[music]
Okay the next tunnels we're going to look at are DMVPN.
These are probably the more common, more modern way of doing this,
the transport IPv6 over an IPv4 only network.
The advantage of this is of course the D means dynamic the M means
multipoint. So we already have the dynamic and the multipoint part
in here. Now, we just got done looking at two other dynamic multipoint
methods of doing this.
So what makes DMVPN so much better?
First off it's a lot easier to do security with it.
The other piece is you're going to see the hub doesn't need a whole
lot of config.
In fact it's actually the simplest part of this,
and then all the spokes get almost identical configs.
So that's really the big advantage to this whole thing,
is that you have very, very simple config and it does everything
you need it to do, our dynamic routing protocols can run over it,
no problem at all.
So that's what we're going to do.
We're going to jump in. We're going to set this up. It's actually really easy to do.
So once again, we'll be using our same VPN topology but this time,
we're going to be focusing on just all the customer A sites.
So we're going to be doing Switch 1, Switch 2,
and Router 6 here.
That way, we can actually have multipoint tunnels.
We will use Router 1 as our hub, and we will use Routers 4 and 5
as our spoke routers with the networks behind them.
So let's again jump over the command line here and I'm already on
Router 1 as the hub, so here we go, and this is where again,
it's really nice.
Actually before we get too far into this,
we've been doing EIGRP this whole time on our previous lessons.
So I decided it would be a good time to switch to OSPF.
So that being the case, we do actually need to fire that up here
real quick. So let's go over-- we'll start with the client devices,
we'll start at Switch 1, and we'll say,
interface loopback0 ipv6 ospf 1 area 0,
loopback1 in area 0 and interface fa0/0.71.
There's the switch, interface vlan 71 in area 0.
Switch 2, same basic thing, interface loopback0 ipv6 ospf 1 area
0. And this is of course legacy OSPF config.
We'll be doing fancier stuff in MPLS in our next lesson.
So interface loopback1 in area 0, and interface VLAN.
And this one up here is 84 in area 0.
And then Router 6 interface loopback0 ipv6 ospf 1 area 0,
interface loopback1 area 0, interface g0/0.
and that's 65 in area 0.
Okay. That should pretty much take care of those.
Let's go to Router 1 now, and interface FA00.71 IPv6 OSPF 1 area 0.
So we fire up OSPF with the client router,
same on Router 4.
Interface FA0/0.84 neighbor ship and Router 5.
So that takes care of OSPF running on the outer edges,
now we could get to our tunnel.
So Router 1 interface tunnel 0 and there's two things we need to
do right off the bat.
First off IPv6 OSPF 1 area 0 before we forget and it's not going
to let me, okay so we can't do that first.
Fine. Let's go ahead and set this up normal,
then. So IPv6 address FE80::1 link-local,
and IPv6 address 2001:db8:100:200::1/64.
We're just sort of using 200 for our tunnel interface here.
Now we can say IPv6 OSPF 1 area 0, and IPv6 OSPF network type point-to-multipoint.
Because it's the hub, so it's definitely going to have to either
be point-to-multipoint or broadcast.
We'll start to point to multipoint, this is essentially doing either
phase one or phase two for DMVPN and then we'll move this whole thing
over here in a minute.
But we'll at least just do phase two, we'll turn it over to broadcast
should only take about a moment.
So that's what we need for the IPv6 basic config.
Don't forget we also need a tunnel source and that's going to be
on Router 1, that's going to be FA0/0.12.
We could use a loop back too it doesn't really matter.
Then we need a tunnel mode.
Is GRE my multipoint.
So tunnel mode GRE multipoint is what we typed in.
Now we need a couple NHRP commands.
NHRP is Next Hop Redundancy Protocol.
It's what DMVPN uses to build the dynamic mappings on how to get
to remote sites.
We're not going to get a whole bunch into DMVPN this is again,
just about changes from IPv4 to IPv6 so I'm not going to get into
a whole bunch here.
Probably the best way to think of NHRP if you're not real familiar
with DMVPN is it's like ARP but instead of ARP which does Layer 3
to Layer 2 lookup, this is Layer 3 to Layer 3.
I want to get to this private address through what public address?
So, that's what we need to do.
Now, the hub though is very, very simple because it doesn't get that
information. It just gets IPv6 , NHRP map,
for multicast, learn it dynamics.
That's so we can run routing protocols over it,
and then IPv6, NHRP, network ID and give it a number.
It doesn't really matter - network ID 1 - we're not trying to run
multiple networks over this same tunnel interface,
so that's fine.
