgp-neighbor)# address-family ipv4 unicast
SPOKE-1(config-bgp-neighbor-af)# route-map DMVPN_BGP_OUT out
SPOKE-1(config-bgp-neighbor-af)# enable
SPOKE-1(config-bgp-neighbor-af)# exit
SPOKE-1(config-bgp-neighbor)# enable
SPOKE-1(config-bgp-neighbor)# exit
SPOKE-1(config-bgp)# address-family ipv4 unicast
SPOKE-1(config-bgp-af)# network 128.66.1.0/24
SPOKE-1(config-bgp-af)# exit
SPOKE-1(config-bgp)# enable
SPOKE-1(config-bgp)# exit

SPOKE-1(config)# security ike proposal ike_proposal
SPOKE-1(config-ike-proposal)# authentication algorithm sha2-256
SPOKE-1(config-ike-proposal)# encryption algorithm aes256
SPOKE-1(config-ike-proposal)# dh-group 19
SPOKE-1(config-ike-proposal)# exit
SPOKE-1(config)# security ike policy ike_policy
SPOKE-1(config-ike-policy)# pre-shared-key ascii-text encrypted 8CB5107EA7005AFF
SPOKE-1(config-ike-policy)# proposal ike_proposal
SPOKE-1(config-ike-policy)# exit
SPOKE-1(config)# security ike gateway ike_gateway_cloud_one
SPOKE-1(config-ike-gw)# version v2-only
SPOKE-1(config-ike-gw)# ike-policy ike_policy
SPOKE-1(config-ike-gw)# local address 198.51.100.10
SPOKE-1(config-ike-gw)# local network 198.51.100.10/32 protocol gre 
SPOKE-1(config-ike-gw)# remote address 198.51.100.2
SPOKE-1(config-ike-gw)# remote network 198.51.100.2/32 protocol gre 
SPOKE-1(config-ike-gw)# mode policy-based
SPOKE-1(config-ike-gw)# mobike disable
SPOKE-1(config-ike-gw)# dead-peer-detection action clear
SPOKE-1(config-ike-gw)# dead-peer-detection interval 10
SPOKE-1(config-ike-gw)# dead-peer-detection retransmit timeout 5
SPOKE-1(config-ike-gw)# dead-peer-detection retransmit tries 2
SPOKE-1(config-ike-gw)# exit
SPOKE-1(config)# security ike gateway ike_gateway_cloud_two
SPOKE-1(config-ike-gw)# version v2-only
SPOKE-1(config-ike-gw)# ike-policy ike_policy
SPOKE-1(config-ike-gw)# local address 198.51.100.10
SPOKE-1(config-ike-gw)# local network 198.51.100.10/32 protocol gre 
SPOKE-1(config-ike-gw)# remote address 198.51.100.6
SPOKE-1(config-ike-gw)# remote network 198.51.100.6/32 protocol gre 
SPOKE-1(config-ike-gw)# mode policy-based
SPOKE-1(config-ike-gw)# mobike disable
SPOKE-1(config-ike-gw)# dead-peer-detection action clear
SPOKE-1(config-ike-gw)# dead-peer-detection interval 10
SPOKE-1(config-ike-gw)# dead-peer-detection retransmit timeout 5
SPOKE-1(config-ike-gw)# dead-peer-detection retransmit tries 2
SPOKE-1(config-ike-gw)# exit
SPOKE-1(config)# security ike gateway ike_gateway_to_spokes
SPOKE-1(config-ike-gw)# version v2-only
SPOKE-1(config-ike-gw)# ike-policy ike_policy
SPOKE-1(config-ike-gw)# local address 198.51.100.10
SPOKE-1(config-ike-gw)# local network 198.51.100.10/32 protocol gre 
SPOKE-1(config-ike-gw)# remote id any
SPOKE-1(config-ike-gw)# remote address any
SPOKE-1(config-ike-gw)# remote network any protocol gre 
SPOKE-1(config-ike-gw)# mode policy-based
SPOKE-1(config-ike-gw)# mobike disable
SPOKE-1(config-ike-gw)# dead-peer-detection action clear
SPOKE-1(config-ike-gw)# dead-peer-detection interval 10
SPOKE-1(config-ike-gw)# dead-peer-detection retransmit timeout 5
SPOKE-1(config-ike-gw)# dead-peer-detection retransmit tries 2
SPOKE-1(config-ike-gw)# exit

