S
S
Sergey Ryzhkin2017-03-20 20:40:16
Cisco
Sergey Ryzhkin, 2017-03-20 20:40:16

DMVPN and OSPF on cisco 1921, what's wrong?

Greetings, Comrades!
Help to understand why DMVPN a network between two tsiska does not work. I normally ping the internal address of the second tsiska from the first. And the second tsiska does not ping the internal address of the first. Accordingly, it is impossible to view resources on the local network from both sides.
Config of the first cisco:

dbt_vlg#sh run
Building configuration...
Current configuration : 4058 bytes
!
! Last configuration change at 12:24:50 UTC Mon Mar 20 2017 by francyz
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service internal
no service dhcp
!
hostname dbt_vlg
!
boot-start-marker
boot-end-marker
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
!
!
!
!
!
aaa session-id common
!
!
no ipv6 cef
ip source-route
ip cef
!
!
!
ip multicast-routing
!
!
ip domain name corp.donbiotech.com
ip name-server 83.221.202.254
ip name-server 8.8.8.8
ip inspect WAAS flush-timeout 10
!
multilink bundle-name authenticated
!
redundancy
!
!
!
!
ip ssh version 1
!
!
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key dbtkey address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set dmvpn_ts esp-3des esp-md5-hmac
 mode transport
!
crypto ipsec profile dmvpn_profile
 set transform-set dmvpn_ts
!
!
!
!
!
!
interface Tunnel1
 description DMVPN
 ip address 10.0.0.1 255.255.255.224
 no ip redirects
 ip mtu 1400
 ip nhrp authentication nhrpkey
 ip nhrp map multicast dynamic
 ip nhrp network-id 2014
 ip ospf authentication message-digest
 ip ospf authentication-key 7 151D181C0215202131
 ip ospf network broadcast
 ip ospf hello-interval 3
 ip ospf priority 100
 tunnel source GigabitEthernet0/1
 tunnel mode gre multipoint
 tunnel key 2014
 tunnel protection ipsec profile dmvpn_profile
!
interface GigabitEthernet0/0
 description LAN
 ip address 192.168.50.249 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 description INTERNET
 ip address <Мой внешний первая циска> 255.255.255.248
 ip access-group LANNET-in in
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable
!
router ospf 10
 router-id 1.1.1.1
 auto-cost reference-bandwidth 1000
 area 0 authentication message-digest
 area 192.168.50.0 authentication message-digest
 redistribute static subnets
 passive-interface default
 no passive-interface Tunnel1
 network 10.0.0.0 0.0.0.31 area 0
 network 192.168.50.0 0.0.0.255 area 192.168.50.0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list internet_to_lan interface GigabitEthernet0/1 overload
ip nat inside source static tcp 192.168.50.249 22 <Мой внешний первая циска> 25330 extendable
ip route 0.0.0.0 0.0.0.0 <Шлюз провайдера>
!
ip access-list extended LANNET-in
 permit icmp any any
 permit tcp any any established
 remark DNS
 permit udp any host <Мой внешний первая циска> eq domain
 permit tcp any host <Мой внешний первая циска> eq domain
 permit udp any any
 remark WEB
 permit tcp any host <Мой внешний первая циска> eq www
 permit tcp any host <Мой внешний первая циска> eq 443
 remark FILE
 permit tcp any host <Мой внешний первая циска> eq 445
 permit tcp any host <Мой внешний первая циска> range 5000 5001
 permit tcp any host <Мой внешний первая циска> gt 1024
 remark MAIL
 permit tcp any host <Мой внешний первая циска> eq pop3
 permit tcp any host <Мой внешний первая циска> eq smtp
 permit tcp any host <Мой внешний первая циска> eq 143
 permit tcp any host <Мой внешний первая циска> eq 465
 permit tcp any host <Мой внешний первая циска> eq 993
 remark AVP
 permit tcp any host <Мой внешний первая циска> eq 13000
 permit tcp any host <Мой внешний первая циска> eq 14000
 permit udp any host <Мой внешний первая циска> eq 15000
 remark HOST
 permit ip host <Внешний второй циски> host <Мой внешний первая циска>
 remark RDP
 permit tcp any host <Мой внешний первая циска> eq 51788
ip access-list extended internet_to_lan
 permit ip 192.168.0.0 0.0.0.255 any
 permit ip 192.168.50.0 0.0.0.255 any
!
dialer-list 1 protocol ip permit
!
!
!
!
!
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0
 transport input all
line vty 1
 exec-timeout 30 0
 privilege level 15
 transport input ssh
line vty 2 4
 transport input all
!
scheduler allocate 20000 1000
end
dbt_vlg#

