!
! SOLUTION CONFIG — HUB-WC-1 (DMVPN Phase 3 Hub)
! Blueprint: §3.2.a DMVPN Phase 3 with dual-hub
!
version 17.6
service timestamps log datetime msec
service timestamps debug datetime msec
service password-encryption
no ip domain lookup
ip routing
logging buffered 64000
!
hostname HUB-WC-1
!
enable algorithm-type scrypt secret Lab@2024#EI
!
key chain KC-EIGRP-AUTH
 key 1
  key-string Tz4!vR8#wL
  cryptographic-algorithm hmac-sha-256
!
interface Loopback0
 description Router-ID
 ip address 10.255.4.1 255.255.255.255
 no shutdown
!
interface GigabitEthernet1
 description Underlay uplink to EDGE-2
 ip address 10.0.210.1 255.255.255.254
 no shutdown
!
! DMVPN Phase 3 tunnel (§3.2.a)
interface Tunnel0
 description DMVPN-WEST Phase 3 Hub
 ip address 172.16.10.254 255.255.255.0
 ! mGRE enables dynamic spokes (§3.2.a)
 tunnel mode gre multipoint
 tunnel source GigabitEthernet1
 ! NHS points to self — hub registers here
 ip nhrp network-id 10
 ip nhrp authentication Jm5#bQ9@nW
 ! redirect enables Phase 3 shortcut routing
 ip nhrp redirect
 ! map multicast to dynamic for spoke discovery
 ip nhrp map multicast dynamic
 !
 ! Per-tunnel QoS (§3.2.a.iii)
 tunnel key 100
 !
 ! IPsec IKEv2 profile binding (§3.2.a.ii)
 tunnel protection ipsec profile DMVPN-WEST-IPSEC
 !
 ip summary-address eigrp 100 10.255.4.0 255.255.255.0
 no shutdown
!
! IKEv2 configuration (§3.2.a.ii)
crypto ikev2 proposal DMVPN-PROP
 encryption aes-cbc-256
 integrity sha256
 group 14
!
crypto ikev2 policy DMVPN-POL
 proposal DMVPN-PROP
!
crypto ikev2 keyring DMVPN-KEYS
 peer ANY
  address 0.0.0.0 0.0.0.0
  pre-shared-key Kp7$rV2@mN
!
crypto ikev2 profile DMVPN-IKE
 match identity remote address 0.0.0.0
 identity local address 10.0.210.1
 authentication remote pre-share
 authentication local pre-share
 keyring local DMVPN-KEYS
!
crypto ipsec transform-set DMVPN-TS esp-aes 256 esp-sha256-hmac
 mode transport
!
crypto ipsec profile DMVPN-WEST-IPSEC
 set transform-set DMVPN-TS
 set ikev2-profile DMVPN-IKE
!
! EIGRP Named Mode over DMVPN (§1.3.e)
router eigrp ENTERPRISE
 address-family ipv4 unicast autonomous-system 100
  af-interface Tunnel0
   authentication mode hmac-sha-256
   authentication key-chain KC-EIGRP-AUTH
   ! no split-horizon on hub for DMVPN
   no split-horizon
   hello-interval 20
   hold-time 60
  !
  af-interface Loopback0
   passive-interface
  !
  topology base
  !
  network 172.16.10.0 0.0.0.255
  network 10.255.4.1 0.0.0.0
  network 10.0.210.0 0.0.0.1
  eigrp router-id 10.255.4.1
 !
!
line vty 0 15
 transport input ssh
!
end