zNetLaB › Guided labs › Enterprise
DMVPN phase 2 over IPsec
Enterprise Advanced 6 devices 5 checked tasks 105 points Plan lab
A hub and two spokes on the internet. Build one multipoint GRE tunnel per router, register the spokes with the hub over NHRP, protect it all with IPsec, run EIGRP over it — and keep the far spoke as the next hop so spoke-to-spoke traffic goes direct once NHRP resolves it. You build it in a browser, type real commands at each device, and every task below is
checked against the running configuration — so you find out it is wrong before anybody else does.
Open this lab in the simulator
The simulator runs in your browser with nothing to install. This lab is part of the full simulator: open it free for 7 days with a new account, then with a plan. It needs an account, which keeps your progress.
The scenario
A hub and two spokes on the internet. Build one multipoint GRE tunnel per router, register the spokes with the hub over NHRP, protect it all with IPsec, run EIGRP over it — and keep the far spoke as the next hop so spoke-to-spoke traffic goes direct once NHRP resolves it.
Your role: a network engineer on the enterprise team. Level: Advanced Done when: all 5 goals show as passed (105 points).
Network status
Devices: 4 routers, 2 PCs, cabled as drawn. No Layer 1 or Layer 2 faults: every link is connected and up. HUB starts with addresses (G0/0 203.0.113.1/30) and static routes already configured. Internet starts with addresses (G0/0/0 203.0.113.2/30, G0/0/1 198.51.100.2/30, G0/0/2 192.0.2.2/30). SPOKE1 starts with addresses (G0/0 198.51.100.1/30, G0/1 10.1.0.1/24) and static routes already configured. SPOKE2 starts with addresses (G0/0 192.0.2.1/30, G0/1 10.2.0.1/24) and static routes already configured. H1 is a host with 10.1.0.10/24, gateway 10.1.0.1. H2 is a host with 10.2.0.10/24, gateway 10.2.0.1. Known problems
None: nothing is misconfigured. The network is simply not finished: what the goals list is what you have to build or secure. Goals
Both spokes register with the hub (25 pts) IPsec phase 1 is up between the hub and SPOKE1 (20 pts) SPOKE1 routes to SPOKE2’s LAN with SPOKE2 as the next hop (20 pts) H1 reaches H2 across the overlay (20 pts) SPOKE1 has resolved SPOKE2 through NHRP (20 pts) The activity, in order
Both spokes register with the hub Why: Each goal is a state the lab can check on the running device. Verify with: show running-config IPsec phase 1 is up between the hub and SPOKE1 Why: Each goal is a state the lab can check on the running device. Verify with: show running-config SPOKE1 routes to SPOKE2’s LAN with SPOKE2 as the next hop Why: The next hop must be an address on a directly connected subnet, or the route never enters the table. Verify with: show ip route H1 reaches H2 across the overlay Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 10.2.0.10 SPOKE1 has resolved SPOKE2 through NHRP Why: Each goal is a state the lab can check on the running device. Verify with: show running-config Tips
Work in the order given: later goals depend on the earlier ones. After every change, run the verify command before moving on; do not guess. Stuck? Read the verify output first. It names the interface, neighbour or route that is wrong. Why this matters
A hub and two spokes on the internet. Build one multipoint GRE tunnel per router, register the spokes with the hub over NHRP, protect it all with IPsec, run EIGRP over it — and keep the far spoke as the next hop so spoke-to-spoke traffic goes direct once NHRP resolves it.
What you will be able to do
Both spokes register with the hub
IPsec phase 1 is up between the hub and SPOKE1
SPOKE1 routes to SPOKE2’s LAN with SPOKE2 as the next hop
H1 reaches H2 across the overlay
The network
ISR 2911, ISR 4451, PC — 6 devices in all, already cabled.
Gi0/0 203.0.113.1/30 Gi0/0/0 203.0.113.2/30 Gi0/0 198.51.100.1/30 Gi0/0/1 198.51.100.2/30 Gi0/0 192.0.2.1/30 Gi0/0/2 192.0.2.2/30 Gi0/1 10.1.0.1/24 Fa0 Gi0/1 10.2.0.1/24 Fa0 HUB Internet SPOKE1 SPOKE2 H1 10.1.0.10/24 · gw 10.1.0.1 H2 10.2.0.10/24 · gw 10.2.0.1 Drawn from this lab: devices, cables, ports and the addresses already set. Device Model Address already set
HUB ISR 2911 configure it Internet ISR 4451 configure it SPOKE1 ISR 2911 configure it SPOKE2 ISR 2911 configure it H1 PC 10.1.0.10 / 255.255.255.0 gw 10.1.0.1 H2 PC 10.2.0.10 / 255.255.255.0 gw 10.2.0.1
Cabling
HUB Gi0/0 ↔ Internet Gi0/0/0 SPOKE1 Gi0/0 ↔ Internet Gi0/0/1 SPOKE2 Gi0/0 ↔ Internet Gi0/0/2 SPOKE1 Gi0/1 ↔ H1 Fa0 SPOKE2 Gi0/1 ↔ H2 Fa0
What is configured at the start
These are already configured when the lab opens — including, where this is a troubleshooting lab, the fault itself:
Internet interface g0/0/0
ip address 203.0.113.2 255.255.255.252
no shutdown
exit
interface g0/0/1
ip address 198.51.100.2 255.255.255.252
no shutdown
exit
interface g0/0/2
ip address 192.0.2.2 255.255.255.252
no shutdown
exit HUB interface g0/0
ip address 203.0.113.1 255.255.255.252
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 203.0.113.2 SPOKE1 interface g0/0
ip address 198.51.100.1 255.255.255.252
no shutdown
exit
interface g0/1
ip address 10.1.0.1 255.255.255.0
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 198.51.100.2 SPOKE2 interface g0/0
ip address 192.0.2.1 255.255.255.252
no shutdown
exit
interface g0/1
ip address 10.2.0.1 255.255.255.0
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 192.0.2.2 Tasks, and how each one is checked
Every task is decided by reading the live network — a neighbour in FULL, a ping that succeeds, a line in the running configuration — not by looking for a keyword you typed. The same command shows you what the lab sees.