Next, the config of the second tsiska:
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname dbt_m
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
!
aaa new-model
!
aaa session-id common
!
no ipv6 cef
ip source-route
ip cef
!
ip dhcp excluded-address 192.168.10.1 192.168.10.10
!
ip dhcp pool LAN
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 domain-name dbt_m.local
 dns-server 77.88.8.88 77.88.8.2 77.88.8.8 77.88.8.1 8.8.8.8
!
ip domain name dbt_m.local
ip name-server 77.88.8.88
ip name-server 77.88.8.2
ip name-server 77.88.8.8
ip name-server 77.88.8.1
ip name-server 8.8.8.8
!
multilink bundle-name authenticated
!
redundancy
!
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key dbtkey address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set dmvpn_ts esp-3des esp-md5-hmac
 mode transport
!
crypto ipsec profile dmvpn_profile
 set transform-set dmvpn_ts
!
interface Tunnel1
 ip address 10.0.0.2 255.255.255.224
 no ip redirects
 ip mtu 1400
 ip nhrp authentication nhrpkey
 ip nhrp map multicast <Внешний первой циски>
 ip nhrp network-id 2014
 ip nhrp nhs 10.0.0.1
 ip nhrp registration no-unique
 ip ospf authentication message-digest
 ip ospf authentication-key ospf_key
 ip ospf network broadcast
 ip ospf hello-interval 3
 ip ospf priority 0
 tunnel source GigabitEthernet0/1
 tunnel mode gre multipoint
 tunnel key 2014
 tunnel protection ipsec profile dmvpn_profile
!
interface GigabitEthernet0/0
 description LAN
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 description WAN
 ip address <Внешний второй циски> 255.255.255.248
 ip access-group WAN-in in
 ip access-group 24 out
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
router ospf 10
 router-id 2.2.2.2
 auto-cost reference-bandwidth 1000
 area 0 authentication message-digest
 passive-interface default
 no passive-interface Tunnel1
 network 10.0.0.0 0.0.0.31 area 0
 network 192.168.10.0 0.0.0.255 area 192.168.10.0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list 23 interface GigabitEthernet0/1 overload
ip nat inside source list NAT-ACC interface GigabitEthernet0/1 overload
ip nat inside source static tcp 192.168.10.19 20 <Внешний второй циски> 20 extendable
ip nat inside source static tcp 192.168.10.19 21 <Внешний второй циски> 21 extendable
ip route 0.0.0.0 0.0.0.0 <Внешний шлюз провайдера>
!
ip access-list standard NAT-ACC
 permit 192.168.0.0 0.0.0.255
!
ip access-list extended WAN-in
 permit tcp any host <Внешний второй циски> eq 443
 permit udp any eq domain host <Внешний второй циски>
 permit tcp any eq www host <Внешний второй циски>
 permit tcp any eq 443 host <Внешний второй циски>
 permit tcp any eq smtp host <Внешний второй циски>
 permit tcp any eq 465 host <Внешний второй циски>
 permit tcp any eq 587 host <Внешний второй циски>
 permit tcp any eq pop3 host <Внешний второй циски>
 permit tcp any eq 995 host <Внешний второй циски>
 permit tcp any eq 143 host <Внешний второй циски>
 permit tcp any eq 993 host <Внешний второй циски>
 permit ip host <Внешний первой циски> host <Внешний второй циски> log
ip access-list extended nat
 permit ip 192.168.10.0 0.0.0.255 any
!
no logging trap
access-list 23 permit 192.168.10.0 0.0.0.255
access-list 24 permit any
!
control-plane
!
line con 0
line aux 0
line vty 0 4
 access-class 23 in
 privilege level 15
 transport input telnet ssh
line vty 5 15
 access-class 23 in
 privilege level 15
 transport input telnet ssh
!
scheduler allocate 20000 1000
end

From the address of the first cisco 192.168.50.249 I distinctly ping the address of the second cisco 192.168.10.1, But on the contrary, nothing works and therefore I do not see other devices on the 10.0/24 network, and they do not see mine in 50.0/24
Tell me where the error is in configuration. And there and so all the interface is raised normally.
Here is "sh ip ospf int brief" from both ciscos.
First:
Interface PID Area IP Address/Mask Cost State Nbrs F/C
Tu1 10 0 10.0.0.1/27 10000 DR 0/0
NV0 10 192.168.50.0 Unnumbered Gi0/0 17857 P2P 0/0
Gi0/0 10 192.168.50.0 192.168.50.249/24 1 DR 0/0

Second:
Interface PID Area IP Address/Mask Cost State Nbrs F/C
Tu1 10 0 10.0.0.2/27 10000 DROTH 0/0
NV0 10 192.168.10.0 Unnumbered Gi0/0 17857 P2P 0/0
Gi0/0 10 192.168.10.0 192.168.10.1/24 10 DR 0/0

show ip ospf neighbor - empty on both tsiska

Answer the question

In order to leave comments, you need to log in

1 answer(s)
R
Rinat Garipov, 2017-03-21
@Franciz

Sergey Ryzhkin show sh ip nhrp from both devices.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question