SPOKE-1(config)# security ipsec proposal ipsec_proposal
SPOKE-1(config-ipsec-proposal)# authentication algorithm sha2-256
SPOKE-1(config-ipsec-proposal)# encryption algorithm aes256
SPOKE-1(config-ipsec-proposal)# pfs dh-group 19
SPOKE-1(config-ipsec-proposal)# exit
SPOKE-1(config)# security ipsec policy ipsec_policy
SPOKE-1(config-ipsec-policy)# proposal ipsec_proposal
SPOKE-1(config-ipsec-policy)# exit
SPOKE-1(config)# security ipsec vpn ipsec_dynamic_to_spoke
SPOKE-1(config-ipsec-vpn)# type transport
SPOKE-1(config-ipsec-vpn)# ike establish-tunnel route
SPOKE-1(config-ipsec-vpn)# ike gateway ike_gateway_to_spokes
SPOKE-1(config-ipsec-vpn)# ike ipsec-policy ipsec_policy
SPOKE-1(config-ipsec-vpn)# enable
SPOKE-1(config-ipsec-vpn)# exit
SPOKE-1(config)# security ipsec vpn ipsec_static_cloud_one
SPOKE-1(config-ipsec-vpn)# type transport
SPOKE-1(config-ipsec-vpn)# ike establish-tunnel route
SPOKE-1(config-ipsec-vpn)# ike gateway ike_gateway_cloud_one
SPOKE-1(config-ipsec-vpn)# ike ipsec-policy ipsec_policy
SPOKE-1(config-ipsec-vpn)# enable
SPOKE-1(config-ipsec-vpn)# exit
SPOKE-1(config)# security ipsec vpn ipsec_static_cloud_two
SPOKE-1(config-ipsec-vpn)# type transport
SPOKE-1(config-ipsec-vpn)# ike establish-tunnel route
SPOKE-1(config-ipsec-vpn)# ike gateway ike_gateway_cloud_two
SPOKE-1(config-ipsec-vpn)# ike ipsec-policy ipsec_policy
SPOKE-1(config-ipsec-vpn)# enable
SPOKE-1(config-ipsec-vpn)# exit

SPOKE-1(config)# object-group service ISAKMP_PORT
SPOKE-1(config-object-group-service)# port-range 500
SPOKE-1(config-object-group-service)# port-range 4500
SPOKE-1(config-object-group-service)# exit
SPOKE-1(config)#  security zone-pair WAN self  
SPOKE-1(config-security-zone-pair)# rule 1
SPOKE-1(config-security-zone-pair-rule)# action permit 
SPOKE-1(config-security-zone-pair-rule)# match protocol udp 
SPOKE-1(config-security-zone-pair-rule)# match destination-port object-group ISAKMP_PORT 
SPOKE-1(config-security-zone-pair-rule)# enable 
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# rule 2
SPOKE-1(config-security-zone-pair-rule)# action permit
SPOKE-1(config-security-zone-pair-rule)# match protocol esp
SPOKE-1(config-security-zone-pair-rule)# enable
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# rule 3
SPOKE-1(config-security-zone-pair-rule)# action permit
SPOKE-1(config-security-zone-pair-rule)# match protocol gre
SPOKE-1(config-security-zone-pair-rule)# enable
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# exit