And at the end of this whole thing, guess what?
That's the config.
Do show run interface tunnel 0.
That's it. That's what we have.
And we did turn on OSPF, correct?
Yes we did, okay.
So let's go over to Router 4 and interface tunnel 0 IPv6 address
FE80:: four link local.
So, give him an address.
Of course, IPv6 RSPF1 area 0 for consistency,
and so we don't have to change timers and stuff.
We will change his network type to point to multipoint as well.
And then there's the stuff that makes the spokes a little bit
different from the hub.
Now, I've put in the stuff that's the same first,
so first off, tunnel source FA0/0.
and in this case it's 34.
And tunnel mode GRE multipoint.
And IPv6 NHRP network ID 1.
So those things are the same.
Those are things we had put in on the other side,
and they're going to be the same on this side,
the side of course in the tunnel source may be different.
Now, the next things are things that we're going to need on the
spokes, but not on the hub.
So the first one is IPv6 NHRP map multicast.
And all this part we had on the hub, but the hub said dynamic.
Actually you know what, I'm sorry.
Before we do multicast we should really map the address of the hub
first. 2001 DB8:100:200::1.
So that IPv6 address/64 is available through what's his IPv4
address. You can go back to the diagram if you need to but it's 173.1.12.1.
So I'm telling him that you can get to his address on the cloud through
that next hub.
This is also where we're going to map our multicast.
So IPv6 NHRP map multicast to 173.1.12.1.
Last but not least IPv6 NHRP next hop server end point into that
guy. Oops, not with the mask.
OSPF just came up over the tunnel which is always a really good sign.
Do show run interface tunnel 0.
So there's the spoke configuration.
Here's the beautiful part about the spoke configuration is we can
grab this, we can copy this put it in your favorite note editor and
then just tweak it a little bit.
So let's see this is going to go on Router 5 next.
So his link local is going to be 5, oops not 51.
Area 51 is a whole different thing.
Five but guess what, that's the same, that's the same,
that's the same, that's the same, that's the same,
this is going to be different because it's actually 35.
That's it. Copy it, switch back to your command line make sure you
go to the right router.
I want to make sure I have that interface right.
I said 35 I'm pretty sure that's right,
yeah it is. Okay, and paste.
Didn't really need an end on that but that's okay.
OSPF already came up, already a good sign.
Now what this means is we should be able to go to say Switch 1
and say, Do trace 2001 DB8:100:8::8 good.
Also somebody we haven't hit yet 6::6 Router 6.
You can see right here it went to 1 and then 4 and here it went
from 1 and then 5.
So just like that DMVPN is done and up and good to go.
If you go to router-- let's see we're on Switch 1.
So let's go to switch two and say do trace 2001 DB8:100:6::6 that
should go through Router 1, so it goes to 4,
to 1, to 5, to 6.
Fine. Trace it a couple of times, it'll do the same thing.
This is what's referred to as DMVPN Phase 1.
Phase 1 essentially says that all traffic has to go through the hub.
So I'm learning all the routes, but the next hop for all the routes,
if I go to-- this is of course, not taking place on Switch 2,
it's taking place on Router 4.
If I go to Router 4 and I say, do show IPv6 route OSPF,
all of his next hops, all point to the link-local address of Router
1. I mean, everything is not on this side,
of course. Stuff on this side is, of course,
pointing to Switch 2.
But everything else including 5's address.
So you know Router 5's address on the tunnel,
Router 6 is loopback, all goes to Router 1,
so that's essentially Phase 1.
Now with Phase 1, I technically wouldn't have to get all these routes,
I could summarize.
But we're not going down the whole big DMVPN discussion here.
But what I can do, just to show you that it works fine for IPv6,
is I could go to Router 1 and I could say,
ipv6 ospf network broadcast.
And then on 4, I'm on the interface, ipv6 ospf network broadcast
and ip ospf priority 0, so we cannot become the DR or the BDR.
Router 5, and I'm not under the tunnel.
