DMVPN Phase 1 BGP Routing
In the first DMVPN lesson I explained some of its basics and in the second lesson I
explained how to create a basic DMVPN phase 1 configuration. We also did a
configuration for each of the IGPs:
DMVPN Phase 1 RIP Routing
DMVPN Phase 1 EIGRP Routing
DMVPN Phase 1 OSPF Routing
This time, we’ll take a look at BGP. Here’s the topology we will use:
Configuration
Tunnel Interfaces
Here’s a basic DMVPN phase 1 configuration:
Hub(config)#interface Tunnel0
Hub(config-if)#ip address [Link] [Link]
Hub(config-if)#ip nhrp authentication DMVPN
Hub(config-if)#ip nhrp map multicast dynamic
Hub(config-if)#ip nhrp network-id 1
Hub(config-if)#tunnel source GigabitEthernet0/1
Hub(config-if)#tunnel mode gre multipoint
Spoke1(config)#interface Tunnel0
Spoke1(config-if)#ip address [Link] [Link]
Spoke1(config-if)#ip nhrp authentication DMVPN
Spoke1(config-if)#ip nhrp map [Link] [Link]
Spoke1(config-if)#ip nhrp map multicast [Link]
Spoke1(config-if)#ip nhrp network-id 1
Spoke1(config-if)#ip nhrp nhs [Link]
Spoke1(config-if)#tunnel source GigabitEthernet0/1
Spoke1(config-if)#tunnel destination [Link]
Spoke2(config)#interface Tunnel0
Spoke2(config-if)#ip address [Link] [Link]
Spoke2(config-if)#ip nhrp authentication DMVPN
Spoke2(config-if)#ip nhrp map [Link] [Link]
Spoke2(config-if)#ip nhrp map multicast [Link]
Spoke2(config-if)#ip nhrp network-id 1
Spoke2(config-if)#ip nhrp nhs [Link]
Spoke2(config-if)#tunnel source GigabitEthernet0/1
Spoke2(config-if)#tunnel destination [Link]
Let’s verify if the tunnels are working:
Hub#show dmvpn | begin 192.168.123.
1 [Link] [Link] UP 00:22:37 D
1 [Link] [Link] UP 00:00:32 D
And do a quick ping:
Hub#ping [Link]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to [Link], timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 6/6/8 ms
Hub#ping [Link]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to [Link], timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 5/6/9 ms
Everything seems to be working, time to configure BGP.
eBGP with different AS on the spokes
There are a number of variations we can choose from:
eBGP with a different AS number on each spoke.
eBGP with the same AS number on each spoke.
iBGP
We’ll take a look at all the different options, we’ll start with eBGP with the same AS
number on all spokes:
Hub(config)#router bgp 65001
Hub(config-router)#neighbor [Link] remote-as 65002
Hub(config-router)#neighbor [Link] remote-as 65003
Hub(config-router)#network [Link] mask [Link]
Spoke1(config)#router bgp 65002
Spoke1(config-router)#neighbor [Link] remote-as 65001
Spoke1(config-router)#network [Link] mask [Link]
Spoke2(config)#router bgp 65003
Spoke2(config-router)#neighbor [Link] remote-as 65001
Spoke2(config-router)#network [Link] mask [Link]
Above we have a different AS number for each router, also we advertised the loopback
interfaces in BGP. Let’s see if our hub router has two neighbors:
Hub#show ip bgp summary | begin Neighbor
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down
State/PfxRcd
[Link] 4 65002 47 48 4 0 0 00:38:49
1
[Link] 4 65003 46 47 4 0 0 00:38:05
1
This is looking good, we have two neighbors. Let’s take a look at the routing tables:
Hub#show ip route bgp
[Link]/32 is subnetted, 1 subnets
B [Link] [20/0] via [Link], 00:37:59
[Link]/32 is subnetted, 1 subnets
B [Link] [20/0] via [Link], 00:37:59
Spoke1#show ip route bgp
[Link]/32 is subnetted, 1 subnets
B [Link] [20/0] via [Link], 00:38:16
[Link]/32 is subnetted, 1 subnets
B [Link] [20/0] via [Link], 00:37:46
Spoke2#show ip route bgp
[Link]/32 is subnetted, 1 subnets
B [Link] [20/0] via [Link], 00:38:34
[Link]/32 is subnetted, 1 subnets
B [Link] [20/0] via [Link], 00:38:34
All routers have learned the different networks. Let’s see if spoke1 can reach spoke2:
Spoke1#ping [Link] source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to [Link], timeout is 2 seconds:
Packet sent with a source address of [Link]
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/10 ms
Great, no issues there. All traffic goes through the hub so there’s no need for our spoke
routers to see specific networks.
