Answer the question
In order to leave comments, you need to log in
DMVPN and OSPF on cisco 1921, what's wrong?
Greetings, Comrades!
Help to understand why DMVPN a network between two tsiska does not work. I normally ping the internal address of the second tsiska from the first. And the second tsiska does not ping the internal address of the first. Accordingly, it is impossible to view resources on the local network from both sides.
Config of the first cisco:
dbt_vlg#sh run
Building configuration...
Current configuration : 4058 bytes
!
! Last configuration change at 12:24:50 UTC Mon Mar 20 2017 by francyz
!
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service internal
no service dhcp
!
hostname dbt_vlg
!
boot-start-marker
boot-end-marker
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
!
!
!
!
!
aaa session-id common
!
!
no ipv6 cef
ip source-route
ip cef
!
!
!
ip multicast-routing
!
!
ip domain name corp.donbiotech.com
ip name-server 83.221.202.254
ip name-server 8.8.8.8
ip inspect WAAS flush-timeout 10
!
multilink bundle-name authenticated
!
redundancy
!
!
!
!
ip ssh version 1
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key dbtkey address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set dmvpn_ts esp-3des esp-md5-hmac
mode transport
!
crypto ipsec profile dmvpn_profile
set transform-set dmvpn_ts
!
!
!
!
!
!
interface Tunnel1
description DMVPN
ip address 10.0.0.1 255.255.255.224
no ip redirects
ip mtu 1400
ip nhrp authentication nhrpkey
ip nhrp map multicast dynamic
ip nhrp network-id 2014
ip ospf authentication message-digest
ip ospf authentication-key 7 151D181C0215202131
ip ospf network broadcast
ip ospf hello-interval 3
ip ospf priority 100
tunnel source GigabitEthernet0/1
tunnel mode gre multipoint
tunnel key 2014
tunnel protection ipsec profile dmvpn_profile
!
interface GigabitEthernet0/0
description LAN
ip address 192.168.50.249 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
description INTERNET
ip address <Мой внешний первая циска> 255.255.255.248
ip access-group LANNET-in in
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
!
router ospf 10
router-id 1.1.1.1
auto-cost reference-bandwidth 1000
area 0 authentication message-digest
area 192.168.50.0 authentication message-digest
redistribute static subnets
passive-interface default
no passive-interface Tunnel1
network 10.0.0.0 0.0.0.31 area 0
network 192.168.50.0 0.0.0.255 area 192.168.50.0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list internet_to_lan interface GigabitEthernet0/1 overload
ip nat inside source static tcp 192.168.50.249 22 <Мой внешний первая циска> 25330 extendable
ip route 0.0.0.0 0.0.0.0 <Шлюз провайдера>
!
ip access-list extended LANNET-in
permit icmp any any
permit tcp any any established
remark DNS
permit udp any host <Мой внешний первая циска> eq domain
permit tcp any host <Мой внешний первая циска> eq domain
permit udp any any
remark WEB
permit tcp any host <Мой внешний первая циска> eq www
permit tcp any host <Мой внешний первая циска> eq 443
remark FILE
permit tcp any host <Мой внешний первая циска> eq 445
permit tcp any host <Мой внешний первая циска> range 5000 5001
permit tcp any host <Мой внешний первая циска> gt 1024
remark MAIL
permit tcp any host <Мой внешний первая циска> eq pop3
permit tcp any host <Мой внешний первая циска> eq smtp
permit tcp any host <Мой внешний первая циска> eq 143
permit tcp any host <Мой внешний первая циска> eq 465
permit tcp any host <Мой внешний первая циска> eq 993
remark AVP
permit tcp any host <Мой внешний первая циска> eq 13000
permit tcp any host <Мой внешний первая циска> eq 14000
permit udp any host <Мой внешний первая циска> eq 15000
remark HOST
permit ip host <Внешний второй циски> host <Мой внешний первая циска>
remark RDP
permit tcp any host <Мой внешний первая циска> eq 51788
ip access-list extended internet_to_lan
permit ip 192.168.0.0 0.0.0.255 any
permit ip 192.168.50.0 0.0.0.255 any
!
dialer-list 1 protocol ip permit
!
!
!
!
!