SPOKE-1(config)# object-group service BGP
SPOKE-1(config-object-group-service)# port-range 179
SPOKE-1(config-object-group-service)# exit
SPOKE-1(config)# object-group service BFD
SPOKE-1(config-object-group-service)# port-range 3784
SPOKE-1(config-object-group-service)# exit
SPOKE-1(config)# security zone-pair DMVPN_C_ONE self
SPOKE-1(config-security-zone-pair)# rule 1
SPOKE-1(config-security-zone-pair-rule)# action permit
SPOKE-1(config-security-zone-pair-rule)# match protocol icmp
SPOKE-1(config-security-zone-pair-rule)# enable
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# rule 2
SPOKE-1(config-security-zone-pair-rule)# action permit
SPOKE-1(config-security-zone-pair-rule)# match protocol tcp
SPOKE-1(config-security-zone-pair-rule)# match destination-port object-group BGP
SPOKE-1(config-security-zone-pair-rule)# enable
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# rule 3
SPOKE-1(config-security-zone-pair-rule)# action permit
SPOKE-1(config-security-zone-pair-rule)# match protocol udp
SPOKE-1(config-security-zone-pair-rule)# match destination-port object-group BFD
SPOKE-1(config-security-zone-pair-rule)# enable
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# exit
SPOKE-1(config)# security zone-pair DMVPN_C_TWO self
SPOKE-1(config-security-zone-pair)# rule 1
SPOKE-1(config-security-zone-pair-rule)# action permit
SPOKE-1(config-security-zone-pair-rule)# match protocol icmp
SPOKE-1(config-security-zone-pair-rule)# enable
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# rule 2
SPOKE-1(config-security-zone-pair-rule)# action permit
SPOKE-1(config-security-zone-pair-rule)# match protocol tcp
SPOKE-1(config-security-zone-pair-rule)# match destination-port object-group BGP
SPOKE-1(config-security-zone-pair-rule)# enable
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# rule 3
SPOKE-1(config-security-zone-pair-rule)# action permit
SPOKE-1(config-security-zone-pair-rule)# match protocol udp
SPOKE-1(config-security-zone-pair-rule)# match destination-port object-group BFD
SPOKE-1(config-security-zone-pair-rule)# enable
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# exit

SPOKE-1(config)# security zone-pair LAN DMVPN_C_ONE
SPOKE-1(config-security-zone-pair)# rule 1
SPOKE-1(config-security-zone-pair-rule)# action permit
SPOKE-1(config-security-zone-pair-rule)# enable
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# exit
SPOKE-1(config)# security zone-pair LAN DMVPN_C_TWO
SPOKE-1(config-security-zone-pair)# rule 1
SPOKE-1(config-security-zone-pair-rule)# action permit
SPOKE-1(config-security-zone-pair-rule)# enable
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# exit
SPOKE-1(config)# security zone-pair DMVPN_C_ONE LAN
SPOKE-1(config-security-zone-pair)# rule 1
SPOKE-1(config-security-zone-pair-rule)# action permit
SPOKE-1(config-security-zone-pair-rule)# match protocol icmp
SPOKE-1(config-security-zone-pair-rule)# enable
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# exit
SPOKE-1(config)# security zone-pair DMVPN_C_TWO LAN
SPOKE-1(config-security-zone-pair)# rule 1
SPOKE-1(config-security-zone-pair-rule)# action permit
SPOKE-1(config-security-zone-pair-rule)# match protocol icmp
SPOKE-1(config-security-zone-pair-rule)# enable
SPOKE-1(config-security-zone-pair-rule)# exit
SPOKE-1(config-security-zone-pair)# exit

SPOKE-2(config)# security zone DMVPN_C_TWO
SPOKE-2(config-security-zone)# exit
SPOKE-2(config)# security zone DMVPN_C_ONE
SPOKE-2(config-security-zone)# exit
SPOKE-2(config)# tunnel gre 1
SPOKE-2(config-gre)# key 1000
SPOKE-2(config-gre)# ttl 64
SPOKE-2(config-gre)# mtu 1400
SPOKE-2(config-gre)# multipoint
SPOKE-2(config-gre)# security-zone DMVPN_C_ONE
SPOKE-2(config-gre)# local address 198.51.100.14
SPOKE-2(config-gre)# ip address 203.0.113.3/25
SPOKE-2(config-gre)# ip tcp adjust-mss 1360
SPOKE-2(config-gre)# ip nhrp holding-time 60
SPOKE-2(config-gre)# ip nhrp shortcut
SPOKE-2(config-gre)# ip nhrp map 203.0.113.1 198.51.100.2
SPOKE-2(config-gre)# ip nhrp nhs 203.0.113.1
SPOKE-2(config-gre)# ip nhrp multicast nhs
SPOKE-2(config-gre)# ip nhrp enable
SPOKE-2(config-gre)# enable
SPOKE-2(config-gre)# exit
SPOKE-2(config)# tunnel gre 2
SPOKE-2(config-gre)# key 2000
SPOKE-2(config-gre)# ttl 64
SPOKE-2(config-gre)# mtu 1400
SPOKE-2(config-gre)# multipoint
SPOKE-2(config-gre)# security-zone DMVPN_C_TWO
SPOKE-2(config-gre)# local address 198.51.100.14
SPOKE-2(config-gre)# ip address 203.0.113.131/25
SPOKE-2(config-gre)# ip tcp adjust-mss 1360
SPOKE-2(config-gre)# ip nhrp holding-time 60
SPOKE-2(config-gre)# ip nhrp shortcut
SPOKE-2(config-gre)# ip nhrp map 203.0.113.129 198.51.100.6
SPOKE-2(config-gre)# ip nhrp nhs 203.0.113.129
SPOKE-2(config-gre)# ip nhrp multicast nhs
SPOKE-2(config-gre)# ip nhrp enable
SPOKE-2(config-gre)# enable
SPOKE-2(config-gre)# exit

