DMVPN Tutorial
Vendor
Cisco
Platform
Router
Version
12.x
Router - Cisco Router
Thursday, 24 March 2011 00:51
Share on emailShare on printShare on surfingbirdShare on deliciousShare on twitterShare on diggShare on stumbleuponShare
on facebook
Introduction
DMVPN (Dynamic Multipoint Virtual Private Network) is a feature within the Cisco IOS based router family which provides the
ability to dynamically build IPSEC tunneling between peers based on an evolved iteration of hub and spoke tunneling. DMVPN
uses a combination of the following technologies :
1.
Multipoint GRE (mGRE)
2.
Next-Hop Resolution Protocol (NHRP)
3.
Dynamic Routing Protocol (EIGRP, RIP, OSPF, BGP)
4.
Dynamic IPsec encryption
DMVPN alleviates the need for multiple IPSEC configurations. This:
a.
reduces administration and management overhead
b.
allows for efficient scalability
Example
In the following example we will configure DMVPN between the Hub router and each of its spokes (router 2, 3 and 4). The steps
will be broken broken down into the following sections:
o
Physical Connectivity
DMVPN Configuration
IPSEC
Dynamic Routing
PHYSICAL CONNECTIVITY
Below shows the physical topology along with the configuration for each of the routers.
HUB
interface f0/0
ip address [Link] [Link]
duplex full
speed 100
no shut
ip route [Link] [Link] [Link]
ip route [Link] [Link] [Link]
ip route [Link] [Link] [Link]
ROUTER 1
interface f2/0
ip address [Link] [Link]
duplex full
speed 100
no shut
interface f0/0
ip address [Link] [Link]
duplex full
speed 100
no shut
interface f1/0
ip address [Link] [Link]
duplex full
speed 100
no shut
interface f0/1
ip address [Link] [Link]
duplex full
speed 100
no shut
ROUTER 2
interface f0/0
ip address [Link] [Link]
duplex full
speed 100
no shut
interface loopback 0
ip address [Link] [Link]
no shut
ip route [Link] [Link] [Link]
ROUTER 3
interface f0/0
ip address [Link] [Link]
duplex full
speed 100
no shut
interface loopback 0
ip address [Link] [Link]
no shut
ip route [Link] [Link] [Link]
ROUTER 4
interface f0/0
ip address [Link] [Link]
duplex full
speed 100
no shut
interface loopback 0
ip address [Link] [Link]
no shut
ip route [Link] [Link] [Link]
DMVPN CONFIGURATION
Once we have physical connectivity we can add the DMVPN configuration. The diagram below shows you the logical topology of
our DMVPN network.
Note: Each tunnel is represented via the grey dotted lines.
HUB
interface Tunnel0
ip address [Link] [Link]
ip nhrp map multicast dynamic
ip nhrp network-id 1
tunnel source [Link]
tunnel mode gre multipoint
ip mtu 1416
ROUTER 2
interface Tunnel0
ip address [Link] [Link]
ip nhrp map [Link] [Link]
ip nhrp map multicast [Link]
ip nhrp network-id 1
ip nhrp nhs [Link]
tunnel source [Link]
tunnel mode gre multipoint
ip mtu 1416
ROUTER 3
interface Tunnel0
ip address [Link] [Link]
ip nhrp map [Link] [Link]
ip nhrp map multicast [Link]
ip nhrp network-id 1
ip nhrp nhs [Link]
tunnel source [Link]
tunnel mode gre multipoint
ip mtu 1416
ROUTER 4
interface Tunnel0
ip address [Link] [Link]
ip nhrp map [Link] [Link]
ip nhrp map multicast [Link]
ip nhrp network-id 1
ip nhrp nhs [Link]
tunnel source [Link]
tunnel mode gre multipoint
ip mtu 1416
IPSEC
Next we will need to add IPSEC, this will ensure that traffic is not sent in clear text. This configuration should be added to each
router apart from router 1.
crypto isakmp policy 10
hash md5
encryption 3des
authentication pre-share
crypto isakmp key cisco123 address [Link] [Link]
crypto ipsec transform MINE esp-3des
crypto ipsec profile DMVPN
set transform-set MINE
interface tunnel0
tunnel protection ipsec profile DMVPN
DYNAMIC ROUTING
To enable dynamic routing using EIGRP add the following configuration onto each of your routers excluding router 1.
interface tunnel0
ip hold-time eigrp 1 35
no ip next-hop-self eigrp 1
no ip split-horizon eigrp 1
router eigrp 1
network [Link]
network [Link]
network [Link]
no auto-summary
TESTING / DIAGNOSTICS
NHRP TUNNELS
HUB#sh dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incompletea
N - NATed, L - Local, X - No Socket
# Ent --> Number of NHRP entries with same NBMA peer
Tunnel0, Type:Hub, NHRP Peers:2,
# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb
----- --------------- --------------- ----- -------- ----1 [Link] [Link] UP never D
1 [Link] [Link] UP never D
1 [Link] [Link] UP never D
DYNAMIC TUNNELS
To test for dynamic tunnels between spokes run the following command:
R3#ping [Link]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to [Link], timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 372/506/660 ms
R3#sh dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incompletea
N - NATed, L - Local, X - No Socket
# Ent --> Number of NHRP entries with same NBMA peer
Tunnel0, Type:Spoke, NHRP Peers:2,
# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb
----- --------------- --------------- ----- -------- ----1 [Link] [Link] UP 00:15:48 S
1 [Link] [Link] UP never DX
EIGRP
HUB#sh ip route
! Gateway of last resort is
[Link]/24 is subnetted,
D [Link] [90/297372416]
D [Link] [90/297372416]
D [Link] [90/297372416]
not set
2 subnets
via [Link], 00:02:02, Tunnel0
via [Link], 00:00:42, Tunnel0
via [Link], 00:00:42, Tunnel0
S [Link]/24 [1/0] via [Link]
[Link]/24 is subnetted, 1 subnets
C [Link] is directly connected, Tunnel0
C [Link]/24 is directly connected, FastEthernet0/0
S [Link]/24 [1/0] via [Link]
S [Link]/24 [1/0] via [Link]
REFERENCES:
[Link]
[Link]
Related Articles
Endpoint Connect MEP Tutorial
Video Tutorial / How do I Enable Check Point SNMPD on SPLAT ??
Creating a VLAN Trunk on a Netscreen Firewall
How do I configure a Site to Site VPN between a Cisco ASA and Juniper Netscreen with overlapping encryption
domains ?
Cisco ASA - 8.3 / 8.4 NAT Tutorial
Cisco Router Zone Based Firewall Configuation Guide - Video Tutorial
Using SSH Keys - Video Tutorial
ASA L2L VPN is not passing traffic when a VPN Filter is applied