dmvpn实例+dhcp+rtr+route-map实用配置.docx

dmvpn实例+dhcp+rtr+route-map实用配置 上海和北京2个spoke点（cisco831)我在机房用一台设备做hub.公网ip后来编辑的有点乱大家对照top图看吧dmvpn配置大家都熟悉的，路由策略大家看top图就清楚了，不过路由怎么走，包括做的NAT,花了我很长时间叶请教了资深的CCIE，经过测试ok现在拿出来和大家分享ios ver:c831-k9o3sy6-mz.124-4.T4.bin机房hub config (相关配置）crypto isakmp policy 1authentication pre-sharecrypto isakmp key asiavest address no crypto isakmp ccmcrypto ipsec transform-set set2 esp-des esp-md5-hmac mode transport!crypto ipsec profile vpn-profset transform-set set2 !interface Tunnel1bandwidth 512ip address no ip redirectsip nat insideip nhrp authentication asiavestip nhrp map multicast dynamicip nhrp network-id 66ip nhrp holdtime 300ip virtual-reassemblyip policy route-map bj-xxxdelay 100000tunnel source FastEthernet0/1tunnel mode gre multipointtunnel key 6tunnel protection ipsec profile vpn-prof!interface FastEthernet0/0ip address 210.243.aa.xx 24ip nat outsideip virtual-reassemblyduplex autospeed 10!interface FastEthernet0/1ip address 210.17.bb.yy 24duplex autospeed auto!no ip classlessip route 210.17.bb.cccip route ip route ip route 218.242.dd.ff 55 210.17.bb.cccip route 222.66.94.zz 52 210.17.bb.ccc!ip http serverno ip http secure-serverip nat inside source list natuse interface FastEthernet0/0 overload!ip access-list extended natusepermit ip 55 anypermit ip 55 any!access-list 115 deny ip 55 55access-list 115 deny ip 55 55access-list 115 permit ip 55 anyaccess-list 115 permit ip 55 any!route-map bj-xxx permit 10match ip address 115set ip next-hop 210.243.hh.gg!北京831配置北京采用adsl connect internet!no ip dhcp use vrf connectedip dhcp excluded-address 2 54!ip dhcp pool zimport allnetwork dns-server 00 default-router 54 netbios-node-type h-node!ip cefip sla 1icmp-echo source-ip timeout 2000frequency 30ip sla schedule 1 start-time nowvpdn enable!track 1 rtr 1 reachability! !crypto isakmp policy 1authentication pre-sharecrypto isakmp key asiavest address !crypto ipsec transform-set set2 esp-des esp-md5-hmac mode transport!crypto ipsec profile vpn-profset transform-set set2 !interface Tunnel1bandwidth 512ip address no ip redirectsip nhrp authentication asiavestip nhrp map 210.17.bb.yyip nhrp map multicast 210.17.bb.yyip nhrp network-id 66ip nhrp holdtime 300ip nhrp nhs load-interval 30delay 100000tunnel source Ethernet1tunnel mode gre multipointtunnel key 6tunnel protection ipsec profile vpn-prof!interface Ethernet0ip address 54 ip nat insideip virtual-reassemblyip tcp adjust-mss 1344ip policy route-map xxx!interface Ethernet1description WAN conn ADSL Modemip address dhcpduplex auto!interface Ethernet2no ip addressshutdown!interface FastEthernet1duplex autospeed auto!interface FastEthernet2duplex autospeed auto!interface FastEthernet3duplex autospeed auto!interface FastEthernet4duplex autospeed auto!interface Dialer1no ip address!ip classless!ip http serverno ip http secure-server!ip nat inside source list 199 interface Dialer1 overload!access-list 100 permit ip 55 anyaccess-list 199 permit ip 55 any!route-map xxx permit 10match ip address 100set ip next-hop 上海-831 有固定ipno ip dhcp use vrf connectedip dhcp excluded-address 0!ip dhcp pool zimport allnetwork dns-server 00 default-router netbios-node-type h-node!ip cefip sla 1icmp-echo source-ip timeout 2000frequency 30ip sla schedule 1 start-time nowvpdn enable!track 1 rtr 1 reachability! !crypto isakmp policy 1authentication pre-sharecrypto isakmp key asiavest address !crypto ipsec transform-set set2 esp-des esp-md5-hmac mode transport!crypto ipsec profile vpn-profset transform-set set2 !interface Tunnel1bandwidth 512ip address no ip redirectsip nhrp authentication asiavestip nhrp map 210.17.bb.yyyip nhrp map multicast 210.17.bb.yyyip nhrp network-id 66ip nhrp holdtime 300ip nhrp nhs load-interval 30delay 100000tunnel source Ethernet1tunnel mode gre multipointtunnel key 6tunnel protection ipsec profile vpn-prof!interface Ethernet0ip address ip nat insideip virtual-reassemblyip tcp adjust-mss 1344ip policy route-map yyy!interface Ethernet1description WAN conn ip address 222.66.aa.bb 52duplex auto!interface Ethernet2no ip addressshutdown!interface FastEthernet1duplex autospeed auto!interface FastEthernet2duplex autospeed auto!interface FastEthernet3duplex autospeed auto!interface FastEthernet4duplex autospeed auto!interface Dialer1no ip address!ip classless!ip http serverno ip http secure-server!ip nat inside source list 199 interface Ethernet1 overload!ip route 222.66.