SPOKE-2(config)# route-map DMVPN_BGP_OUT
SPOKE-2(config-route-map)# rule 1
SPOKE-2(config-route-map-rule)# exit
SPOKE-2(config-route-map)# exit
SPOKE-2(config)# router bgp 64501
SPOKE-2(config-bgp)# timers error-wait 5 10
SPOKE-2(config-bgp)# neighbor 203.0.113.1
SPOKE-2(config-bgp-neighbor)# remote-as 64500
SPOKE-2(config-bgp-neighbor)# allow-local-as 10
SPOKE-2(config-bgp-neighbor)# update-source 203.0.113.3
SPOKE-2(config-bgp-neighbor)# fall-over bfd
SPOKE-2(config-bgp-neighbor)# address-family ipv4 unicast
SPOKE-2(config-bgp-neighbor-af)# route-map DMVPN_BGP_OUT out
SPOKE-2(config-bgp-neighbor-af)# enable
SPOKE-2(config-bgp-neighbor-af)# exit
SPOKE-2(config-bgp-neighbor)# enable
SPOKE-2(config-bgp-neighbor)# exit
SPOKE-2(config-bgp)# neighbor 203.0.113.129
SPOKE-2(config-bgp-neighbor)# remote-as 64500
SPOKE-2(config-bgp-neighbor)# allow-local-as 10
SPOKE-2(config-bgp-neighbor)# update-source 203.0.113.131
SPOKE-2(config-bgp-neighbor)# fall-over bfd
SPOKE-2(config-bgp-neighbor)# address-family ipv4 unicast
SPOKE-2(config-bgp-neighbor-af)# route-map DMVPN_BGP_OUT out
SPOKE-2(config-bgp-neighbor-af)# enable
SPOKE-2(config-bgp-neighbor-af)# exit
SPOKE-2(config-bgp-neighbor)# enable
SPOKE-2(config-bgp-neighbor)# exit
SPOKE-2(config-bgp)# address-family ipv4 unicast
SPOKE-2(config-bgp-af)# network 128.66.2.0/24
SPOKE-2(config-bgp-af)# exit
SPOKE-2(config-bgp)# enable
SPOKE-2(config-bgp)# exit