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0
transport input all
line vty 1
exec-timeout 30 0
privilege level 15
transport input ssh
line vty 2 4
transport input all
!
scheduler allocate 20000 1000
end
dbt_vlg#
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname dbt_m
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
!
aaa new-model
!
aaa session-id common
!
no ipv6 cef
ip source-route
ip cef
!
ip dhcp excluded-address 192.168.10.1 192.168.10.10
!
ip dhcp pool LAN
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
domain-name dbt_m.local
dns-server 77.88.8.88 77.88.8.2 77.88.8.8 77.88.8.1 8.8.8.8
!
ip domain name dbt_m.local
ip name-server 77.88.8.88
ip name-server 77.88.8.2
ip name-server 77.88.8.8
ip name-server 77.88.8.1
ip name-server 8.8.8.8
!
multilink bundle-name authenticated
!
redundancy
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key dbtkey address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set dmvpn_ts esp-3des esp-md5-hmac
mode transport
!
crypto ipsec profile dmvpn_profile
set transform-set dmvpn_ts
!
interface Tunnel1
ip address 10.0.0.2 255.255.255.224
no ip redirects
ip mtu 1400
ip nhrp authentication nhrpkey
ip nhrp map multicast <Внешний первой циски>
ip nhrp network-id 2014
ip nhrp nhs 10.0.0.1
ip nhrp registration no-unique
ip ospf authentication message-digest
ip ospf authentication-key ospf_key
ip ospf network broadcast
ip ospf hello-interval 3
ip ospf priority 0
tunnel source GigabitEthernet0/1
tunnel mode gre multipoint
tunnel key 2014
tunnel protection ipsec profile dmvpn_profile
!
interface GigabitEthernet0/0
description LAN
ip address 192.168.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet0/1
description WAN
ip address <Внешний второй циски> 255.255.255.248
ip access-group WAN-in in
ip access-group 24 out
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
router ospf 10
router-id 2.2.2.2
auto-cost reference-bandwidth 1000
area 0 authentication message-digest
passive-interface default
no passive-interface Tunnel1
network 10.0.0.0 0.0.0.31 area 0
network 192.168.10.0 0.0.0.255 area 192.168.10.0
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list 23 interface GigabitEthernet0/1 overload
ip nat inside source list NAT-ACC interface GigabitEthernet0/1 overload
ip nat inside source static tcp 192.168.10.19 20 <Внешний второй циски> 20 extendable
ip nat inside source static tcp 192.168.10.19 21 <Внешний второй циски> 21 extendable
ip route 0.0.0.0 0.0.0.0 <Внешний шлюз провайдера>
!
ip access-list standard NAT-ACC
permit 192.168.0.0 0.0.0.255
!
ip access-list extended WAN-in
permit tcp any host <Внешний второй циски> eq 443
permit udp any eq domain host <Внешний второй циски>
permit tcp any eq www host <Внешний второй циски>
permit tcp any eq 443 host <Внешний второй циски>
permit tcp any eq smtp host <Внешний второй циски>
permit tcp any eq 465 host <Внешний второй циски>
permit tcp any eq 587 host <Внешний второй циски>
permit tcp any eq pop3 host <Внешний второй циски>
permit tcp any eq 995 host <Внешний второй циски>
permit tcp any eq 143 host <Внешний второй циски>
permit tcp any eq 993 host <Внешний второй циски>
permit ip host <Внешний первой циски> host <Внешний второй циски> log
ip access-list extended nat
permit ip 192.168.10.0 0.0.0.255 any
!
no logging trap
access-list 23 permit 192.168.10.0 0.0.0.255
access-list 24 permit any
!
control-plane
!
line con 0
line aux 0
line vty 0 4
access-class 23 in
privilege level 15
transport input telnet ssh
line vty 5 15
access-class 23 in
privilege level 15
transport input telnet ssh
!
scheduler allocate 20000 1000
end
Interface PID Area IP Address/Mask Cost State Nbrs F/C
Tu1 10 0 10.0.0.1/27 10000 DR 0/0
NV0 10 192.168.50.0 Unnumbered Gi0/0 17857 P2P 0/0
Gi0/0 10 192.168.50.0 192.168.50.249/24 1 DR 0/0
Interface PID Area IP Address/Mask Cost State Nbrs F/C
Tu1 10 0 10.0.0.2/27 10000 DROTH 0/0
NV0 10 192.168.10.0 Unnumbered Gi0/0 17857 P2P 0/0
Gi0/0 10 192.168.10.0 192.168.10.1/24 10 DR 0/0
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question