Configuring DMVPN Phase 3 w/ EIGRP

In this blogtorial we will configure DMVPN Phase 3 and run EIGRP over the tunnel. After reading this blogtorial, I hope that you will have a clear understanding of DMVPN Phase 3 and how it interacts with EIGRP. If you need a primer on DMVPN Phase 1 and Phase 2, please see my DMVPN blogtorials.

Here is the topology.

Configuring DMVPN Phase 2 w/ EIGRP

In this blogtorial we will configure DMVPN Phase 2 and configure EIGRP over the DMVPN tunnel. Over the past few blogtorials we've been concentrating on how to configure DMVPN Phase 1 and routing protocols over DMVPN Phase 1. One of the key disadvantage of Phase 1 is that all spoke to spoke traffic must pass through the HUB which is a bit inefficient. DMVPN Phase 2 improves on DMVPN Phase 1 by allowing for on-demand dynamic spoke to spoke tunnels based on traffic patterns.

Here is our topology.

Configuring DMVPN Phase 1 w/ IPSEC and EIGRP

In this blogtorial we will take a look at how to configure DMVPN, EIGRP over DMVPN and get the traffic going over the DMVPN encrypted using IPSEC. We will break the blogtorial in 3 parts. First we will configure the DMVPN / tunnel and verify end-to-end IP connectivity, then we will move on to configuring routing over the tunnel and finally get IPSEC configured to encrypt everything going over the tunnel.

Here is our topology.

Configuring GRE over IPSEC w/ Routing (EIGRP)

In this blogtorial, we will briefly explore how to configure GRE tunnels over IPSEC with routing (EIGRP). In addition, we will take a closer look down at the packet level on how GRE interacts with IPSEC. Take a look at the simple topology below and let's get started.

EIGRP - Troubleshooting LAB 1

Objective:

• When Gig2 is shutdown on R1, metric for the route to reach Loopback1 should not change on R2.  

Here is a simple topology and let's get started.

EIGRP - Extended NAMED ACLs are not allowed in distribute-list.

Quick post regarding an error message I came across when trying to configure eigrp distribute-list with extended NAMED ACLs.

% The ACL cannot be created or an ACL with the same name but incompatible type already exists.

Router version CSR1000v - Cisco IOS Software, CSR1000V Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.4(2)S, RELEASE SOFTWARE (fc2)

 R5(config)#ip access-list extended PBR_EIGRP  
 R5(config-ext-nacl)#deny ip host 155.1.0.1 host 150.1.4.4  
 R5(config-ext-nacl)#deny ip host 155.1.0.3 host 150.1.4.4  
 R5(config-ext-nacl)#deny ip host 155.1.0.4 host 150.1.4.4  
 R5(config-ext-nacl)#deny ip host 155.1.0.1 host 150.1.6.6  
 R5(config-ext-nacl)#deny ip host 155.1.0.3 host 150.1.6.6  
 R5(config-ext-nacl)#deny ip host 155.1.0.4 host 150.1.6.6  
 R5(config-ext-nacl)#deny ip host 155.1.0.1 host 150.1.1.1  
 R5(config-ext-nacl)#deny ip host 155.1.0.2 host 150.1.1.1  
 R5(config-ext-nacl)#deny ip host 155.1.0.4 host 150.1.1.1  
 R5(config-ext-nacl)#deny ip host 155.1.0.1 host 150.1.2.2  
 R5(config-ext-nacl)#deny ip host 155.1.0.2 host 150.1.2.2  
 R5(config-ext-nacl)#deny ip host 155.1.0.4 host 150.1.2.2  
 R5(config-ext-nacl)#deny ip host 155.1.0.3 host 150.1.7.7  
 R5(config-ext-nacl)#deny ip host 155.1.0.2 host 150.1.7.7  
 R5(config-ext-nacl)#deny ip host 155.1.0.4 host 150.1.7.7  
 R5(config-ext-nacl)#deny ip host 155.1.0.3 host 150.1.9.9  
 R5(config-ext-nacl)#deny ip host 155.1.0.2 host 150.1.9.9  
 R5(config-ext-nacl)#deny ip host 155.1.0.4 host 150.1.9.9  
 R5(config-ext-nacl)#permit ip any any  

 R5(config-router)#distribute-list PBR_EIGRP in
 % The ACL cannot be created or an ACL with the same name but incompatible type already exists.
 R5(config-router)#^Z

Propagating Default Routes - EIGRP

There are 4 ways to get default routes into EIGRP topology. We will take a look at all of them. Consider a simple 2 router topology and let's begin.