SPOKE-2(config)# security ike proposal ike_proposal
SPOKE-2(config-ike-proposal)# authentication algorithm sha2-256
SPOKE-2(config-ike-proposal)# encryption algorithm aes256
SPOKE-2(config-ike-proposal)# dh-group 19
SPOKE-2(config-ike-proposal)# exit
SPOKE-2(config)# security ike policy ike_policy
SPOKE-2(config-ike-policy)# pre-shared-key ascii-text encrypted 8CB5107EA7005AFF
SPOKE-2(config-ike-policy)# proposal ike_proposal
SPOKE-2(config-ike-policy)# exit
SPOKE-2(config)# security ike gateway ike_gateway_cloud_one
SPOKE-2(config-ike-gw)# version v2-only
SPOKE-2(config-ike-gw)# ike-policy ike_policy
SPOKE-2(config-ike-gw)# local address 198.51.100.14
SPOKE-2(config-ike-gw)# local network 198.51.100.14/32 protocol gre 
SPOKE-2(config-ike-gw)# remote address 198.51.100.2
SPOKE-2(config-ike-gw)# remote network 198.51.100.2/32 protocol gre 
SPOKE-2(config-ike-gw)# mode policy-based
SPOKE-2(config-ike-gw)# mobike disable
SPOKE-2(config-ike-gw)# dead-peer-detection action clear
SPOKE-2(config-ike-gw)# dead-peer-detection interval 10
SPOKE-2(config-ike-gw)# dead-peer-detection retransmit timeout 5
SPOKE-2(config-ike-gw)# dead-peer-detection retransmit tries 2
SPOKE-2(config-ike-gw)# exit
SPOKE-2(config)# security ike gateway ike_gateway_cloud_two
SPOKE-2(config-ike-gw)# version v2-only
SPOKE-2(config-ike-gw)# ike-policy ike_policy
SPOKE-2(config-ike-gw)# local address 198.51.100.14
SPOKE-2(config-ike-gw)# local network 198.51.100.14/32 protocol gre 
SPOKE-2(config-ike-gw)# remote address 198.51.100.6
SPOKE-2(config-ike-gw)# remote network 198.51.100.6/32 protocol gre 
SPOKE-2(config-ike-gw)# mode policy-based
SPOKE-2(config-ike-gw)# mobike disable
SPOKE-2(config-ike-gw)# dead-peer-detection action clear
SPOKE-2(config-ike-gw)# dead-peer-detection interval 10
SPOKE-2(config-ike-gw)# dead-peer-detection retransmit timeout 5
SPOKE-2(config-ike-gw)# dead-peer-detection retransmit tries 2
SPOKE-2(config-ike-gw)# exit
SPOKE-2(config)# security ike gateway ike_gateway_to_spokes
SPOKE-2(config-ike-gw)# version v2-only
SPOKE-2(config-ike-gw)# ike-policy ike_policy
SPOKE-2(config-ike-gw)# local address 198.51.100.14
SPOKE-2(config-ike-gw)# local network 198.51.100.14/32 protocol gre 
SPOKE-2(config-ike-gw)# remote id any
SPOKE-2(config-ike-gw)# remote address any
SPOKE-2(config-ike-gw)# remote network any protocol gre 
SPOKE-2(config-ike-gw)# mode policy-based
SPOKE-2(config-ike-gw)# mobike disable
SPOKE-2(config-ike-gw)# dead-peer-detection action clear
SPOKE-2(config-ike-gw)# dead-peer-detection interval 10
SPOKE-2(config-ike-gw)# dead-peer-detection retransmit timeout 5
SPOKE-2(config-ike-gw)# dead-peer-detection retransmit tries 2
SPOKE-2(config-ike-gw)# exit

SPOKE-2(config)# security ipsec proposal ipsec_proposal
SPOKE-2(config-ipsec-proposal)# authentication algorithm sha2-256
SPOKE-2(config-ipsec-proposal)# encryption algorithm aes256
SPOKE-2(config-ipsec-proposal)# pfs dh-group 19
SPOKE-2(config-ipsec-proposal)# exit
SPOKE-2(config)# security ipsec policy ipsec_policy
SPOKE-2(config-ipsec-policy)# proposal ipsec_proposal
SPOKE-2(config-ipsec-policy)# exit
SPOKE-2(config)# security ipsec vpn ipsec_dynamic_to_spoke
SPOKE-2(config-ipsec-vpn)# type transport
SPOKE-2(config-ipsec-vpn)# ike establish-tunnel route
SPOKE-2(config-ipsec-vpn)# ike gateway ike_gateway_to_spokes
SPOKE-2(config-ipsec-vpn)# ike ipsec-policy ipsec_policy
SPOKE-2(config-ipsec-vpn)# enable
SPOKE-2(config-ipsec-vpn)# exit
SPOKE-2(config)# security ipsec vpn ipsec_static_cloud_one
SPOKE-2(config-ipsec-vpn)# type transport
SPOKE-2(config-ipsec-vpn)# ike establish-tunnel route
SPOKE-2(config-ipsec-vpn)# ike gateway ike_gateway_cloud_one
SPOKE-2(config-ipsec-vpn)# ike ipsec-policy ipsec_policy
SPOKE-2(config-ipsec-vpn)# enable
SPOKE-2(config-ipsec-vpn)# exit
SPOKE-2(config)# security ipsec vpn ipsec_static_cloud_two
SPOKE-2(config-ipsec-vpn)# type transport
SPOKE-2(config-ipsec-vpn)# ike establish-tunnel route
SPOKE-2(config-ipsec-vpn)# ike gateway ike_gateway_cloud_two
SPOKE-2(config-ipsec-vpn)# ike ipsec-policy ipsec_policy
SPOKE-2(config-ipsec-vpn)# enable
SPOKE-2(config-ipsec-vpn)# exit