# Task Pts How to verify it yourself
1 Both spokes register with the hub 25 Checked automatically against the device’s live state (dmvpnPeers). 2 IPsec phase 1 is up between the hub and SPOKE1 20 On HUB: show crypto isakmp sa — peer 198.51.100.1 is QM_IDLE. 3 SPOKE1 routes to SPOKE2’s LAN with SPOKE2 as the next hop 20 On SPOKE1: show ip route 10.2.0.0 shows next hop 10.0.0.12. 4 H1 reaches H2 across the overlay 20 On H1: ping 10.2.0.10 must succeed. 5 SPOKE1 has resolved SPOKE2 through NHRP 20 Checked automatically against the device’s live state (nhrpEntry).
Stuck? Ask the coach
Tell the coach what you see or what you tried. It gives you a hint, not the answer, the way a senior engineer would. Included with a free trial or any plan.
Ask the coach
Reference solution
Try it yourself first — the lab checks your work either way. This is one configuration that makes every task pass, device by device:
HUB crypto isakmp policy 10
encryption aes 256
hash sha256
authentication pre-share
group 14
exit
crypto isakmp key DmvpnKey address 0.0.0.0 0.0.0.0
crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac
mode transport
exit
crypto ipsec profile DMVPN
set transform-set TS
exit
interface Tunnel0
ip address 10.0.0.1 255.255.255.0
tunnel source g0/0
tunnel mode gre multipoint
tunnel key 100
ip nhrp network-id 1
ip nhrp authentication DMVPN
ip nhrp map multicast dynamic
no ip next-hop-self eigrp 100
no ip split-horizon eigrp 100
tunnel protection ipsec profile DMVPN
exit
router eigrp 100
network 10.0.0.0 0.0.0.255
no auto-summary SPOKE1 crypto isakmp policy 10
encryption aes 256
hash sha256
authentication pre-share
group 14
exit
crypto isakmp key DmvpnKey address 0.0.0.0 0.0.0.0
crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac
mode transport
exit
crypto ipsec profile DMVPN
set transform-set TS
exit
interface Tunnel0
ip address 10.0.0.11 255.255.255.0
tunnel source g0/0
tunnel mode gre multipoint
tunnel key 100
ip nhrp network-id 1
ip nhrp authentication DMVPN
ip nhrp map 10.0.0.1 203.0.113.1
ip nhrp map multicast 203.0.113.1
ip nhrp nhs 10.0.0.1
tunnel protection ipsec profile DMVPN
exit
router eigrp 100
network 10.0.0.0 0.0.0.255
network 10.1.0.0 0.0.0.255
no auto-summary SPOKE2 crypto isakmp policy 10
encryption aes 256
hash sha256
authentication pre-share
group 14
exit
crypto isakmp key DmvpnKey address 0.0.0.0 0.0.0.0
crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac
mode transport
exit
crypto ipsec profile DMVPN
set transform-set TS
exit
interface Tunnel0
ip address 10.0.0.12 255.255.255.0
tunnel source g0/0
tunnel mode gre multipoint
tunnel key 100
ip nhrp network-id 1
ip nhrp authentication DMVPN
ip nhrp map 10.0.0.1 203.0.113.1
ip nhrp map multicast 203.0.113.1
ip nhrp nhs 10.0.0.1
tunnel protection ipsec profile DMVPN
exit
router eigrp 100
network 10.0.0.0 0.0.0.255
network 10.2.0.0 0.0.0.255
no auto-summary Where this is examined
This lab practises these topics in the zNetLaB certification courses:
GRE and IPsec tunnels, LISP, VXLAN concepts — CCNP Enterprise · ENCOR · Virtualization DMVPN phases, NHRP, IPsec — CCNP Enterprise · ENARSI · VPN DMVPN phase 2/3, IPsec profiles — CCIE Enterprise Infrastructure · Transport Technologies and Solutions Secure communications: VPN, IPsec, tunnels — CompTIA Security+ · Security Architecture VPN technologies: site-to-site IPsec, DMVPN, GRE — CCNP Security Core · Security Concepts Overlays: GRE, IPsec, SD-WAN — Service Provider · VPN Services
Related labs
Where to start
The lessons all guided labs plans
CCNA®, CCNP® and Cisco® are trademarks of Cisco Systems, Inc. zNetLaB is not affiliated with or endorsed by Cisco.