DMVPN - phase four (IKEv2/FlexVPN)
When Cisco introduced the new IKE (IKEv2) and the new unified configuration for all types of VPN (excluding GET VPN), they also updated the DMVPN. The new version (phase 4 - but I’m not sure if it is official name) spoke-to-spoke has changed many things. There is no more point-to-multipoint tunnels. For spoke-to-hub connection you have to configure a tunnel interface (for each hub in case you have more than one) on your spoke routers. For spoke-to-spoke communication you need to create a virtual-template and every time the new connection will be built, based on this template, the new, dynamic interface will be created.
In my configuration I will use as much default settings as it is possible. Let’s start with the hub configuration.
I enable following ikev2 settings on all routers (hub and spoke):
default crypto ikev2 proposal default crypto ikev2 policy default crypto ipsec
Continue reading →