SPOKE-2(config)# object-group service ISAKMP_PORT
SPOKE-2(config-object-group-service)# port-range 500
SPOKE-2(config-object-group-service)# port-range 4500
SPOKE-2(config-object-group-service)# exit
SPOKE-2(config)#  security zone-pair WAN self  
SPOKE-2(config-security-zone-pair)# rule 1
SPOKE-2(config-security-zone-pair-rule)# action permit 
SPOKE-2(config-security-zone-pair-rule)# match protocol udp 
SPOKE-2(config-security-zone-pair-rule)# match destination-port object-group ISAKMP_PORT 
SPOKE-2(config-security-zone-pair-rule)# enable 
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# rule 2
SPOKE-2(config-security-zone-pair-rule)# action permit
SPOKE-2(config-security-zone-pair-rule)# match protocol esp
SPOKE-2(config-security-zone-pair-rule)# enable
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# rule 3
SPOKE-2(config-security-zone-pair-rule)# action permit
SPOKE-2(config-security-zone-pair-rule)# match protocol gre
SPOKE-2(config-security-zone-pair-rule)# enable
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# exit

SPOKE-2(config)# object-group service BGP
SPOKE-2(config-object-group-service)# port-range 179
SPOKE-2(config-object-group-service)# exit
SPOKE-2(config)# object-group service BFD
SPOKE-2(config-object-group-service)# port-range 3784
SPOKE-2(config-object-group-service)# exit
SPOKE-2(config)# security zone-pair DMVPN_C_ONE self
SPOKE-2(config-security-zone-pair)# rule 1
SPOKE-2(config-security-zone-pair-rule)# action permit
SPOKE-2(config-security-zone-pair-rule)# match protocol icmp
SPOKE-2(config-security-zone-pair-rule)# enable
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# rule 2
SPOKE-2(config-security-zone-pair-rule)# action permit
SPOKE-2(config-security-zone-pair-rule)# match protocol tcp
SPOKE-2(config-security-zone-pair-rule)# match destination-port object-group BGP
SPOKE-2(config-security-zone-pair-rule)# enable
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# rule 3
SPOKE-2(config-security-zone-pair-rule)# action permit
SPOKE-2(config-security-zone-pair-rule)# match protocol udp
SPOKE-2(config-security-zone-pair-rule)# match destination-port object-group BFD
SPOKE-2(config-security-zone-pair-rule)# enable
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# exit
SPOKE-2(config)# security zone-pair DMVPN_C_TWO self
SPOKE-2(config-security-zone-pair)# rule 1
SPOKE-2(config-security-zone-pair-rule)# action permit
SPOKE-2(config-security-zone-pair-rule)# match protocol icmp
SPOKE-2(config-security-zone-pair-rule)# enable
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# rule 2
SPOKE-2(config-security-zone-pair-rule)# action permit
SPOKE-2(config-security-zone-pair-rule)# match protocol tcp
SPOKE-2(config-security-zone-pair-rule)# match destination-port object-group BGP
SPOKE-2(config-security-zone-pair-rule)# enable
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# rule 3
SPOKE-2(config-security-zone-pair-rule)# action permit
SPOKE-2(config-security-zone-pair-rule)# match protocol udp
SPOKE-2(config-security-zone-pair-rule)# match destination-port object-group BFD
SPOKE-2(config-security-zone-pair-rule)# enable
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# exit

SPOKE-2(config)# security zone-pair LAN DMVPN_C_ONE
SPOKE-2(config-security-zone-pair)# rule 1
SPOKE-2(config-security-zone-pair-rule)# action permit
SPOKE-2(config-security-zone-pair-rule)# enable
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# exit
SPOKE-2(config)# security zone-pair LAN DMVPN_C_TWO
SPOKE-2(config-security-zone-pair)# rule 1
SPOKE-2(config-security-zone-pair-rule)# action permit
SPOKE-2(config-security-zone-pair-rule)# enable
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# exit
SPOKE-2(config)# security zone-pair DMVPN_C_ONE LAN
SPOKE-2(config-security-zone-pair)# rule 1
SPOKE-2(config-security-zone-pair-rule)# action permit
SPOKE-2(config-security-zone-pair-rule)# match protocol icmp
SPOKE-2(config-security-zone-pair-rule)# enable
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# exit
SPOKE-2(config)# security zone-pair DMVPN_C_TWO LAN
SPOKE-2(config-security-zone-pair)# rule 1
SPOKE-2(config-security-zone-pair-rule)# action permit
SPOKE-2(config-security-zone-pair-rule)# match protocol icmp
SPOKE-2(config-security-zone-pair-rule)# enable
SPOKE-2(config-security-zone-pair-rule)# exit
SPOKE-2(config-security-zone-pair)# exit

