Configure a DMVPN spoke

To configure a DMVPN spoke:


  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Create an IP tunnel.
    1. Click VPN > IP Tunnels.
    2. In Add IP tunnel, type the name of the tunnel and click .

    3. For Mode, select mGRE.
    4. For Local endpoint, select the interface that will serve as the local endpoint of the tunnel.
    5. For Key, type a four-octet value that matches the key on the remote endpoint.

    6. (Optional) Enable keep-alive reply to enable the device to reply to Cisco GRE keep-alive packets.
    7. (Optional) Enable open routing to enable packets destined for an address which is not explicitly in the routing table to exit the IP tunnel.
  4. Assign an IP address to the IP tunnel:
    1. Click Network > Interfaces.
    2. For Add Interface, type a name for the interface and click .

    3. For Zone, select Internal.
    4. For Device, select the IP tunnel created above.
    5. Click to expand IPv4.
    6. For Address, type the IP address and netmask of the tunnel. The netmask must be set to /32.

  5. Configure NHRP:
    1. Click Network > Routing Services.
    2. Enable routing services.
    3. Click to expand NHRP.
    4. Enable NHRP.
    5. Click to expand Network.
    6. Click to add a network.

    7. For Interface, select the interface created above.
    8. For Tunnel, select the IP tunnel created above.
    9. Click to expand Next hop servers.
    10. Click to add a server.
    11. For NBMA address, type the hostname or IP address of the node that will be the next hop server.

  6. To enable redirection of packets between spokes, configure OSPF routing:
    1. Click Network > Routes > Routing services > OSPF.
    2. Enable OSPF.
    3. For ABR behavior, choose the Area Border Router for the network.
    4. For Reference bandwidth, type the link bandwidth.
    5. Enable the Opaque-LSA standard.
    6. Enable the RFC1583 standard.
  7. Configure the overlay connection:
    1. Click Network > Routing services > BGP.
    2. Enable BGP.
    3. For AS number, type the autonomous system number for this device.
    4. For Best path criteria, select Multipath.
    5. Click to expand Neighbours.
    6. Click to add a neighbour.
    7. For IP address, type the IP address of the hub.
    8. Click to toggle on eBGP multihop.

  8. Repeat to add additional spokes.
  9. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the IX10 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. Create an IP tunnel.
    1. Add an IP tunnel. For example, to add a tunnel named dmvpn_tunnel:
      (config)> add vpn iptunnel dmvpn_tunnel
(config vpn iptunnel dmvpn_tunnel)>
    2. Set the type to multipoint:
      (config vpn iptunnel dmvpn_tunnel)> type multipoint
(config vpn iptunnel dmvpn_tunnel)>
    3. Set the local interface:
      2. Set the interface. For example:
        (config vpn iptunnel dmvpn_tunnel)> local /network/interface/eth1
(config vpn iptunnel dmvpn_tunnel)>
    4.  Set the key to a four-octet value that matches the key on the remote endpoint. For example:
      (config vpn iptunnel dmvpn_tunnel)> key 1.1.1.1
(config vpn iptunnel dmvpn_tunnel)>
    5. (Optional) Enable the device to reply to Cisco GRE keepalive packets:
      (config vpn iptunnel dmvpn_tunnel)> keepalive true
(config vpn iptunnel dmvpn_tunnel)>

    6. (Optional) Enable the device to allow packets destined for an address which is not explicitly in the routing table to exit the IP tunnel:

      (config vpn iptunnel dmvpn_tunnel)> open_routing true
(config vpn iptunnel dmvpn_tunnel)>
  4. Assign an IP address to the IP tunnel:

    1. Type ... to return to the top level of the configuration schema:

      (config vpn iptunnel dmvpn_tunnel)> ...
(config)>

    2. And a network interface. For example, to add an interface named dmvpn_tunnel_interface:

      (config)> add network interface dmvpn_tunnel_interface
(config network interface dmvpn_tunnel_interface)>

    3. Set the zone to internal:
      (config network interface dmvpn_tunnel_interface)> zone internal
(config network interface dmvpn_tunnel_interface)>
    4. Set the device to the IP tunnel created above:
      (config network interface dmvpn_tunnel_interface)> device /vpn/iptunnel/dmvpn_tunnel
(config network interface dmvpn_tunnel_interface)>

    5. Set the IP address and netmask of the tunnel. The netmask must be set to /32. For example, to set the IP address to 10.20.1.4/32:

      (config network interface dmvpn_tunnel_interface)> ipv4 address 10.20.1.4/32
(config network interface dmvpn_tunnel_interface)>
  5. Configure NHRP:

    1. Type ... to return to the top level of the configuration schema:

      (config network interface dmvpn_tunnel_interface)> ...
(config)>

    2. Enable routing services:
      (config)> network route service enable true
(config)>
    3. Enable NHRP:
      (config)> network route service nhrp enable true
(config)>
    4. Add an NHRP network:
      (config)> add network route service nhrp network end
(config network route service nhrp network 0)>
    5. Set the interface to the interface that was created above:
      (config network route service nhrp network 0)> interface dmvpn_tunnel_interface
(config network route service nhrp network 0)>
    6. Set the tunnel to the IP tunnel created above:
      (config network route service nhrp network 0)> tunnel /vpn/iptunnel/dmvpn_tunnel
(config network route service nhrp network 0)>
    7. Add a net hop server:
      (config network route service nhrp network 0)> add nhs end
(config network route service nhrp network 0 nhs 0)>-
  6. Set the hostname or IP address of the node that will be the next hop server:
    (config network route service nhrp network 0 nhs 0)> nbma hostname/IP_address
(config network route service nhrp network 0 nhs 0)>

  7. Configure OSPF routing:

    (config network route service ospf) 
(config)>
  8. Configure the overlay connection using BGP:

    1. Type ... to return to the top level of the configuration schema:

      (config network interface dmvpn_tunnel_interface)> ...
(config)>

    2. Enable BGP:
      (config)> network route service bgp enable true
(config)>
    3. Set the autonomous system number for this device. For example, to set the autonomous system number to 66007:
      (config)> network route service bgp asn 66007
(config)>
    4. Set the best path criteria to multipath:
      (config)> network route service bgp as_path multipath-relax
(config)>
    5. Add a neighbour:
      (config)> add network route service bgp neighbour end
(config network route service bgp neighbour 0)>
    6. Set ip to the IP address of the hub. For example:
      (config network route service bgp neighbour 0)> ip 10.20.1.1
(config network route service bgp neighbour 0)>
    7. Enable eBGP multihop:
      (config network route service bgp neighbour 0)> ebgp_multihop true
(config network route service bgp neighbour 0)>
  9. Repeat to add additional spokes.
  10. Save the configuration and apply the change.
    (config)> save
Configuration saved.
>
  11. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.