! R-HUB-01 end state after svpn-flexvpn-local-aaa (Implement Site-to-Site FlexVPN with Local AAA Authorization).
! Captured with `show running-config | exclude ^!|^ *$` on IOSv 15.9(3)M12 in CML at 10.82.22.170,
! 2026-09-26, lab seclab-svpn-dmvpn-flexvpn (labs/SVPN/blueprint.yaml, svpn-extension-v1).
! The three IOSv licence banners are omitted; nothing else is edited. Secrets are type 9 hashes of the
! lab-only password; the IKEv2 pre-shared keys are the lab keys the lessons print.
! The DMVPN Tunnel0 from svpn-dmvpn-implementation is kept, shut down, for rollback.
version 15.9
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname R-HUB-01
boot-start-marker
boot-end-marker
enable secret 9 $9$NCw8Gtm8yESiat$tbs3khLpXNNFcibTHRZA9dNBFbk.l3Y/HMGkZE2PUEA
aaa new-model
aaa authorization network FLEX-LOCAL local 
aaa session-id common
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
no ip domain lookup
ip domain name securitylessons.lab
ip cef
no ipv6 cef
multilink bundle-name authenticated
username admin privilege 15 secret 9 $9$v3kQXNF/bJ0WF7$/MPafJZHWpU86o32gmcxxHJBAbgH3friIzN/eUfI32.
redundancy
crypto ikev2 name-mangler NM-HOST
 fqdn hostname
crypto ikev2 authorization policy r-branch-01 
 pool POOL-BR1
 route set interface
 route set access-list ACL-HQ-ROUTES
crypto ikev2 authorization policy r-branch-02 
 pool POOL-BR2
 route set interface
 route set access-list ACL-HQ-ROUTES
crypto ikev2 proposal PROP-DMVPN 
 encryption aes-cbc-256
 integrity sha256
 group 19
crypto ikev2 policy POL-DMVPN 
 proposal PROP-DMVPN
crypto ikev2 keyring KR-DMVPN
 peer ANY-SPOKE
  address 0.0.0.0 0.0.0.0
  pre-shared-key SVPN-lab-DMVPN-psk
 !
crypto ikev2 keyring KR-FLEX
 peer BRANCHES
  identity fqdn domain securitylessons.lab
  pre-shared-key SVPN-lab-FLEX-psk
 !
crypto ikev2 profile IKEV2-DMVPN
 match identity remote address 0.0.0.0 
 authentication remote pre-share
 authentication local pre-share
 keyring local KR-DMVPN
crypto ikev2 profile IKEV2-FLEX-HUB
 match identity remote fqdn domain securitylessons.lab
 identity local fqdn r-hub-01.securitylessons.lab
 authentication remote pre-share
 authentication local pre-share
 keyring local KR-FLEX
 aaa authorization group psk list FLEX-LOCAL name-mangler NM-HOST
 virtual-template 11
crypto ipsec transform-set TS-DMVPN esp-aes 256 esp-sha256-hmac 
 mode transport
crypto ipsec transform-set TS-FLEX esp-aes 256 esp-sha256-hmac 
 mode tunnel
crypto ipsec profile IPSEC-DMVPN
 set transform-set TS-DMVPN 
 set ikev2-profile IKEV2-DMVPN
crypto ipsec profile IPSEC-FLEX
 set transform-set TS-FLEX 
 set ikev2-profile IKEV2-FLEX-HUB
interface Loopback10
 description HQ servers prefix
 ip address 10.10.10.254 255.255.255.0
interface Loopback11
 description FlexVPN tunnel source address (unnumbered)
 ip address 10.255.11.254 255.255.255.255
interface Tunnel0
 description DMVPN hub - NHRP next-hop server
 ip address 10.255.10.254 255.255.255.0
 no ip redirects
 ip mtu 1400
 ip nhrp network-id 10
 ip nhrp redirect
 ip summary-address eigrp 100 10.0.0.0 255.0.0.0
 ip tcp adjust-mss 1360
 shutdown
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 tunnel key 10
 tunnel protection ipsec profile IPSEC-DMVPN
interface GigabitEthernet0/0
 description perimeter transit
 ip address 198.51.100.10 255.255.255.0
 duplex auto
 speed auto
 media-type rj45
interface GigabitEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
 media-type rj45
interface Virtual-Template11 type tunnel
 description FlexVPN hub - one virtual-access per branch
 ip unnumbered Loopback11
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/0
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC-FLEX
router eigrp 100
 network 10.10.10.0 0.0.0.255
 network 10.255.10.0 0.0.0.255
ip local pool POOL-BR1 10.255.11.1
ip local pool POOL-BR2 10.255.11.2
ip forward-protocol nd
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 198.51.100.254
ip access-list standard ACL-HQ-ROUTES
 permit 10.10.10.0 0.0.0.255
 permit 10.20.0.0 0.0.255.255
ipv6 ioam timestamp
control-plane
line con 0
 exec-timeout 0 0
 logging synchronous
line aux 0
line vty 0 4
 transport input none
no scheduler allocate
end