If your match acl permits the traffic you just need reverse route injection on the dynamic-map and redistribute static into MP-BGP.
-----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Randy Sent: Tuesday, July 10, 2012 7:52 PM To: cisco-nsp; ar Subject: Re: [c-nsp] IPSEC Hub and Spoke - Single crypto profile, Multiple dynamic-map why am I thinking same security traffic permit intra-interface ./Randy --- On Tue, 7/10/12, ar <[email protected]> wrote: > From: ar <[email protected]> > Subject: [c-nsp] IPSEC Hub and Spoke - Single crypto profile, Multiple > dynamic-map > To: "cisco-nsp" <[email protected]> > Date: Tuesday, July 10, 2012, 4:43 PM > > > Hi. > > I am trying to setup a dynamic IPSEC remote access for > MPLS VPNs. > > Setup is; > > - one 7200 as VPN concentrator > - mulitple remote CPE connected via 3G Internet doing IPSEC > with the concentrator > > Objective is: > - Remote CPE LAN to another remote CPE LAN traffic > > > My config is a single Phase 1, but mulitple Phase 2. > > Is it possible to have inter-site traffic via the hub using > the same IPSEC tunnel? > Or it has to be different tunnel per site? > > > > > > VPN Concentrator Config: > > crypto keyring custC-key vrf FVRF-C > pre-shared-key address 0.0.0.0 0.0.0.0 key customerC > > crypto isakmp policy 1 > encr 3des > authentication pre-share > group 2 > > > crypto isakmp profile custC-profile > vrf VRF-C > keyring custC-key > match identity address 0.0.0.0 FVRF-C > > crypto dynamic-map custC-map 10 > set transform-set IPSEC > set isakmp-profile custC-profile > match address 104 > > crypto dynamic-map custC-map 20 > set transform-set IPSEC > set isakmp-profile custC-profile > match address 105 > > crypto dynamic-map custC-map 30 > set transform-set IPSEC > set isakmp-profile custC-profile > match address 106 > > crypto dynamic-map custC-map 40 > set transform-set IPSEC > set isakmp-profile custC-profile > match address 108 > > crypto dynamic-map custC-map 50 > set transform-set IPSEC > set isakmp-profile custC-profile > match address 109 > > > Comments? > > thanks > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ ----- No virus found in this message. Checked by AVG - www.avg.com Version: 10.0.1424 / Virus Database: 2437/5124 - Release Date: 07/10/12 _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
