I am doing a lab about DMVPN and Site to Site ASA integration. There is no problem in the DMVPN.
The router on the left is the hub of the DMVPN and the router on the right is one of the spokes. All internal network (172.20.40.0/24, 172.20.1.0/4) is routed through Tunnel interface through EIGRP.
There is one to one natting of the address 126.96.36.199 forward to FW on the left (172.20.4.2). The firewall on the right establishes site-to-site VPN through the external IP (188.8.131.52). show crypto ipsec sa managed to show that the vpn tunnel is established, however there is no route from the firewall on the right to the DMVPN (172.20.30.0/24 -> 172.20.40.0/24).
The routing of the external network (184.108.40.206/24, 220.127.116.11/24, 18.104.22.168/24) uses BGP to exchange routing. How do I allow the firewall to learn the route of DMVPN and vice versa?
Left side ASA
protocol esp encryption des protocol esp integrity sha-256 crypto ikev2 policy 1 encryption des integrity sha group 5 prf sha lifetime seconds 86400 crypto ikev2 enable outside ! Define the B-END of the tunnel and configure PSK tunnel-group 22.214.171.124 type ipsec-l2l tunnel-group 126.96.36.199 ipsec-attributes ikev2 remote-authentication pre-shared-key *** ikev2 local-authentication pre-shared-key *** access-list S2SACL extended permit ip any 172.16.30.0 255.255.255.0 crypto map S2SCRYPTOMAP 10 match address S2SACL crypto map S2SCRYPTOMAP 10 set peer 188.8.131.52 crypto map S2SCRYPTOMAP 10 set ikev2 ipsec-proposal S2SPROP crypto map S2SCRYPTOMAP interface outside
Right side ASA
crypto ipsec ikev2 ipsec-proposal S2SPROP protocol esp encryption des protocol esp integrity sha-256 ! crypto ikev2 policy 1 encryption des integrity sha group 5 prf sha lifetime seconds 86400 crypto ikev2 enable outside ! tunnel-group 184.108.40.206 type ipsec-l2l tunnel-group 220.127.116.11 ipsec-attributes ikev2 remote-authentication pre-shared-key *** ikev2 local-authentication pre-shared-key *** ! object network INTERNAL network-object 172.16.30.0 255.255.255.0 access-list clients extended permit ip object INTERNAL any access-list clients extended permit icmp any any access-list S2SACL extended permit ip 172.16.30.0 255.255.255.0 any ! access-group clients in interface inside ! crypto map outside_map 10 match address S2SACL crypto map outside_map 10 set peer 18.104.22.168 crypto map outside_map 10 set ikev2 ipsec-proposal S2SPROP crypto map outside_map interface outside ! packet-tracer input inside icmp 172.16.30.10 1 2 3 172.16.40.10