¶ hostname Hub-1
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 0.0.0.0
!
crypto ipsec transform-set cisco esp-des esp-md5-hmac
mode tunnel
!
crypto ipsec profile ipsecprof
set transform-set cisco
!
interface Tunnel0
ip address 172.16.1.100 255.255.255.0
ip mtu 1492
no ip next-hop-self eigrp 100
no ip split-horizon eigrp 100
ip nhrp authentication cisco
ip nhrp map multicast dynamic
ip nhrp map 172.16.1.200 61.128.1.200
ip nhrp map multicast 61.128.1.200
ip nhrp network-id 10
tunnel source FastEthernet1/0
tunnel mode gre multipoint
tunnel key 12345
tunnel protection ipsec profile ipsecprof
!
interface FastEthernet1/0
ip address 61.128.1.100 255.255.255.0
!
interface FastEthernet2/0
ip address 192.168.100.1 255.255.255.0
!
router eigrp 100
network 172.16.1.0 0.0.0.255
network 192.168.100.0
!
ip route 0.0.0.0 0.0.0.0 61.128.1.10
¶ hostname Hub-2
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 0.0.0.0
!
crypto ipsec transform-set cisco esp-des esp-md5-hmac
mode tunnel
!
crypto ipsec profile ipsecprof
set transform-set cisco
!
interface Tunnel0
ip address 172.16.1.200 255.255.255.0
ip mtu 1492
no ip next-hop-self eigrp 100
no ip split-horizon eigrp 100
ip nhrp authentication cisco
ip nhrp map multicast dynamic
ip nhrp map 172.16.1.100 61.128.1.100
ip nhrp map multicast 61.128.1.100
ip nhrp network-id 10
tunnel source FastEthernet1/0
tunnel mode gre multipoint
tunnel key 12345
tunnel protection ipsec profile ipsecprof
!
interface FastEthernet1/0
ip address 61.128.1.200 255.255.255.0
!
interface FastEthernet2/0
ip address 192.168.100.2 255.255.255.0
!
router eigrp 100
network 172.16.1.0 0.0.0.255
network 192.168.100.0
!
ip route 0.0.0.0 0.0.0.0 61.128.1.10
¶ hostname Spoke-1
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 0.0.0.0
!
!
crypto ipsec transform-set cisco esp-des esp-md5-hmac
mode tunnel
!
!
crypto ipsec profile ipsecprof
set transform-set cisco
!
interface Loopback0
ip address 192.168.1.1 255.255.255.0
!
interface Tunnel0
ip address 172.16.1.1 255.255.255.0
ip mtu 1492
ip nhrp authentication cisco
ip nhrp map 172.16.1.100 61.128.1.100
ip nhrp map multicast 61.128.1.100
ip nhrp map 172.16.1.200 61.128.1.200
ip nhrp map multicast 61.128.1.200
ip nhrp network-id 10
ip nhrp nhs 172.16.1.100
ip nhrp nhs 172.16.1.200
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 12345
tunnel protection ipsec profile ipsecprof
!
interface FastEthernet0/0
ip address 202.100.1.1 255.255.255.0
!
router eigrp 100
network 172.16.1.0 0.0.0.255
network 192.168.1.0
!
ip route 0.0.0.0 0.0.0.0 202.100.1.10
¶ hostname Spoke-2
crypto isakmp policy 10
authentication pre-share
crypto isakmp key cisco address 0.0.0.0
!
crypto ipsec transform-set cisco esp-des esp-md5-hmac
mode tunnel
!
crypto ipsec profile ipsecprof
set transform-set cisco
!
interface Loopback0
ip address 192.168.2.1 255.255.255.0
!
interface Tunnel0
ip address 172.16.1.2 255.255.255.0
ip mtu 1492
ip nhrp authentication cisco
ip nhrp map 172.16.1.100 61.128.1.100
ip nhrp map multicast 61.128.1.100
ip nhrp map 172.16.1.200 61.128.1.200
ip nhrp map multicast 61.128.1.200
ip nhrp network-id 10
ip nhrp nhs 172.16.1.100
ip nhrp nhs 172.16.1.200
tunnel source FastEthernet0/0
tunnel mode gre multipoint
tunnel key 12345
tunnel protection ipsec profile ipsecprof
!
interface FastEthernet0/0
ip address 202.100.1.2 255.255.255.0
!
router eigrp 100
network 172.16.1.0 0.0.0.255
network 192.168.2.0
!
ip forward-protocol nd
!
ip route 0.0.0.0 0.0.0.0 202.100.1.10
¶ ASA
object-group network out-gre-address
network-object host 202.100.1.1
network-object host 202.100.1.2
object-group network in-gre-address
network-object host 61.128.1.3
network-object host 61.128.1.100
network-object host 61.128.1.200
object-group service gre-ipsec
service-object udp destination eq isakmp
service-object esp
service-object icmp
access-list out extended permit object-group gre-ipsec object-group out-gre-address object-group in-gre-address
access-group out in interface outside
！
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 202.100.1.10 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 61.128.1.10 255.255.255.0
¶ 验证
¶ OSPF
router ospf 1
router-id 172.16.1.200
！
interface Tunnel0
ip ospf network broadcast
ip ospf priority 128
ip ospf 1 area 0
ip ospf priority X ：0表示不参与选举；数值越大优先级越高
¶ DMVPN路由配置简介
| Hub-and-spoke | DynamicSpoke-spoke | |
| EIGRP | no ipsplit-horizon eigrp | no ip split-horizon eigrp no Ip next-hop-self eigrp no auto-summary |
| OSPF | Ip ospf network point-multipoint | Ip ospf network broadcast iP ospf priority (2(hub)10(spoke)) |
| RIP | No ipsplit-horizon | 0n ip split-horizon No auto-summary |
| ODR | distribute-list out | |
| BGP | Hub is route reflector next-hopself |
Hub is route reflector |