DMVPN with a Single Hub

What it is

DMVPN builds a hub and spoke VPN where spokes can also create direct tunnels to each other on demand.

It combines four things.

• mGRE gives one tunnel interface that reaches many peers.
• NHRP maps tunnel addresses to public addresses.
• IPsec protects the tunnels.
• A routing protocol shares the networks.

The result scales well, because a new spoke needs only its own configuration and the hub needs no change.

How it works

The hub learns each spoke's public address through NHRP, and spokes ask the hub where to find each other.

GRE, mGRE and NHRP

A normal GRE tunnel has one fixed destination. An mGRE tunnel has no fixed destination, so one interface can send to many peers.

NHRP works like ARP for tunnels. Each spoke registers its tunnel address and public (NBMA) address with the hub, which is the next hop server (NHS). The hub keeps the mapping table.

Hub configuration

Hub(config)# interface Tunnel0
Hub(config-if)# ip address 172.16.0.1 255.255.255.0
Hub(config-if)# ip nhrp network-id 1
Hub(config-if)# ip nhrp map multicast dynamic
Hub(config-if)# tunnel source GigabitEthernet0/0
Hub(config-if)# tunnel mode gre multipoint
Hub(config-if)# tunnel protection ipsec profile DMVPN-PROF

The ip nhrp map multicast dynamic line makes the hub send multicast, such as routing hellos, to every spoke that registers. This is how routing neighbours form dynamically.

Spoke configuration

Spoke1(config)# interface Tunnel0
Spoke1(config-if)# ip address 172.16.0.2 255.255.255.0
Spoke1(config-if)# ip nhrp network-id 1
Spoke1(config-if)# ip nhrp nhs 172.16.0.1
Spoke1(config-if)# ip nhrp map 172.16.0.1 203.0.113.1
Spoke1(config-if)# ip nhrp map multicast 203.0.113.1
Spoke1(config-if)# tunnel source GigabitEthernet0/0
Spoke1(config-if)# tunnel mode gre multipoint
Spoke1(config-if)# tunnel protection ipsec profile DMVPN-PROF

The spoke maps the hub tunnel address to the hub public address, here 203.0.113.1. It also sends multicast to the hub. A spoke that only talks to the hub, as in phase 1, can use a point to point GRE tunnel with a tunnel destination instead.

IPsec protection

The profile is applied to the tunnel interface, and it needs an IKE policy, a key and a transform set.

Hub(config)# crypto isakmp policy 10
Hub(config-isakmp)# encryption aes
Hub(config-isakmp)# authentication pre-share
Hub(config)# crypto isakmp key MYKEY address 0.0.0.0 0.0.0.0
Hub(config)# crypto ipsec transform-set TS esp-aes esp-sha-hmac
Hub(cfg-crypto-trans)# mode transport
Hub(config)# crypto ipsec profile DMVPN-PROF
Hub(ipsec-profile)# set transform-set TS

The key is matched against any peer address, because spoke public addresses may be unknown or change. Both ends must have the same policy and key.

Dynamic routing and the phases

A routing protocol runs across the tunnel. The hub learns spoke networks, and passes them on to the other spokes.

For phase 3, the hub gets ip nhrp redirect and the spokes get ip nhrp shortcut. The hub tells a spoke that a better path exists, and the spokes then build a direct tunnel and install an NHRP route.

With EIGRP on the hub, split horizon must be off, and for phase 2 the next hop must not be changed.

Hub(config-if)# no ip split-horizon eigrp 100
Hub(config-if)# no ip next-hop-self eigrp 100

With OSPF, the tunnel is usually set to the broadcast network type. The hub must be the DR, so spokes use priority 0. With BGP, the hub can accept spokes without listing each one by using a bgp listen range peer group, a form of dynamic neighbour.

Verifying

Hub# show dmvpn
Hub# show ip nhrp
Hub# show crypto isakmp sa
Hub# show crypto ipsec sa

show dmvpn lists each peer, its NBMA address and the state. A state of UP means the tunnel is working. Other states, such as IKE or NHRP, mean the peer has not yet reached UP, so check the IPsec and NHRP steps.