! R-BRANCH-02 end state after svpn-flexvpn-local-aaa (Implement Site-to-Site FlexVPN with Local AAA Authorization).
! Captured with `show running-config | exclude ^!|^ *$` on IOSv 15.9(3)M12 in CML at 10.82.22.170,
! 2026-09-26, lab seclab-svpn-dmvpn-flexvpn (labs/SVPN/blueprint.yaml, svpn-extension-v1).
! The three IOSv licence banners are omitted; nothing else is edited. Secrets are type 9 hashes of the
! lab-only password; the IKEv2 pre-shared keys are the lab keys the lessons print.
! The DMVPN Tunnel0 from svpn-dmvpn-implementation is kept, shut down, for rollback.
version 15.9
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname R-BRANCH-02
boot-start-marker
boot-end-marker
enable secret 9 $9$odhRVu/1fyPnvt$8qC6NK7SjLusZs8NfYKHkYtqYR4MkJ/yBnpUw.rGF5Y
aaa new-model
aaa authorization network FLEX-LOCAL local 
aaa session-id common
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
no ip domain lookup
ip domain name securitylessons.lab
ip cef
no ipv6 cef
multilink bundle-name authenticated
username admin privilege 15 secret 9 $9$PDUq7F1yxFzNj7$0fcvneNi/wa2eXoWQQP9AMF.r3TB/SNNt6IG4u.mzIA
redundancy
crypto ikev2 authorization policy default
 route set interface
 route set access-list ACL-BR2-LAN
crypto ikev2 proposal PROP-DMVPN 
 encryption aes-cbc-256
 integrity sha256
 group 19
crypto ikev2 policy POL-DMVPN 
 proposal PROP-DMVPN
crypto ikev2 keyring KR-DMVPN
 peer ANY-SPOKE
  address 0.0.0.0 0.0.0.0
  pre-shared-key SVPN-lab-DMVPN-psk
 !
crypto ikev2 keyring KR-FLEX
 peer R-HUB-01
  address 198.51.100.10
  pre-shared-key SVPN-lab-FLEX-psk
 !
crypto ikev2 profile IKEV2-DMVPN
 match identity remote address 0.0.0.0 
 authentication remote pre-share
 authentication local pre-share
 keyring local KR-DMVPN
crypto ikev2 profile IKEV2-FLEX-SPOKE
 match identity remote fqdn r-hub-01.securitylessons.lab
 identity local fqdn r-branch-02.securitylessons.lab
 authentication remote pre-share
 authentication local pre-share
 keyring local KR-FLEX
 aaa authorization group psk list FLEX-LOCAL default
crypto ipsec transform-set TS-DMVPN esp-aes 256 esp-sha256-hmac 
 mode transport
crypto ipsec transform-set TS-FLEX esp-aes 256 esp-sha256-hmac 
 mode tunnel
crypto ipsec profile IPSEC-DMVPN
 set transform-set TS-DMVPN 
 set ikev2-profile IKEV2-DMVPN
crypto ipsec profile IPSEC-FLEX
 set transform-set TS-FLEX 
 set ikev2-profile IKEV2-FLEX-SPOKE
interface Tunnel0
 description DMVPN spoke - registers with R-HUB-01
 ip address 10.255.10.2 255.255.255.0
 no ip redirects
 ip mtu 1400
 ip nhrp network-id 10
 ip nhrp nhs 10.255.10.254 nbma 198.51.100.10 multicast
 ip tcp adjust-mss 1360
 shutdown
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 tunnel key 10
 tunnel protection ipsec profile IPSEC-DMVPN
interface Tunnel11
 description FlexVPN to R-HUB-01
 ip address negotiated
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/0
 tunnel mode ipsec ipv4
 tunnel destination 198.51.100.10
 tunnel protection ipsec profile IPSEC-FLEX
interface GigabitEthernet0/0
 description branch2-wan
 ip address 192.0.2.6 255.255.255.252
 duplex auto
 speed auto
 media-type rj45
interface GigabitEthernet0/1
 description branch 2 LAN
 ip address 10.20.2.1 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
router eigrp 100
 network 10.20.2.0 0.0.0.255
 network 10.255.10.0 0.0.0.255
ip forward-protocol nd
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 192.0.2.5
ip access-list standard ACL-BR2-LAN
 permit 10.20.2.0 0.0.0.255
ipv6 ioam timestamp
control-plane
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
 transport input none
no scheduler allocate
end