HQ-EDGE
en
conf t
hostname HQ-EDGE
enable secret P@ssw0rd!
username admin secret P@ssw0rd! pri 15
line vty 0 4
login local
transport input ssh
banner "Authorized access only"
ip domain-name local
crypto key gen rsa mod 1024
ip ssh version 2
ip vrf CORP
int g0/0
ip add 100.64.10.2 255.255.255.252
no shu
int g0/1
ip add 100.64.10.6 255.255.255.252
no shu
int g0/2
ip vrf forwarding CORP
ip add 10.10.200.1 255.255.255.252
no shu
int g0/3
ip vrf forwarding CORP
ip add 10.10.200.5 255.255.255.252
no shu
int loop0
ip add 10.10.0.1 255.255.255.255
no shu
! BGP
ip route 10.255.0.11 255.255.255.255 100.64.10.1
ip route 10.255.0.12 255.255.255.255 100.64.10.5
router bgp 65100
bgp log-neighbor-changes
neighbor 10.255.0.11 remote-as 65000
neighbor 10.255.0.11 ebgp-multihop
neighbor 10.255.0.11 password P@ssw0rd!
neighbor 10.255.0.11 update-source Loopback0
neighbor 10.255.0.11 maximum-prefix 1 warning-only
neighbor 10.255.0.12 remote-as 65000
neighbor 10.255.0.12 ebgp-multihop
neighbor 10.255.0.12 password P@ssw0rd!
neighbor 10.255.0.12 update-source Loopback0
neighbor 10.255.0.12 maximum-prefix 1 warning-only
network 203.0.114.200 mask 255.255.255.255
network 100.64.10.0 mask 255.255.255.252
network 100.64.10.4 mask 255.255.255.252
exit
! Tunnel
crypto isakmp policy 100
encr aes
authentication pre-share
group 2
crypto isakmp key P@ssw0rd! address 0.0.0.0
crypto ipsec transform-set TRANS esp-aes 256 esp-md5-hmac
mode transport
crypto ipsec profile VPN
set transform-set TRANS
interface Tunnel100
ip vrf forwarding CORP
ip address 10.10.100.1 255.255.255.0
no ip redirects
ip nhrp authentication P@ssw0rd
ip nhrp map multicast dynamic
ip nhrp network-id 999
tunnel source Loopback0
tunnel mode gre multipoint
tunnel key 999
tunnel protection ipsec profile VPN
! EIGRP
key chain EIGRP
key 100
key-string P@ssw0rd!
router eigrp CORP
address-family ipv4 unicast vrf CORP autonomous-system 100
af-interface Tunnel100
authentication key-chain EIGRP
authentication mode md5
exit-af-interface
af-interface g0/2
authentication key-chain EIGRP
authentication mode md5
exit-af-interface
af-interface g0/3
authentication key-chain EIGRP
authentication mode md5
exit-af-interface
topology base
redistribute static
no default-information out
network 10.10.50.0 0.0.0.255
network 10.10.200.0 0.0.0.3
network 10.10.200.4 0.0.0.3
exit-address-family
! NAT
ip access-list extended NAT
permit ip 10.0.0.0 0.255.255.255 any
deny ip host 10.10.0.1 any
deny ip host 10.10.0.2 any
ip nat pool NAT 203.0.114.200 203.0.114.200 netmask 255.255.255.0
ip nat inside source list NAT pool NAT vrf CORP overload
int range g0/0-1
ip nat outside
int range g0/2-3, tun 100
ip nat inside
track 1 interface GigabitEthernet0/0 line-protocol
track 2 interface GigabitEthernet0/1 line-protocol
ip route vrf CORP 0.0.0.0 0.0.0.0 10.255.0.11 global track 1
ip route vrf CORP 0.0.0.0 0.0.0.0 10.255.0.12 global track 2
ip route 203.0.114.200 255.255.255.255 null 0
BR-EDGE
en
conf t
hostname BR-EDGE
enable secret P@ssw0rd!
username admin secret P@ssw0rd! pri 15
line vty 0 4
login local
transport input ssh
banner "Authorized access only"
ip domain-name local
crypto key gen rsa mod 1024
ip ssh version 2
ip vrf CORP
int g0/0
ip add 100.64.20.2 255.255.255.252
no shu
int g0/1
ip vrf forwarding CORP
ip add 10.10.50.254 255.255.255.0
no shu
int loop0
ip add 10.10.0.2 255.255.255.255
no shu
! BGP
ip route 10.255.0.12 255.255.255.255 100.64.20.1
ip route 10.10.0.1 255.255.255.255 10.255.0.12
router bgp 65100
bgp log-neighbor-changes
neighbor 10.255.0.12 remote-as 65000
neighbor 10.255.0.12 ebgp-multihop
neighbor 10.255.0.12 password P@ssw0rd!
neighbor 10.255.0.12 update-source Loopback0
neighbor 10.255.0.12 maximum-prefix 1
network 100.64.20.0 mask 255.255.255.252
exit
! Tunnel
crypto isakmp policy 100
encr aes
authentication pre-share
group 2
crypto isakmp key P@ssw0rd! address 0.0.0.0
crypto ipsec transform-set TRANS esp-aes 256 esp-md5-hmac
mode transport
crypto ipsec profile VPN
set transform-set TRANS
interface Tunnel100
ip vrf forwarding CORP
ip address 10.10.100.2 255.255.255.0
no ip redirects
ip nhrp authentication P@ssw0rd
ip nhrp nhs 10.10.100.1
ip nhrp map 10.10.100.1 10.10.0.1
ip nhrp map multicast 10.10.0.1
ip nhrp network-id 999
tunnel source Loopback0
tunnel mode gre multipoint
tunnel key 999
tunnel protection ipsec profile VPN
exit
! DHCP
ip dhcp excluded-address 10.10.50.0 10.10.50.49
ip dhcp excluded-address 10.10.50.201 10.10.50.255
ip dhcp pool VLAN50
vrf CORP
network 10.10.50.0 255.255.255.0
default-router 10.10.50.254
! EIGRP
key chain EIGRP
key 100
key-string P@ssw0rd!
router eigrp CORP
address-family ipv4 unicast vrf CORP autonomous-system 100
af-interface Tunnel100
authentication key-chain EIGRP
authentication mode md5
exit-af-interface
eigrp stub connected summary
network 10.10.50.0 0.0.0.255
network 10.10.100.0 0.0.0.255
exit-address-family