Let’s configure the hub so that it will only advertise a default route to our spokes. I’ll use
a route-map for this:
Hub(config)#ip route [Link] [Link] null0
Hub(config)#ip prefix-list DEFAULT_ROUTE permit [Link]/0
Hub(config)#route-map SPOKE_ROUTERS permit 10
Hub(config-route-map)#match ip address prefix-list DEFAULT_ROUTE
Hub(config)#router bgp 65001
Hub(config-router)#network [Link] mask [Link]
Hub(config-router)#neighbor [Link] route-map SPOKE_ROUTERS out
Hub(config-router)#neighbor [Link] route-map SPOKE_ROUTERS out
Hub#clear ip bgp *
Our hub router should still have all networks, the spoke routers should only have a
default route. Let’s take a look:
Hub#show ip route bgp
[Link]/32 is subnetted, 1 subnets
B [Link] [20/0] via [Link], 00:00:52
[Link]/32 is subnetted, 1 subnets
B [Link] [20/0] via [Link], 00:00:52
Spoke1#show ip route bgp
B* [Link]/0 [20/0] via [Link], 00:00:44
Spoke2#show ip route bgp
B* [Link]/0 [20/0] via [Link], 00:00:48
That’s looking good. Let’s verifiy connectivity:
Spoke1#ping [Link] source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to [Link], timeout is 2 seconds:
Packet sent with a source address of [Link]
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/8/9 ms
It’s still working, excellent!
eBGP with same AS on the spokes
Another thing we can try with eBGP is to use the same AS number on all spoke routers.
The advantage of this solution is that we don’t have to filter any networks, the spoke
routers will not accept any networks where they see their own AS number in the AS
path. Let’s clean up first:
Hub(config)#router bgp 65001
Hub(config-router)#no neighbor [Link]
Hub(config-router)#no neighbor [Link]
Spoke1(config)#no router bgp 65002
Spoke2(config)#no router bgp 65003
Now we’ll configure the spoke routers to use AS 65023:
Hub(config)#router bgp 65001
Hub(config-router)#neighbor [Link] remote-as 65023
Hub(config-router)#neighbor [Link] remote-as 65023
Spoke1(config)#router bgp 65023
Spoke1(config-router)#neighbor [Link] remote-as 65001
Spoke1(config-router)#network [Link] mask [Link]
Spoke2(config)#router bgp 65023
Spoke2(config-router)#neighbor [Link] remote-as 65001
Spoke2(config-router)#network [Link] mask [Link]
Our hub router is still advertising a default route but we don’t need the route-map
anymore. Let’s take a closer look:
Hub#show ip route bgp
[Link]/32 is subnetted, 1 subnets
B [Link] [20/0] via [Link], 00:00:56
[Link]/32 is subnetted, 1 subnets
B [Link] [20/0] via [Link], 00:00:20
The hub still has the networks from the spoke routers in its routing table. Let’s see what
it is advertising to the spoke routers:
Hub#show ip bgp neighbors [Link] advertised-routes
BGP table version is 9, local router ID is [Link]
Status codes: s suppressed, d damped, h history, * valid, > best, i -
internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> [Link] [Link] 0 32768 i
*> [Link]/32 [Link] 0 32768 i
*> [Link]/32 [Link] 0 0 65023 i
*> [Link]/32 [Link] 0 0 65023 i
Hub#show ip bgp neighbors [Link] advertised-routes
BGP table version is 9, local router ID is [Link]
Status codes: s suppressed, d damped, h history, * valid, > best, i -
internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> [Link] [Link] 0 32768 i
*> [Link]/32 [Link] 0 32768 i
*> [Link]/32 [Link] 0 0 65023 i
*> [Link]/32 [Link] 0 0 65023 i
Above you can see that the hub is advertising [Link]/32 to spoke1 and [Link] to
spoke2. What did they install?
Spoke1#show ip route bgp
B* [Link]/0 [20/0] via [Link], 00:04:05
[Link]/32 is subnetted, 1 subnets
B [Link] [20/0] via [Link], 00:04:05
Spoke2#show ip route bgp
B* [Link]/0 [20/0] via [Link], 00:02:19
[Link]/32 is subnetted, 1 subnets
B [Link] [20/0] via [Link], 00:02:19
Spoke1 doesn’t accept [Link]/32 since it has AS 65023 in the AS path. The same thing
applies to spoke2, it doesn’t like [Link]/32 since AS 65023 is in the AS path. The
default route is installed and we can see [Link]/32. It would be best to get rid of the
network command on the hub, we don’t need this entry.
Let’s see if the spokes can still reach each other:
Spoke1#ping [Link] source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to [Link], timeout is 2 seconds:
Packet sent with a source address of [Link]
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 7/8/9 ms
Spoke1 can still reach spoke2. No problems here!
iBGP with dynamic peers
The two previous examples with eBGP work very well. Both examples had one “issue”
though, we manually configured our neighbors. It works but it defeats the purpose of
having dynamic DMVPN spoke routers.
BGP supports something called “dynamic peers” which means we will accept a BGP
neighbor adjacency from any router in a given range. You can use this for both eBGP
and iBGP but there is one catch…the remote routers have to be in the same AS.
I’ll show you how to do this with iBGP:
Hub(config)#router bgp 65001
Hub(config-router)#bgp listen range [Link]/24 peer-group
DMVPN_SPOKES
Hub(config-router)#neighbor DMVPN_SPOKES peer-group
Hub(config-router)#neighbor DMVPN_SPOKES remote-as 65001
Hub(config-router)#network [Link] mask [Link]
Above we used the listen range command to accept a BGP neighbor adjacency from
any device in the [Link]/24 range. We also use a peer-group that specifies the
iBGP neighbors in AS 65001 and the default route is advertised. Let’s configure the
spoke routers:
Spoke1(config)#router bgp 65001
Spoke1(config-router)#neighbor [Link] remote-as 65001
Spoke1(config-router)#network [Link] mask [Link]
Spoke2(config)#router bgp 65001
Spoke2(config-router)#neighbor [Link] remote-as 65001
Spoke2(config-router)#network [Link] mask [Link]
Let’s check the routing tables:
Hub#show ip route bgp
[Link]/32 is subnetted, 1 subnets
B [Link] [200/0] via [Link], 00:02:23
[Link]/32 is subnetted, 1 subnets
B [Link] [200/0] via [Link], 00:02:23
Spoke1#show ip route bgp
B* [Link]/0 [200/0] via [Link], 00:01:26
Spoke2#show ip route bgp
B* [Link]/0 [200/0] via [Link], 00:01:08
The hub router sees two networks, each spoke only sees the default route.
The advantage of iBGP in combination with DMVPN phase 1 is that you don’t have to filter
anything on the hub router. Because of iBGP split horizon, the hub won’t advertise any networks
from spoke1 to spoke2 (or vice versa).
Configurations
Hub
Spoke1
Spoke2
hostname Hub
!
interface Loopback0
ip address [Link] [Link]
!
interface Tunnel0
ip address [Link] [Link]
no ip redirects
ip nhrp authentication DMVPN
ip nhrp map multicast dynamic
ip nhrp network-id 1
tunnel source GigabitEthernet0/1
tunnel mode gre multipoint
!
interface GigabitEthernet0/1
ip address [Link] [Link]
duplex auto
speed auto
media-type rj45
!
router bgp 65001
bgp log-neighbor-changes
network [Link]
network [Link] mask [Link]
neighbor [Link] remote-as 65023
neighbor [Link] remote-as 65023
!
ip route [Link] [Link] Null0
!
ip prefix-list DEFAULT_ROUTE seq 5 permit [Link]/0
!
route-map SPOKE_ROUTERS permit 10
match ip address prefix-list DEFAULT_ROUTE
!
end
Configurations
Hub
Spoke1
Spoke2
hostname Spoke1
!
