Introduction to DMVPN (2024)

Lesson Contents

DMVPN (Dynamic Multipoint VPN) is a routing technique we can use to build a VPN network with multiple sites without having to statically configure all devices. It’s a “hub and spoke” network where the spokes will be able to communicate with each other directly without having to go through the hub. Encryption is supported through IPsec which makes DMVPN a popular choice for connecting different sites using regular Internet connections. It’s a great backup or alternative to private networks like MPLS VPN. A popular alternative to DMVPN is FlexVPN.

There are four pieces to the DMVPN puzzle:

Multipoint GRE (mGRE)
NHRP (Next Hop Resolution Protocol)
Routing (RIP, EIGRP, OSPF, BGP, etc.)
IPsec (not required but recommended)

Let me explain these different topics…

Multipoint GRE

Our “regular” GRE tunnels are point-to-point and don’t scale well. For example, let’s say we have a company network with some sites that we want to connect to each other using regular Internet connections:

Above we have one router that represents the HQ and there are four branch offices. Let’s say that we have the following requirements:

Each branch office has to be connected to the HQ.
Traffic between Branch 1 and Branch 2 has to be tunneled directly.
Traffic between Branch 3 and Branch 4 has to be tunneled directly.

To accomplish this we will have to configure a bunch of GRE tunnels which will look like this:

Thing will get messy quickly…we have to create multiple tunnel interfaces, set the source/destination IP addresses etc. Itwill work but it’s not a very scalable solution. Multipoint GRE, as the name implies allows us to have multiple destinations. When we use them, our picture could look like this:

NHRP (Next Hop Resolution Protocol)

We need something that helps our branch1router figure out what thepublic IP address is of the branch2 router, we do this with a protocol calledNHRP (Next Hop Resolution Protocol). Here’s an explanation of how NHRP works:

One router will be the NHRP server.
All other routers will be NHRP clients.
NHRP clients register themselves with the NHRP server and report their public IP address.
The NHRP server keeps track of all public IP addresses in its cache.
When one router wants to tunnel something to another router, it will requestthe NHRP server for the public IP address of the other router.

Since NHRP uses this server and clients model, it makes sense to use a hub and spoke topology for multipoint GRE. Our hub router will be the NHRP server and all other routers will be the spokes.

Here’s an an illustration of how NHRP works with multipoint GRE:

Above we have two spoke routers (NHRP clients) which establish a tunnel to the hub router. Later oncewe look at the configurations you will see that the destination IP address of the hub router will be statically configured on the spoke routers. The hub router will dynamically accept spoke routers.The routers will use a NHRP registration request message to register their public IP addresses to the hub.

The hub, our NHRP server will create a mapping between the public IP addresses and the IP addresses of the tunnel interfaces.

A few seconds later, spoke1 decides that it wants to send something to spoke2. It needs to figure out the destination public IP address of spoke2 so it will send a NHRP resolution request, asking the Hub router what the public IP address of spoke 2 is.

The Hub router checks its cache, finds an entry for spoke 2 and sends the NHRP resolution reply to spoke1 with the public IP address of spoke2.

Spoke1now knows the destination public IP address of spoke2 and is able to tunnel something directly. This is great, we only required the hub to figure out what the public IP address is and all traffic can be sent from spoke to spoke directly.

In NHRP terminology, you’ll see that we don’t talk about“public IP addresses” but NBMA addresses. NHRP is an old protocol (the RFC is from 1998) which was originally developed for NBMA networks like frame-relay or ATM.

When we talk about DMVPN, we often refer to an underlay and overlay network:

The underlay network is the network we use for connectivity between the different routers, for example the Internet.
The overlay network is our private network with GRE tunnels.

NHRP is a bit similar to ARP or frame-relay inverse ARP. Instead of mapping L2 to L3 information, we are now mapping a tunnel IP address to a NBMA IPaddress.

DMVPN has different versions which we call phases, there’s three of them:

Phase 1
Phase 2
Phase 3

Let me give you an overview of the three phases:

Phase 1

With phase 1 we use NHRP so that spokes can register themselves with the hub. The hub is the only router that is using a multipoint GRE interface, all spokes will be using regular point-to-point GRE tunnel interfaces. This means that there will be no direct spoke-to-spoke communication, all traffic has to go through the hub!

Since our traffic has to go through the hub, our routing configuration will be quite simple. Spoke routers only need a summary or default route to the hub to reach other spoke routers.

Phase 2

The disadvantage of phase 1 is that there is no direct spoke to spoke tunnels. In phase 2, all spoke routers use multipoint GRE tunnels so we do have direct spoke to spoke tunneling. When a spoke router wants to reach another spoke, it will send an NHRP resolution request to the hub to find the NBMA IPaddress of the other spoke.

There are two requirements to make spoke to spoke tunnels work: