Introduction. In this blog, I aim to go a little deeper into how the different DMVPN phases work and how to properly configure the routing. DMVPN Explained. DMVPN stands for Dynamic Multipoint VPN and it is an effective solution for dynamic secure overlay networks. In short. Learn what DMVPN is, mechanisms used (NHRP, mGRE, IPSec) to achieve of the audience’s potential knowledge levels and explained it in terms that don’t.

Author: Ganris Gardakinos
Country: Sierra Leone
Language: English (Spanish)
Genre: Personal Growth
Published (Last): 27 March 2015
Pages: 306
PDF File Size: 7.89 Mb
ePub File Size: 13.61 Mb
ISBN: 390-3-55719-520-1
Downloads: 62930
Price: Free* [*Free Regsitration Required]
Uploader: Tekora

If you continue to use this site we will assume that you are happy with ecplained. In our diagram below, this is network Share on Google Plus Share.

When there is traffic between the branch offices, we can tunnel it directly instead of sending it through the HQ router. Share on Facebook Share. Above we have two spoke routers NHRP clients which establish a tunnel to the hub router. The HQ for example has one tunnel with each branch office as its destination. This means that there will be no direct spoke-to-spoke communication, all traffic has to go through the hub!

Lastly, traffic between spokes in a point-to-point GRE VPN network must pass through the hub, wasting valuable bandwidth and introducing unnecessary bottlenecks. At this point, the spokes can now modify their routing table entries to reflect the NHRP shortcut route and use it to reach the remote spoke.

More Lessons Added Every Week! Continue reading in our forum. An article by Fabio Semperboni Tutorial. All tunnel interfaces are part of the same network.


This is great, we only required the hub to figure out what the public IP address is and all traffic explainned be sent from spoke to spoke directly. Ask a question or join the discussion by visiting our Community Forum.

Understanding Cisco DMVPN | CiscoZine

Initially, and that is the key word all spoke to spoke packets are switched across the hub. In phase 2, all spoke routers use multipoint GRE tunnels so we do have direct spoke to spoke tunneling.

Right now we have a hub and spoke topology. The disadvantage of phase 1 is that there is no direct spoke to spoke tunnels.

Introduction to DMVPN

Web Vulnerability Scanner Free Download. Hello Lagapides Thank you so much for your time.

Because all spoke-to-spoke traffic in DMVPN Phase1 always traverses the hub, it is actually inefficient to even send the entire routing table from the hub to the spokes. Share on LinkedIn Share. The flexibility, stability and easy setup it provides are second-to-none, making it pretty much the best VPN solution available these days for any type of network. Share on Twitter Tweet. The request gets forwarded from HUB to Spoke3.

I understand the differences between the three, but do we gain any benefit from implementing one or the other that is noticeable to end users? Follow Us on Twitter!

Send this to a friend Your email Recipient email Send Cancel. Join us on Facebbook! Full Access to our Lessons. Unified Communications Components – Understanding Your Join us on Youtube! Since our traffic has to go through the hub, our routing configuration will be quite simple.


Understanding Cisco DMVPN

Cisco DMVPN uses a centralized architecture to provide easier implementation and management for deployments that require granular access controls for diverse user communities, including mobile workers, telecommuters, and extranet users. Looking at the process in more detail, when using Phase 3.

We use cookies to give you the best personal experience on our website. The Hub router undertakes the role of the server while the spoke routers act as the clients.

DMVPN provides a number of benefits which have helped make them very popular and highly recommended. Allow spokes to build a spoke-to-spoke tunnel on demand with these restrictions: In addition, the hub router has three GRE tunnels configured, one for each spoke, making the overall configuration more complicated.

On the GRE multipoint tunnel interface we use a single subnet with the following private IP addresses:. With mGRE, all spokes are configured with only one tunnel interface, no matter how many spokes they can connect to.

When we use them, our picture could look like this:. In both cases, the Hub router is assigned a static public IP Address while the branch routers spokes can be assigned static or dynamic public IP addresses.

The hub is the only router that is using a multipoint GRE interface, all spokes will be using regular point-to-point GRE tunnel interfaces.