IPsec phase-1 authentication while NAT’ing through an intermediate router to a VPN peer router.

Hey IT network friends, I’ve encountered an issue while bringing a new site into a DMVPN (Phase 3) network today — thought you’d all like to hear about it, with hope you can avoid such complications yourselves in the future.

The problem roots from an incorrect assumption made by our Provisioning Engineer regarding the network architecture at our new London branch. After implementing corporate DMVPN config templates, the new site would not integrate into the DMVPN network. And here’s why…

Intended DMVPN topology.

We found was that there was another router in front of the R-LON peer router, owned by the ISP for the connection to the site…

While internet access data plane traffic from users within the London branch LAN is PAT overloaded by the R-LON-ISP router with SRC IP 42.203.67.18 — the branch DMVPN peer is terminated on the R-LON router.

Due to a static 1–2–1 NAT configured on R-LON-ISP router…

ip nat inside source static 172.16.0.1 42.203.67.19

All management plane traffic, including IPsec authentication, from R-LON is therefore presented to the internet with SRC IP of 42.203.67.19 — not using the R-LON-ISP router outside interface 42.203.67.18 as SRC IP.

Our DMVPN configuration on both hub router R-GLA and on spoke routers R-EDI & R-LON does not specify peer IP address for London, only the hub router IP as R-GLA 42.203.67.2. For example,

!!! R-EDI

interface Tunnel0 ip address 10.0.0.2 255.255.255.0 no ip redirects ip nhrp authentication cisco ip nhrp network-id 100 ip nhrp nhs 10.0.0.1 nbma 42.203.67.2 multicast ip ospf network broadcast ip ospf priority 0 tunnel source GigabitEthernet0/0 tunnel mode gre multipoint tunnel key 123 tunnel protection ipsec profile DMVPN-IPSEC

However, the IPsec phase 1 crypto isakmp key configuration on each router specifies the expected SRC IP for authenticating peers, this therefore needs to be configured on R-GLA and R-EDI routers with the R-LON NAT’d IP address 42.203.67.19.

*crypto isakmp policy 10 encr aes hash sha256 authentication pre-share group 5 crypto isakmp key **** address 42.203.67.2 crypto isakmp key **** address 42.203.67.19 ! ! crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac mode transport ! crypto ipsec profile DMVPN-IPSEC set transform-set TSET*

Alternatively, a wildcard 0.0.0.0 address could be used to allow any peer to authenticate with a single key…

crypto isakmp key ** address 0.0.0.0**

As ever, feel free to DM me if you have any questions or need more info on this type of DMVPN/IPsec setup. Please remember to like and share my channel if you find this content useful.

NOTE: all site & device names and IP addresses have been obfuscated for security.