HUB-1# show security ipsec vpn status 
Name                              Local host        Remote host       Initiator spi        Responder spi        State         
-------------------------------   ---------------   ---------------   ------------------   ------------------   -----------   
ipsec_dynamic_cloud_one           198.51.100.2      198.51.100.14     0x22d11891e06edf92   0x40469d552e93e47c   Established   
ipsec_dynamic_cloud_two           198.51.100.6      198.51.100.14     0x61f7a205eeef5d06   0x141239e7309d351c   Established   
ipsec_dynamic_cloud_one           198.51.100.2      198.51.100.10     0x3dbf984518584d5e   0x08563e2683776071   Established   
ipsec_dynamic_cloud_two           198.51.100.6      198.51.100.10     0x500adbe8428c7d35   0x9c83c7a2255cb0ed   Established    

SPOKE-1# show security ipsec vpn status 
Name                              Local host        Remote host       Initiator spi        Responder spi        State         
-------------------------------   ---------------   ---------------   ------------------   ------------------   -----------   
ipsec_static_cloud_one            198.51.100.10     198.51.100.2      0x3dbf984518584d5e   0x08563e2683776071   Established   
ipsec_static_cloud_two            198.51.100.10     198.51.100.6      0x500adbe8428c7d35   0x9c83c7a2255cb0ed   Established     

SPOKE-2# show security ipsec vpn status 
Name                              Local host        Remote host       Initiator spi        Responder spi        State         
-------------------------------   ---------------   ---------------   ------------------   ------------------   -----------   
ipsec_static_cloud_one            198.51.100.14     198.51.100.2      0x22d11891e06edf92   0x40469d552e93e47c   Established   
ipsec_static_cloud_two            198.51.100.14     198.51.100.6      0x61f7a205eeef5d06   0x141239e7309d351c   Established   

HUB-1# show ip nhrp peers 
 Flags: E - unique, R - nhs, U - used, L - lower-up
        C - connected, G - group, Q - qos, N - nat
        P - protected, I - Redirect-ignored, X - undefined

Tunnel address         NBMA address       Tunnel      Expire      Created          Type              Flags        
                                                      (h:m:s)     (d,h:m:s)                                       
--------------------   ----------------   ---------   ---------   --------------   ---------------   ----------   
203.0.113.2            198.51.100.10      gre 1       00:00:51    00,00:04:41      dynamic           LCP          
203.0.113.3            198.51.100.14      gre 1       00:00:48    00,00:04:44      dynamic           LCP          
203.0.113.130          198.51.100.10      gre 2       00:00:51    00,00:04:41      dynamic           LCP          
203.0.113.131          198.51.100.14      gre 2       00:00:48    00,00:04:44      dynamic           LCP          

SPOKE-1# show ip nhrp peers 
 Flags: E - unique, R - nhs, U - used, L - lower-up
        C - connected, G - group, Q - qos, N - nat
        P - protected, I - Redirect-ignored, X - undefined

Tunnel address         NBMA address       Tunnel      Expire      Created          Type              Flags        
                                                      (h:m:s)     (d,h:m:s)                                       
--------------------   ----------------   ---------   ---------   --------------   ---------------   ----------   
203.0.113.1            198.51.100.2       gre 1       --          00,00:00:13      static            RULCP        
203.0.113.129          198.51.100.6       gre 2       --          00,00:00:13      static            RULCP        

SPOKE-2# show ip nhrp peers 
 Flags: E - unique, R - nhs, U - used, L - lower-up
        C - connected, G - group, Q - qos, N - nat
        P - protected, I - Redirect-ignored, X - undefined

Tunnel address         NBMA address       Tunnel      Expire      Created          Type              Flags        
                                                      (h:m:s)     (d,h:m:s)                                       
--------------------   ----------------   ---------   ---------   --------------   ---------------   ----------   
203.0.113.1            198.51.100.2       gre 1       --          00,00:00:16      static            RULCP        
203.0.113.129          198.51.100.6       gre 2       --          00,00:00:16      static            RULCP