iot.j2

!
crypto isakmp policy 1
 encr aes
 authentication pre-share
 group 2
crypto isakmp key {{ dmvpn.isakmp_key }} address 0.0.0.0        
!
crypto ipsec transform-set TS esp-aes esp-sha-hmac 
 mode tunnel
!
crypto ipsec profile protect-IoT
 set security-association lifetime seconds 86400
 set transform-set TS 
!
{%- for intf in interfaces -%} 
{%   if intf.type is defined and intf.type == "tunnel" %}

interface {{ intf.ifname }}
 description 4G-IoT-Tunnel
 ip address {{ intf.ipv4|ipaddr('address') }} {{ intf.ipv4|ipaddr('netmask') }}
{%   endif %}
{% endfor%}
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/2
{% for intf in hostvars[inventory_hostname].interfaces %}
{%   if intf.role is defined and intf.role == "wan" %}
{%     for n in intf.neighbors %}
 tunnel destination {{ n.ipv4|ipaddr('address') }}
{%     endfor%}
{%   endif %}
{% endfor %}
 tunnel path-mtu-discovery
 tunnel protection ipsec profile protect-IoT
!
{% for tunint in interfaces if tunint.type is defined and tunint.type == "tunnel" %}
{%   for n in tunint.neighbors %}
{%     for intf in hostvars['iotprovider'].interfaces %}
{%       if intf.type is defined and intf.type == "lan" %}
{%       set iotip = intf %}
{%         for intff in hostvars['firewall'].interfaces %}
{%           if intff.type is defined and intff.type == "lan" %}
{%             if inventory_hostname == "iotprovider" %}
ip route {{ intff.ipv4|ipaddr('network') }} {{ intff.ipv4|ipaddr('netmask') }} {{ n.ipv4|ipaddr('address') }} name Prevent_recursive_routing
{%             elif inventory_hostname == "firewall" %}
ip route {{ iotip.ipv4|ipaddr('network') }} {{ iotip.ipv4|ipaddr('netmask') }} {{ n.ipv4|ipaddr('address') }} name Prevent_recursive_routing
{%             endif %}
{%           endif %}
{%         endfor %}
{%       endif %}
{%     endfor%}
{%   endfor%}
{% endfor%}
!