.. _vpn-dmvpn: DMVPN ----- **D** ynamic **M** ultipoint **V** irtual **P** rivate **N** etworking DMVPN is a dynamic VPN technology originally developed by Cisco. While their implementation was somewhat proprietary, the underlying technologies are actually standards based. The three technologies are: * **NHRP** - NBMA Next Hop Resolution Protocol RFC2332_ * **mGRE** - Multipoint Generic Routing Encapsulation / mGRE RFC1702_ * **IPSec** - IP Security (too many RFCs to list, but start with RFC4301_) NHRP provides the dynamic tunnel endpoint discovery mechanism (endpoint registration, and endpoint discovery/lookup), mGRE provides the tunnel encapsulation itself, and the IPSec protocols handle the key exchange, and crypto mechanism. In short, DMVPN provides the capability for creating a dynamic-mesh VPN network without having to pre-configure (static) all possible tunnel end-point peers. .. note:: DMVPN only automates the tunnel endpoint discovery and setup. A complete solution also incorporates the use of a routing protocol. BGP is particularly well suited for use with DMVPN. Baseline Configuration: **STEPS:** #. Create tunnel config (`interfaces tunnel`) #. Create nhrp (`protocols nhrp`) #. Create ipsec vpn (optional, but recommended for security) (`vpn ipsec`) The tunnel will be set to mGRE if for encapsulation `gre` is set, and no `remote-ip` is set. If the public ip is provided by DHCP the tunnel `local-ip` can be set to "0.0.0.0" .. figure:: ../_static/images/vpn_dmvpn_topology01.png :scale: 40 % :alt: Baseline DMVPN topology Baseline DMVPN topology HUB Configuration ^^^^^^^^^^^^^^^^^ .. code-block:: sh interfaces tunnel { address encapsulation gre local-ip multicast enable description parameters { ip { } } } } protocols { nhrp { tunnel { cisco-authentication holding-time multicast dynamic redirect } } } vpn { ipsec { esp-group { lifetime <30-86400> mode tunnel pfs enable proposal <1-65535> { encryption aes256 hash sha1 } proposal <1-65535> { encryption 3des hash md5 } } ike-group { key-exchange ikev1 lifetime <30-86400> proposal <1-65535> { encryption aes256 hash sha1 } proposal <1-65535> { encryption aes128 hash sha1 } } ipsec-interfaces { interface } profile { authentication { mode pre-shared-secret pre-shared-secret } bind { tunnel } esp-group ike-group } } } HUB Example Configuration: .. code-block:: sh set interfaces ethernet eth0 address '1.1.1.1/30' set interfaces ethernet eth1 address '192.168.1.1/24' set system host-name 'HUB' set interfaces tunnel tun0 address 10.0.0.1/24 set interfaces tunnel tun0 encapsulation gre set interfaces tunnel tun0 local-ip 1.1.1.1 set interfaces tunnel tun0 multicast enable set interfaces tunnel tun0 parameters ip key 1 set protocols nhrp tunnel tun0 cisco-authentication SECRET set protocols nhrp tunnel tun0 holding-time 300 set protocols nhrp tunnel tun0 multicast dynamic set protocols nhrp tunnel tun0 redirect set vpn ipsec ipsec-interfaces interface eth0 set vpn ipsec ike-group IKE-HUB proposal 1 set vpn ipsec ike-group IKE-HUB proposal 1 encryption aes256 set vpn ipsec ike-group IKE-HUB proposal 1 hash sha1 set vpn ipsec ike-group IKE-HUB proposal 2 encryption aes128 set vpn ipsec ike-group IKE-HUB proposal 2 hash sha1 set vpn ipsec ike-group IKE-HUB lifetime 3600 set vpn ipsec esp-group ESP-HUB proposal 1 encryption aes256 set vpn ipsec esp-group ESP-HUB proposal 1 hash sha1 set vpn ipsec esp-group ESP-HUB proposal 2 encryption 3des set vpn ipsec esp-group ESP-HUB proposal 2 hash md5 set vpn ipsec esp-group ESP-HUB lifetime 1800 set vpn ipsec esp-group ESP-HUB pfs dh-group2 set vpn ipsec profile NHRPVPN set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret set vpn ipsec profile NHRPVPN authentication pre-shared-secret SECRET set vpn ipsec profile NHRPVPN bind tunnel tun0 set vpn ipsec profile NHRPVPN esp-group ESP-HUB set vpn ipsec profile NHRPVPN ike-group IKE-HUB set protocols static route 0.0.0.0/0 next-hop 1.1.1.2 set protocols static route 192.168.2.0/24 next-hop 10.0.0.2 set protocols static route 192.168.3.0/24 next-hop 10.0.0.3 SPOKE Configuration ^^^^^^^^^^^^^^^^^^^ SPOKE1 Configuration: .. code-block:: sh interfaces tunnel { address encapsulation gre local-ip multicast enable description parameters { ip { } } } } protocols { nhrp { tunnel { cisco-authentication map { nbma-address register } holding-time multicast nhs redirect shortcut } } } vpn { ipsec { esp-group { lifetime <30-86400> mode tunnel pfs enable proposal <1-65535> { encryption aes256 hash sha1 } proposal <1-65535> { encryption 3des hash md5 } } ike-group { key-exchange ikev1 lifetime <30-86400> proposal <1-65535> { encryption aes256 