interface Loopback0
ip address [Link] [Link]
!
interface Tunnel0
ip address [Link] [Link]
ip nhrp authentication DMVPN
ip nhrp map [Link] [Link]
ip nhrp map multicast [Link]
ip nhrp network-id 1
ip nhrp nhs [Link]
tunnel source GigabitEthernet0/1
tunnel destination [Link]
!
interface GigabitEthernet0/1
ip address [Link] [Link]
duplex auto
speed auto
media-type rj45
!
router bgp 65023
bgp log-neighbor-changes
network [Link] mask [Link]
neighbor [Link] remote-as 65001
!
end
Configurations
Hub
Spoke1
Spoke2
hostname Spoke2
!
interface Loopback0
ip address [Link] [Link]
!
interface Tunnel0
ip address [Link] [Link]
ip nhrp authentication DMVPN
ip nhrp map [Link] [Link]
ip nhrp map multicast [Link]
ip nhrp network-id 1
ip nhrp nhs [Link]
tunnel source GigabitEthernet0/1
tunnel destination [Link]
!
interface GigabitEthernet0/1
ip address [Link] [Link]
duplex auto
speed auto
media-type rj45
!
router bgp 65023
bgp log-neighbor-changes
network [Link] mask [Link]
neighbor [Link] remote-as 65001
!
end
Configurations
Hub
Spoke1
Spoke2
hostname Hub
!
interface Loopback0
ip address [Link] [Link]
!
interface Tunnel0
ip address [Link] [Link]
no ip redirects
ip nhrp authentication DMVPN
ip nhrp map multicast dynamic
ip nhrp network-id 1
tunnel source GigabitEthernet0/1
tunnel mode gre multipoint
!
interface GigabitEthernet0/1
ip address [Link] [Link]
duplex auto
speed auto
media-type rj45
!
router bgp 65001
bgp log-neighbor-changes
bgp listen range [Link]/24 peer-group DMVPN_SPOKES
network [Link]
neighbor DMVPN_SPOKES peer-group
neighbor DMVPN_SPOKES remote-as 65001
neighbor DMVPN_SPOKES route-map DMVPN_SPOKES out
!
ip route [Link] [Link] Null0
!
ip prefix-list DEFAULT_ROUTE seq 5 permit [Link]/0
!
route-map DMVPN_SPOKES permit 10
match ip address prefix-list DEFAULT_ROUTE
!
end
Configurations
Hub
Spoke1
Spoke2
hostname Spoke1
!
interface Loopback0
ip address [Link] [Link]
!
interface Tunnel0
ip address [Link] [Link]
ip nhrp authentication DMVPN
ip nhrp map [Link] [Link]
ip nhrp map multicast [Link]
ip nhrp network-id 1
ip nhrp nhs [Link]
tunnel source GigabitEthernet0/1
tunnel destination [Link]
!
interface GigabitEthernet0/1
ip address [Link] [Link]
duplex auto
speed auto
media-type rj45
!
router bgp 65001
bgp log-neighbor-changes
network [Link] mask [Link]
neighbor [Link] remote-as 65001
!
end
d
Configurations
Hub
Spoke1
Spoke2
hostname Spoke2
!
interface Loopback0
ip address [Link] [Link]
!
interface Tunnel0
ip address [Link] [Link]
ip nhrp authentication DMVPN
ip nhrp map [Link] [Link]
ip nhrp map multicast [Link]
ip nhrp network-id 1
ip nhrp nhs [Link]
tunnel source GigabitEthernet0/1
tunnel destination [Link]
!
interface GigabitEthernet0/1
ip address [Link] [Link]
duplex auto
speed auto
media-type rj45
!
router bgp 65001
bgp log-neighbor-changes
network [Link] mask [Link]
neighbor [Link] remote-as 65001
!
end
Conclusion
You have now seen how to configure eBGP and iBGP for DMVPN phase 1. BGP is a good
choice for DMVPN, this example was pretty straight forward since the spoke routers only
required a default route. In large DMVPN setups, it can be useful to use BGP since it’s easy
to advertise, summarize and filter networks.
I hope you enjoyed this lesson, if you have any questions feel free to leave a comment!