hostname Lideta-GezahagnBranch
!
ntp authentication-key 10 md5 0478292321157C 7
ntp authenticate
ntp trusted-key 10
ntp server [Link]
ntp server [Link] prefer
!
interface Tunnel103
description DMVPN to DR-ER11, AA South(3)
ip address 10.220.x.x [Link]
no ip redirects
ip mtu 1400
ip nhrp authentication CBE
ip nhrp map [Link] [Link]
ip nhrp map multicast [Link]
ip nhrp network-id 103
ip nhrp holdtime 600
ip nhrp nhs [Link]
ip tcp adjust-mss 1360
tunnel source BVI1
tunnel destination [Link]
tunnel key 103
tunnel path-mtu-discovery
tunnel protection ipsec profile CBE-IPSec-CA-Profile shared
!
interface Tunnel203
description DMVPN to DR-ER12, AA South(3)
ip address 10.220.x.x [Link]
no ip redirects
ip mtu 1400
ip nhrp authentication CBE
ip nhrp map [Link] [Link]
ip nhrp map multicast [Link]
ip nhrp network-id 203
ip nhrp holdtime 600
ip nhrp nhs [Link]
ip tcp adjust-mss 1360
tunnel source BVI1
tunnel destination [Link]
tunnel key 203
tunnel path-mtu-discovery
tunnel protection ipsec profile CBE-IPSec-CA-Profile shared
!
interface Tunnel303
description DMVPN to DC-ER21, AA South(3)
ip address 10.220.x.x [Link]
no ip redirects
ip mtu 1400
ip nhrp authentication CBE
ip nhrp map [Link] [Link]
ip nhrp map multicast [Link]
ip nhrp network-id 303
ip nhrp holdtime 600
ip nhrp nhs [Link]
ip tcp adjust-mss 1360
tunnel source BVI1
tunnel destination [Link]
tunnel key 303
tunnel path-mtu-discovery
tunnel protection ipsec profile CBE-IPSec-CA-Profile shared
!
interface Tunnel403
description DMVPN to DC-ER22, AA South(3)
ip address 10.220.x.x [Link]
no ip redirects
ip mtu 1400
ip nhrp authentication CBE
ip nhrp map [Link] [Link]
ip nhrp map multicast [Link]
ip nhrp network-id 403
ip nhrp holdtime 600
ip nhrp nhs [Link]
ip tcp adjust-mss 1360
tunnel source BVI1
tunnel destination [Link]
tunnel key 403
tunnel path-mtu-discovery
tunnel protection ipsec profile CBE-IPSec-CA-Profile shared
!
!
router bgp 64520
bgp router-id Loopbck IP
bgp log-neighbor-changes
neighbor EDGE-ROUTERS peer-group
neighbor EDGE-ROUTERS remote-as 64520
neighbor EDGE-ROUTERS password 7 0508040A32494D1B1C11
neighbor [Link] peer-group EDGE-ROUTERS
neighbor [Link] peer-group EDGE-ROUTERS
neighbor [Link] peer-group EDGE-ROUTERS
neighbor [Link] peer-group EDGE-ROUTERS
!
address-family ipv4
network Loopback Ip mask [Link]
neighbor [Link] activate
neighbor [Link] activate
neighbor [Link] activate
neighbor [Link] activate
exit-address-family
!
!
ip route [Link] [Link] Wan IP 250
ip route Loopback Ip [Link] Null0
ip route [Link] [Link] Wan IP////last octet-3
ip route [Link] [Link] Wan IP
ip route [Link] [Link] Wan IP
ip route [Link] [Link] Wan IP
ip route [Link] [Link] Wan IP
ip route [Link] [Link] Wan IP
ip route [Link] [Link] Wan IP
ip tacacs source-interface Loopback0
!
object-group service BGP-SERVICE
tcp eq bgp
tcp source eq bgp
!
object-group network CBE-MGMT-IP
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
!
object-group service CBE-MGMT-SERVICE
tcp eq 22
icmp echo
icmp echo-reply
udp eq snmp
udp source eq snmp
udp eq ntp
udp source eq ntp
!
object-group service DMVPN-SERVICE
udp eq isakmp
udp eq non500-isakmp
esp
gre
ahp
!
object-group network ETC-MGMT-IP
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
!
object-group service ETC-MGMT-SERVICE
icmp echo
icmp echo-reply
!
object-group network IPSEC-ENDPOINT
[Link] [Link]
!
object-group network LOCAL-WANIP
host Wan IP
!
object-group network REMOTE-WANIP
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
[Link] [Link]
!
object-group network ROOT-CA
host [Link]
host [Link]
!
object-group service ROOT-CA-SERVICE
tcp eq www
!
!
ip access-list extended WAN-INBOUND
permit object-group DMVPN-SERVICE object-group IPSEC-ENDPOINT object-
group LOCAL-WANIP
permit object-group CBE-MGMT-SERVICE object-group CBE-MGMT-IP object-
group LOCAL-WANIP
permit object-group ETC-MGMT-SERVICE object-group ETC-MGMT-IP object-
group LOCAL-WANIP
permit object-group ROOT-CA-SERVICE object-group ROOT-CA object-group
LOCAL-WANIP
deny ip any any
!
no ip name-server [Link]
no ip name-server [Link]
!
ip name-server [Link]
ip name-server [Link]
!
no track 1 ip sla 10 reachability
!
no track 2 list boolean and
!
username CBEAdmin privilege 15 secret CBEBR@NETAdmin
!
aaa authorization commands 15 CBEAdmin group DCAdmin local
!
do write
!
interface BVI1
ip access-group WAN-INBOUND in
!