- “Do I Know This Already?” Quiz
- Foundation Topics
- DMVPN Overview
- DVMPN Network Components
- DMVPN Design Considerations
- DMVPN Phase 1 Hub-and-Spoke Implementation
- DMVPN Phase 2 Spoke-to-Spoke Implementation
- DMVPN Phase 3 Spoke-to-Spoke Implementation
- DMVPN Troubleshooting
- Summary
- References
- Exam Preparation Tasks
- Review All Key Topics
- Complete Tables and Lists from Memory
- Define Key Terms
This chapter is from the book
This chapter is from the book
This chapter is from the book
DVMPN Network Components
As mentioned in the previous section of this chapter, DMVPN uses several components to achieve either a hub-and-spoke or a spoke-to-spoke solution: mGRE, NHRP, and IPsec. This section examines these components as well as the routing protocols that DMVPN supports. Make sure you are familiar with each of these components before moving to the next part of this chapter. First, we need to understand mGRE.
mGRE
mGRE enables routers to support multiple GRE tunnels on a single interface. This single interface can receive inbound GRE connections from dynamically addressed remote site locations and simultaneously support dynamic routing protocols, IP Multicast, and non-IP protocols. Both GRE and mGRE have a 24-bit header; in some situations, this header can impact application functionality. (We will examine this later in this chapter.) The advantage of using mGRE is that it enables the DMVPN network to replicate the function of a non-broadcast multiple-access (NBMA) multipoint Frame Relay solution (see Figure 5-5). Such solutions were more common in the past, when companies would purchase a Frame Relay WAN architecture from a telephone company and request that it be configured as multipoint. In Figure 5-5, which provides an example of the components in a DMVPN configuration, you can see that, in addition to a VPN tunnel, there are also GRE tunnels configured between sites.
)
Figure 5-5 GRE Tunnels
GRE and mGRE Advantages
GRE and mGRE have many advantages both with DMVPN and in other solutions. For example, you can use a GRE tunnel to repair network routing links between OSPF areas that have become disconnected, causing routing updates between them to stop. Because GRE uses the IP protocol 47 and encapsulates the entire original IP payload, it supports nontraditional protocols as well as multicast and the use of routing protocols across a VPN tunnel.
GRE has a few limitations, but they are significant:
GRE is not a cryptographic protocol, and it does not provide data protection.
GRE can be CPU intensive, and you need to consider this during design.
The IP MTU and fragmentation issue mentioned earlier might occur with some applications.
Vendor GRE solutions are not all alike, and integration can be challenging.
NHRP
NHRP is used as the primary communication system for DMVPN hubs to inform spoke devices about other registered spokes. This is a classic client and server protocol: The server (hub) maintains the database of the spokes (clients) that have successfully registered. During the registration process, each spoke provides the server with its public IP address and the internal IP address of its GRE tunnel. The NHRP hub stores that information in the NHRP database so that other spokes can query the database for that information. Notice in Figure 5-6 that the NHRP registration occurs over the tunnel, and the NHRP packet includes the source address of the device that sent the tunnel, the destination address of the tunnel, and the NBMA address (public) of the destination device.
)
Figure 5-6 NHRP Registration Process
NHRP Example
Figure 5-6 shows IPsec tunnels, the GRE tunnel, and NHRP configured. It shows that the NHRP database on the NHRP server provides both the tunnel and the external IP address of a spoke router. This information is gathered during the spoke registration process.
Remaining DMVPN Components
IPsec is used to secure traffic going across a tunnel. Depending on the architecture of a DMVPN topology, it is possible for spokes to dynamically establish VPN tunnels with other spokes.
Routing is an often-overlooked piece of a DMVPN solution. However, routing is key because it enables a remote site to reach another remote spoke network that it did not initially have in its routing table prior to registration. Understanding DMVPN routing configuration comes down to understanding the shortfalls of routing protocols such as EIGRP and the split-horizon feature. With OSPF, an engineer would need to address the issue of NBMA with a multipoint OSPF configuration or set up a broadcast network.
Solution Breakdown
In studying and preparing for the SVPN 300-730 exam, a good approach would be to break down the components of a solution down into sub pieces. When you have mastered all the components, troubleshooting DMVPN will be much easier. Table 5-2 will help you study and focus on the key components of a DMVPN configuration.
Table 5-2 Basic DMVPN Configuration Components
Component |
Requirement |
|---|---|
Crypto configuration |
Commands for ISAKMP and IPsec |
Tunnel configuration |
Commands to set up a tunnel interface |
Next Hop Resolution Protocol |
Commands to configure NHRP on both hub and spoke routers |
Routing protocol configuration |
Commands to configure a routing protocol for hub-and-spoke or spoke-to-spoke communications |