hash sha1 } proposal <1-65535> { encryption aes128 hash sha1 } } ipsec-interfaces { interface } profile { authentication { mode pre-shared-secret pre-shared-secret } bind { tunnel } esp-group ike-group } } } SPOKE1 Example Configuration .. code-block:: sh set interfaces ethernet eth0 address 'dhcp' set interfaces ethernet eth1 address '192.168.2.1/24' set system host-name 'SPOKE1' set interfaces tunnel tun0 address 10.0.0.2/24 set interfaces tunnel tun0 encapsulation gre set interfaces tunnel tun0 local-ip 0.0.0.0 set interfaces tunnel tun0 multicast enable set interfaces tunnel tun0 parameters ip key 1 set protocols nhrp tunnel tun0 cisco-authentication 'SECRET' set protocols nhrp tunnel tun0 map 10.0.0.1/24 nbma-address 1.1.1.1 set protocols nhrp tunnel tun0 map 10.0.0.1/24 'register' set protocols nhrp tunnel tun0 multicast 'nhs' set protocols nhrp tunnel tun0 'redirect' set protocols nhrp tunnel tun0 'shortcut' set vpn ipsec ipsec-interfaces interface eth0 set vpn ipsec ike-group IKE-SPOKE proposal 1 set vpn ipsec ike-group IKE-SPOKE proposal 1 encryption aes256 set vpn ipsec ike-group IKE-SPOKE proposal 1 hash sha1 set vpn ipsec ike-group IKE-SPOKE proposal 2 encryption aes128 set vpn ipsec ike-group IKE-SPOKE proposal 2 hash sha1 set vpn ipsec ike-group IKE-SPOKE lifetime 3600 set vpn ipsec esp-group ESP-SPOKE proposal 1 encryption aes256 set vpn ipsec esp-group ESP-SPOKE proposal 1 hash sha1 set vpn ipsec esp-group ESP-SPOKE proposal 2 encryption 3des set vpn ipsec esp-group ESP-SPOKE proposal 2 hash md5 set vpn ipsec esp-group ESP-SPOKE lifetime 1800 set vpn ipsec esp-group ESP-SPOKE pfs dh-group2 set vpn ipsec profile NHRPVPN set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret set vpn ipsec profile NHRPVPN authentication pre-shared-secret SECRET set vpn ipsec profile NHRPVPN bind tunnel tun0 set vpn ipsec profile NHRPVPN esp-group ESP-SPOKE set vpn ipsec profile NHRPVPN ike-group IKE-SPOKE set protocols static route 192.168.1.0/24 next-hop 10.0.0.1 set protocols static route 192.168.3.0/24 next-hop 10.0.0.3 SPOKE2 Configuration .. code-block:: sh interfaces tunnel { address encapsulation gre local-ip multicast enable description parameters { ip { } } } } protocols { nhrp { tunnel { cisco-authentication map { nbma-address register } holding-time multicast nhs redirect shortcut } } } vpn { ipsec { esp-group { lifetime <30-86400> mode tunnel pfs enable proposal <1-65535> { encryption aes256 hash sha1 } proposal <1-65535> { encryption 3des hash md5 } } ike-group { key-exchange ikev1 lifetime <30-86400> proposal <1-65535> { encryption aes256 hash sha1 } proposal <1-65535> { encryption aes128 hash sha1 } } ipsec-interfaces { interface } profile { authentication { mode pre-shared-secret pre-shared-secret } bind { tunnel } esp-group ike-group } } } SPOKE2 Example Configuration .. code-block:: sh set interfaces ethernet eth0 address 'dhcp' set interfaces ethernet eth1 address '192.168.3.1/24' set system host-name 'SPOKE2' set interfaces tunnel tun0 address 10.0.0.3/24 set interfaces tunnel tun0 encapsulation gre set interfaces tunnel tun0 local-ip 0.0.0.0 set interfaces tunnel tun0 multicast enable set interfaces tunnel tun0 parameters ip key 1 set protocols nhrp tunnel tun0 cisco-authentication SECRET set protocols nhrp tunnel tun0 map 10.0.0.1/24 nbma-address 1.1.1.1 set protocols nhrp tunnel tun0 map 10.0.0.1/24 register set protocols nhrp tunnel tun0 multicast nhs set protocols nhrp tunnel tun0 redirect set protocols nhrp tunnel tun0 shortcut set vpn ipsec ipsec-interfaces interface eth0 set vpn ipsec ike-group IKE-SPOKE proposal 1 set vpn ipsec ike-group IKE-SPOKE proposal 1 encryption aes256 set vpn ipsec ike-group IKE-SPOKE proposal 1 hash sha1 set vpn ipsec ike-group IKE-SPOKE proposal 2 encryption aes128 set vpn ipsec ike-group IKE-SPOKE proposal 2 hash sha1 set vpn ipsec ike-group IKE-SPOKE lifetime 3600 set vpn ipsec esp-group ESP-SPOKE proposal 1 encryption aes256 set vpn ipsec esp-group ESP-SPOKE proposal 1 hash sha1 set vpn ipsec esp-group ESP-SPOKE proposal 2 encryption 3des set vpn ipsec esp-group ESP-SPOKE proposal 2 hash md5 set vpn ipsec esp-group ESP-SPOKE lifetime 1800 set vpn ipsec esp-group ESP-SPOKE pfs dh-group2 set vpn ipsec profile NHRPVPN set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret set vpn ipsec profile NHRPVPN authentication pre-shared-secret SECRET set vpn ipsec profile NHRPVPN bind tunnel tun0 set vpn ipsec profile NHRPVPN esp-group ESP-SPOKE set vpn ipsec profile NHRPVPN ike-group IKE-SPOKE set protocols static route 192.168.1.0/24 next-hop 10.0.0.1 set protocols static route 192.168.2.0/24 next-hop 10.0.0.2