! R-HUB-01 end state after svpn-dmvpn-implementation (Implement DMVPN: mGRE, NHRP & IPsec Protection).
! Captured with `show running-config | exclude ^!|^ *$` on IOSv 15.9(3)M12 in CML at 10.82.22.170,
! 2026-09-26, lab seclab-svpn-dmvpn-flexvpn (labs/SVPN/blueprint.yaml, svpn-extension-v1).
! The three IOSv licence banners are omitted; nothing else is edited. Secrets are type 9 hashes of the
! lab-only password; the IKEv2 pre-shared key is the lab key the lesson prints.
! This is the state svpn-flexvpn-local-aaa starts from.
version 15.9
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname R-HUB-01
boot-start-marker
boot-end-marker
enable secret 9 $9$NCw8Gtm8yESiat$tbs3khLpXNNFcibTHRZA9dNBFbk.l3Y/HMGkZE2PUEA
no aaa new-model
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
no ip domain lookup
ip domain name securitylessons.lab
ip cef
no ipv6 cef
multilink bundle-name authenticated
username admin privilege 15 secret 9 $9$v3kQXNF/bJ0WF7$/MPafJZHWpU86o32gmcxxHJBAbgH3friIzN/eUfI32.
redundancy
crypto ikev2 proposal PROP-DMVPN 
 encryption aes-cbc-256
 integrity sha256
 group 19
crypto ikev2 policy POL-DMVPN 
 proposal PROP-DMVPN
crypto ikev2 keyring KR-DMVPN
 peer ANY-SPOKE
  address 0.0.0.0 0.0.0.0
  pre-shared-key SVPN-lab-DMVPN-psk
 !
crypto ikev2 profile IKEV2-DMVPN
 match identity remote address 0.0.0.0 
 authentication remote pre-share
 authentication local pre-share
 keyring local KR-DMVPN
crypto ipsec transform-set TS-DMVPN esp-aes 256 esp-sha256-hmac 
 mode transport
crypto ipsec profile IPSEC-DMVPN
 set transform-set TS-DMVPN 
 set ikev2-profile IKEV2-DMVPN
interface Loopback10
 description HQ servers prefix
 ip address 10.10.10.254 255.255.255.0
interface Tunnel0
 description DMVPN hub - NHRP next-hop server
 ip address 10.255.10.254 255.255.255.0
 no ip redirects
 ip mtu 1400
 ip nhrp network-id 10
 ip nhrp redirect
 ip summary-address eigrp 100 10.0.0.0 255.0.0.0
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 tunnel key 10
 tunnel protection ipsec profile IPSEC-DMVPN
interface GigabitEthernet0/0
 description perimeter transit
 ip address 198.51.100.10 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
interface GigabitEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
router eigrp 100
 network 10.10.10.0 0.0.0.255
 network 10.255.10.0 0.0.0.255
ip forward-protocol nd
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 198.51.100.254
ipv6 ioam timestamp
control-plane
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
 login
 transport input none
no scheduler allocate
end