To get a branch router deployed simply log into Prime Infrastructure and go to IWAN Enablement again (Menu – Services – IWAN Enablement).
Hit Next on the intro page and then enter the configuration. For my site I am doing a single router branch. It becomes apparent quiet quickly that the rest of the information is nearly identical to what was needed to set up the DC routers.
|Single Router Branch|
After setting the category and role the rest of the fields are automatically filled. Next will come the device selection.
For the branch locations I decided to do this the hard way. Since I am using new routers they aren’t on the existing network I wanted to try doing an offline configuration. Since you can’t continue without selecting a device I just selected on of the routers I have at the Hub. Before committing the changes to the router I will just copy the CLI commands and run them on the router.
Most of the DMVPN fields should be familiar:
The loopback is just a local /32 address. Internet bandwidth is in Kb, not KB, so that’s easy enough. The tunnel IP needs to be on the same subnet as the Internet tunnel IP from the HQ side. The Internet Hub Tunnel IP is the IP that was assigned to the tunnel interface from the Internet Hub deployment. The interface is the router interface that will connect to the ISP. Lastly, the pre-shared key is the DMVPN key that was set on the hub router.
The MPLS fields are essentially the same as the Internet fields, but with the MPLS addressing.
Under the Internet WAN section you will enter the public IP address that will be assigned to the router, and the same applies for the subnet mask and gateway. Now, according to Cisco’s documentation, the remote DMVPN router supports a dynamic address, but the wizard requires an IP address assigned. I presume this can be cleaned up in the CLI after the deployment.
Again, the MPLS WAN settings are self explanatory. Enter the IP, mask, and gateway. If you are unsure of this information for either the MPLS or Internet interface contact your ISP.
The last section for the DMVPN is the EIGRP settings. For the LAN subnet you would enter the LAN subnet that will be at the remote site. The wizard doesn’t allow multiple subnets to be entered, but they can be added via the CLI later.
When complete, click Apply, then Next. This will bring up the PfR settings. Enter it IP of the Master Controller and the PfR password. Again, click Apply and Next
The next page will be the QoS settings. The wizard asks for the interfaces for Internet, LAN, and MPLS, as well as bandwidth.
There are a few things to be aware of- QoS Marking LAN Interface is the inside interface. When entering the interface names spelling counts. I would recommend just copying the interface name from the router CLI to eliminate the risk of typos. The Device Type field needs to be left with “Product Series” as the value. Finally, select the bandwidth that is the closest match to what you have, and again, this is Mbps, not MBPS.
Click Next through the AVS settings, then review the CLI Summary. As I mentioned, I did an offline config, so I essentially copied the CLI summary to the router CLI. One thing the be aware of is that if the CLI commands are copied it should be done is small batches. There may be issues with commands, and it’s much easier to spot issues if it’s in small chunks. If you are doing an online config then the deployment can be scheduled and confirmed.
If all goes according to plan, the deployment should go without issue. When it finishes make sure to save the config (unless that was selected as part of the deployment options. Then I would reload the router so it can come up with the new config.
In theory, when the routers are up the DMVPN should connect, and you should be able to ping the tunnel IP across the tunnels. Then run ‘show ip route’ and verify that routes are being added via EIGRP.
If so, you should be set to move on. If not, well something went wrong. Unfortunately, what the issue is could be one of many. Here are a couple things to try:
- Ping remote public interface
- Ping the remote tunnel interface
- The ‘show int’ command can help identify if interfaces might be down
- It might be worth looking through the running config for any misconfigurations, like mistyped IP addresses, or incorrect masks.
- Traceroute can also be helpful to make sure that things are getting where they need to
- Check the routing table with ‘show ip route’ to verify routes, including the default route, are correct.