1

I am doing a lab about DMVPN and Site to Site ASA integration. There is no problem in the DMVPN.

However I have problem in establishing route from Site to Site ASA to DMVPN.enter image description here

The router on the left is the hub of the DMVPN and the router on the right is one of the spokes. All internal network (172.20.40.0/24, 172.20.1.0/4) is routed through Tunnel interface through EIGRP.

There is one to one natting of the address 132.87.2.2 forward to FW on the left (172.20.4.2). The firewall on the right establishes site-to-site VPN through the external IP (132.87.2.2). show crypto ipsec sa managed to show that the vpn tunnel is established, however there is no route from the firewall on the right to the DMVPN (172.20.30.0/24 -> 172.20.40.0/24).

The routing of the external network (132.87.2.0/24, 65.32.147.0/24, 18.31.192.0/24) uses BGP to exchange routing. How do I allow the firewall to learn the route of DMVPN and vice versa?

Left side ASA

 protocol esp encryption des
 protocol esp integrity sha-256

crypto ikev2 policy 1
 encryption des
 integrity sha
 group 5
 prf sha
 lifetime seconds 86400

crypto ikev2 enable outside
! Define the B-END of the tunnel and configure PSK
tunnel-group 65.32.147.1 type ipsec-l2l
tunnel-group 65.32.147.1 ipsec-attributes
 ikev2 remote-authentication pre-shared-key ***
 ikev2 local-authentication pre-shared-key ***

access-list S2SACL extended permit ip any 172.16.30.0 255.255.255.0
 
crypto map S2SCRYPTOMAP 10 match address S2SACL
crypto map S2SCRYPTOMAP 10 set peer 65.32.147.1
crypto map S2SCRYPTOMAP 10 set ikev2 ipsec-proposal S2SPROP
crypto map S2SCRYPTOMAP interface outside

Right side ASA

crypto ipsec ikev2 ipsec-proposal S2SPROP
 protocol esp encryption des
 protocol esp integrity sha-256
!
crypto ikev2 policy 1
 encryption des
 integrity sha
 group 5
 prf sha
 lifetime seconds 86400
crypto ikev2 enable outside
!
tunnel-group 132.87.2.2 type ipsec-l2l
tunnel-group 132.87.2.2 ipsec-attributes
 ikev2 remote-authentication pre-shared-key ***
 ikev2 local-authentication pre-shared-key ***
!
object network INTERNAL
 network-object 172.16.30.0 255.255.255.0
access-list clients extended permit ip object INTERNAL any 
access-list clients extended permit icmp any any 
access-list S2SACL extended permit ip 172.16.30.0 255.255.255.0 any 
!
access-group clients in interface inside
!
crypto map outside_map 10 match address S2SACL
crypto map outside_map 10 set peer 132.87.2.2
crypto map outside_map 10 set ikev2 ipsec-proposal S2SPROP
crypto map outside_map interface outside
!
packet-tracer input inside icmp 172.16.30.10 1 2 3 172.16.40.10
Improve this question
2
  • I can't think of a way to do that with policy-based tunnels on your ASAs. If you were using route-based tunnels with VTIs it would be easily accomplished by using some form of dynamic routing between the routers and ASAs and then redistribute the routes the ASA gets from the routers into BGP and use route-maps to control which routes go over the ASA IPSec tunnels to each other.
    – Jesse P.
    Commented Oct 8, 2020 at 13:30
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Nov 19, 2022 at 22:52

1 Answer 1

Reset to default
-1

Looks like your ACL are not defined with destination network. Site-Site should have the source & destination network defined.

access-list S2SACL extended permit ip any 172.16.30.0 255.255.255.0 access-list S2SACL extended permit ip 172.16.30.0 255.255.255.0 any

172.20.1.0/24 should be defined in ACL: so your ACL may look like

access-list S2SACL extended permit ip 172.20.1.0 255.255.255.0 172.16.30.0 255.255.255.0 access-list S2SACL extended permit ip 172.16.30.0 255.255.255.0 172.20.1.0 255.255.255.0

Improve this answer
1
  • Not only does that not really matter (in fact, some setups, such as AWS, REQUIRE you not define a destination network in your "interesting traffic" ACL and leave it set to "any", and then you can then use a VPN filter to restrict traffic), it doesn't have ANYTHING to do with redistributing to/from DMVPN routes, which is what the OP was needing help with. As I stated, if this were a route-based tunnel, what they asked for could easily be done. Please change your answer to a comment, as it doesn't have anything to do with the OPs question, if you choose to leave it.
    – Jesse P.
    Commented Nov 15, 2020 at 1:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.