Okay. Give t:58.840000 Stuff on this side is, of course, pointing to switch to, but everything else, including, you know, five's address. So, you know, router five's address on the, on the tunnel. Router six is loop back. All goes to router one. So that's essentially phase one. Now with phase one, I technically wouldn't have to get all these routes. I could summarize, but we're not going down a whole big DMVPN discussion here. But what I can do, just to show you that it works fine for IPV six, is I can go to router one and I could say IPV six OSPF network broadcast. And then on four. I'm going to interface. IPV six OSPF network broadcast and IPOSPF priority zero so we cannot become the B.R. or the B.D.R. Okay. Give this just a second and it should stabilize. Right now they're in two way. And it's got to wait for things to time out and stuff. It might actually be faster. Give it a second here. You might have to bounce the tunnel interfaces. I'm just going to do it. This is usually faster. And you're going to do this always bring the hub up first. Now this OSPF neighborhood should come up. Probably in the wait state. You have to wait 40 seconds. Do show IP OSPF interface brief. I'm looking at IP. I'm sitting there going like those aren't the right interfaces. That's much better. Okay. So he's the drother, which is good. And then five. No shut. It's already done before I came to command. Okay. So OSPF is up and running now. So now let's go back to our switch to do our trace again. That's looking spectacular. There we go. Okay. So again, four to one to five to eight, just like we had before. Four, one, five to six. Eight to milliseconds. I'm like, what is eight? Okay. All right. So four, one, five, eight. Four, one, five, six. Okay. Let's go to router three. Yeah. I'm out of four, sorry. Do show IPV six. NHRP. And what you can see here. So he's got that entry. He's got the 200. Is it a little bit interesting there? So that's going through one and into five. And then one and into five is not switching over. All the traffic is going through the hub still. Do show IPV six route OSPF. So he has the right next hops now. But for some reason it's not switching. It's interesting. Take a look at router one here. Make sure everything worked okay. And by the way, this is how you look at the cache, right? So what this is basically telling you is, okay, so here's this host. Okay. We're getting to him through that guy through this IPV four address of 34.4. To get to router five, he's going to 35.5. And then of course the link locals are getting registered as well to those same addresses. So what we have going on here is both spokes are registering with the hub. No problem. And then we go to router four. And he's learning. That's the problem right there. Yeah, he's learning it as a slash 64. So yeah, he's going to continue to go to router one. Let's try something behind it. Let's try and go to six again from four. He's still going to one. That's actually really interesting. Why is he going to one? Oh, that'd be why. Because he says that FE80 colon colon five goes to the NBMA address of 173.1.12.1. That's not what we're looking for here. So let's try this one more time. Let him re-register with the server. Because see router one has it right. 34, 35, 34, 35. Okay, neighbor four just came up. Yeah, the problem is he keeps learning. He keeps learning the link local with the NBMA address of 12.1. So we may have to actually say IPv6, NHRP, redirect. And I'm router four, IPv6, NHRP, shortcut. Shouldn't have to do this just for phase two. This is really what you do when you go into phase three. But it looks like for IPv6 with the link local, it's going to cause us a problem. Oops. See if that fixes it. At this point it's working. So it's not that big of a deal. But I'd really rather see it do the actual peer to peer. So let's clear this again. So we only know about one now. Now he's getting it incomplete. And he's still going to go through one. We might have to clear it on five too. We'll do this one more time and see if it works. We'll just bounce all these interfaces one more time. Now that we turned on that feature. For anybody who's not real familiar with DMVPN, what I'm trying to get working here and for some silly reason it's not, is spoke to spoke. I mean spoke to spoke through the hub is working just fine. So just from a raw connectivity standpoint, it's working. But what I'm trying to do is move us out of phase two slash phase or phase one here, which is all traffic through the hub and get us over to something a little more modern. And again, I'm not trying this on this particular version of code. So it's also possible here. Then it doesn't work. I run into a few things that don't work on particular code. So the hub then let's trace it. Oh, play hello, Vospey. I came back up. There we go. Might help. And now it's hitting incomplete negative. So it's not going to switch over. So either the code's not working or I missed something. Let me give a real quick look at my configs. And that's right. And that all looks right. I did have. And one more thing. So he's got the next top right. It's just not resolving the next top right. Yep. So some reason he's hitting type incomplete flags negative trying to do the switch over spoke to spoke. So not going to spend a whole lot of time looking at this. Again, we're not trying to focus here on DM VPN. So obviously something's not quite set right here for some reason, though everything looks right. So as far as IPv6 over DM VPN though, working fine, no problem. And again, still no IPv4 on anything underneath. So that's really all it takes to set it up and run it. And by the way, there's another one you want to be aware of. Do show DM VPN. Another good command that will actually show you what's up for what addresses. So another good one to keep your eyes on for NHRP. And there's another one detail that adds a little bit more information, particularly if you're running IP Sac over any of this. And you're doing cryptography. It shows you the crypto information down at the bottom. So that's pretty cool as well. So that's IPv6 over DM VPN.