heres a (final/working) config in case anyone else wants to do this:
crypto ikev2 proposal gcp-ikev2-proposal-1
encryption aes-cbc-128 aes-cbc-192 aes-cbc-256
integrity sha1 sha256 sha384 sha512
group 2 5 14 15 16
crypto ikev2 policy gcp-ikev2-policy-1
match fvrf any
crypto ikev2 profile gcp-ikev2-profile-1
match identity remote address gcp.gcp.gcp.gcp 255.255.255.255
identity local address me.me.me.me
authentication remote pre-share key xxxxxxxxxxxx
authentication local pre-share key xxxxxxxxxxxx
crypto ipsec transform-set gcp-tset-1 esp-aes esp-sha-hmac
crypto ipsec profile gcp-ipsec-profile-1
set transform-set gcp-tset-1
set pfs group14
set ikev2-profile gcp-ikev2-profile-1
ip address 169.254.0.2 255.255.255.252
tunnel source me.me.me.me
tunnel mode ipsec ipv4
tunnel destination gcp.gcp.gcp.gcp
tunnel protection ipsec profile gcp-ipsec-profile-1
And then configure BGP or maybe static routes as required.
After adding in the Tunnel0 interface config it just started working
straight away. So I guess my config was right all along, its just some
other aspect of IPSEC that wasnt happy with something missing… Yay
misleading debug output. :-/
Hope that helps someone else.
“We further estimate that an academic team can break a 768-bit prime and that a nation-state can break a 1024-bit prime. Breaking the single, most common 1024-bit prime used by web servers would allow passive eavesdropping on connections to 18% of the Top 1 Million HTTPS domains. A second prime would allow passive decryption of connections to 66% of VPN servers and 26% of SSH servers. A close reading of published NSA leaks shows that the agency’s attacks on VPNs are consistent with having achieved such a break”.
Dit zijn de encryptie sterkte van de DH groepen:
- DH Group 1: 768-bit group
- DH Group 2: 1024-bit group
- DH Group 5: 1536-bit group
- DH Group 14: 2048-bit group
- DH Group 15: 3072-bit group
- DH Group 19: 256-bit elliptic curve group
- DH Group 20: 384-bit elliptic curve group
The IANA AS Numbers registry has been updated to reflect the allocation of the following block to ARIN in April 2015:
64198-64296 Assigned by ARIN 2015-04-29
394240-395164 Assigned by ARIN 2015-04-29
You can find the IANA AS Numbers registry at:
The allocation was made in accordance with the Policy for Allocation of ASN Blocks to Regional Internet Registries:
Take a look on this page (Cisco didn’t update it with new models for a long time ) http://www.cisco.com/c/en/us/
The 1002 is limited to 12K
We didnt test the 1002-x but on a 1004 with ESP-20 and RP2 we cross the 32K L2TP sessions without a problem (48K and even 64K for short time ) but it is not recommended to cross the limits
> BTW, any ideas on the first question? 🙂 that is, realistic numbers
> of active broadband users on a 1002 with a 24K license?
> > You may actually want to look at summarizing this. The best practice
> > be to have a per-LNS pool (either locally managed or from RADIUS)
> > and advertise the summary from the LNS up to the network.
> > You may need to redistribute also connected routes for “fixed IP”
> > where a user may have a custom IP from the RADIUS.
> > Not summarizing means that every connection (and disconnection) is a
> > BGP update driving your CPU utilization across the BGP domain…
> >> Secondly, how does one handle running two LNS servers? How does the
> >> border router know which edge (LNS) to forward too for a particular
> >> IP?
> > I do it with iBGP where my router is advertising individual /32’s.
> > Yes it makes the route tables longer but it works well in my environment.
> > YMMV.
Under each Ethernet service instance you can define the following.
1) What frames arriving from the trunk port are to be associated with the particular service instance.
-that is accomplished with the “encapsulation” command.
-in your case “encapsulation dot1q 1048” dictates that service instance 10 will accept only frames with top VLAN tag 1048 followed by any subsequent VLAN tag(s) or data(IP packet).
2) Ingres VLAN tag manipulation removing, adding or translating 1 or 2 topmost tags.
-that is accomplished with the “rewrite” command.
-in your case pop-ing the first/single topmost VLAN tag.
3) Bridging operation aka what to do next with the frame (complete frame i.e. data and possibly adjacent/remaining VLAN tags).
-that is accomplished with the “bridge-domain” command.
– in your case the frame ends within bridge-domain 10.
IP interface for bridge-domain 10 is interface vlan 10.
But as Pshem already mentioned IP operation can be done only on untagged frames.
Though I don’t understand, how the service is supposed to operate, from your other email.
Because if the provider is creating a platform for the hub and spoke setup than they are responsible for pop-ing the top tag 1048.
> I am trying to configure an interface on a ME3600 to accept Q in Q
> from a provider. The p-vlan the provider is using is 1048 and they are
> carrying customer vlans (c-vlan) 1058-1098, one from each site. I’m
> new to the 3600 and have not done Q in Q on it yet. I’ve worked up
> this much of the config but it does not seem right. Can anyone give me
> some pointers or links to help me along ? I’ve only got one customer site configed, there will be 14.
> vlan 1048
> name WINDSTREAM
> vlan 1058
> name WINDSTREAM-HOBBS
> interface GigabitEthernet0/6
> description Windstream VLS IP.LVXX.xxxxxx..WCI.001 port-type nni
> switchport trunk allowed vlan none switchport mode trunk service
> 10 ethernet
> encapsulation dot1q 1048
> rewrite ingress tag pop 1 symmetric
> bridge-domain 10
> interface Vlan1048
> description Windstream VLS
> no ip address
> interface Vlan1058
> description WINDSTREAM-HOBBS
> ip address xxx.xx.xx.1 255.255.255.0