Build DMVPN phase 3 with one hub and two spokes

Tasks

1. Configure the same IKEv2 and IPsec profile on all three routers, with a wildcard peer so any spoke can connect.
2. Build the hub mGRE tunnel with dynamic multicast mapping and NHRP redirect.
3. Build each spoke mGRE tunnel with the hub as NHS and NHRP shortcut enabled.
4. Run EIGRP over the tunnel, summarize at the hub and make the spokes stubs.
5. Prove that spoke-to-spoke traffic moves from the hub path to a direct path.

Solution

1. 1Crypto, identical on R1, R2 and R3

   crypto ikev2 proposal DMVPN-PROP
    encryption aes-cbc-256
    integrity sha256
    group 19
   !
   crypto ikev2 policy DMVPN-POL
    proposal DMVPN-PROP
   !
   crypto ikev2 keyring DMVPN-KR
    peer ANY
     address 0.0.0.0 0.0.0.0
     pre-shared-key Dmvpn-Psk-8xK3pV6nR1tZ
   !
   crypto ikev2 profile DMVPN-IKEV2
    match identity remote address 0.0.0.0
    authentication remote pre-share
    authentication local pre-share
    keyring local DMVPN-KR
    dpd 10 3 on-demand
   !
   crypto ipsec transform-set DMVPN-TS esp-aes 256 esp-sha256-hmac
    mode transport
   !
   crypto ipsec profile DMVPN-IPSEC
    set transform-set DMVPN-TS
    set ikev2-profile DMVPN-IKEV2

   The wildcard keyring lets any spoke, including one with a dynamic address, authenticate with the shared key. In production, certificates avoid one key for the whole cloud.

2. 2Hub tunnelR1

   interface Tunnel0
    ip address 172.16.0.1 255.255.255.0
    no ip redirects
    ip mtu 1400
    ip tcp adjust-mss 1360
    ip nhrp network-id 1
    ip nhrp map multicast dynamic
    ip nhrp redirect
    ip summary-address eigrp 100 10.0.0.0 255.0.0.0
    tunnel source GigabitEthernet0/0/0
    tunnel mode gre multipoint
    tunnel protection ipsec profile DMVPN-IPSEC

   No tunnel destination on mGRE. ip nhrp redirect makes the hub tell a spoke when its traffic hairpins through the hub.

3. 3Hub routingR1

   router eigrp 100
    network 10.1.0.0 0.0.0.255
    network 172.16.0.0 0.0.0.255
    passive-interface GigabitEthernet0/0/1

   Split horizon can stay on. The hub advertises its own summary, not routes learned from other spokes, so split horizon does not block anything.

4. 4Spoke R2 tunnel and routingR2

   interface Tunnel0
    ip address 172.16.0.2 255.255.255.0
    no ip redirects
    ip mtu 1400
    ip tcp adjust-mss 1360
    ip nhrp network-id 1
    ip nhrp nhs 172.16.0.1 nbma 192.0.2.1 multicast
    ip nhrp shortcut
    tunnel source GigabitEthernet0/0/0
    tunnel mode gre multipoint
    tunnel protection ipsec profile DMVPN-IPSEC
   !
   router eigrp 100
    network 10.2.0.0 0.0.0.255
    network 172.16.0.0 0.0.0.255
    passive-interface GigabitEthernet0/0/1
    eigrp stub connected

   The nhs ... nbma ... multicast line registers with the hub and sends EIGRP multicast to it. Older releases need three separate ip nhrp map and ip nhrp nhs lines.

5. 5Spoke R3 tunnel and routingR3

   interface Tunnel0
    ip address 172.16.0.3 255.255.255.0
    no ip redirects
    ip mtu 1400
    ip tcp adjust-mss 1360
    ip nhrp network-id 1
    ip nhrp nhs 172.16.0.1 nbma 192.0.2.1 multicast
    ip nhrp shortcut
    tunnel source GigabitEthernet0/0/0
    tunnel mode gre multipoint
    tunnel protection ipsec profile DMVPN-IPSEC
   !
   router eigrp 100
    network 10.3.0.0 0.0.0.255
    network 172.16.0.0 0.0.0.255
    passive-interface GigabitEthernet0/0/1
    eigrp stub connected

Verify

R1# show dmvpn | begin Interface
Interface: Tunnel0, IPv4 NHRP Details
Type:Hub, NHRP Peers:2,

 # Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb
 ----- --------------- --------------- ----- -------- -----
     1 198.51.100.2         172.16.0.2    UP 00:14:32     D
     1 203.0.113.2          172.16.0.3    UP 00:14:05     D

R2# show ip route eigrp | begin Gateway
Gateway of last resort is 198.51.100.1 to network 0.0.0.0

      10.0.0.0/8 is variably subnetted, 3 subnets, 3 masks
D        10.0.0.0/8 [90/26880256] via 172.16.0.1, 00:14:20, Tunnel0

R2# traceroute 10.3.0.10 source 10.2.0.1
Type escape sequence to abort.
Tracing the route to 10.3.0.10
VRF info: (vrf in name/id, vrf out name/id)
  1 172.16.0.1 21 msec 20 msec 20 msec
  2 172.16.0.3 38 msec 37 msec 37 msec
  3 10.3.0.10 38 msec 38 msec 39 msec

R2# traceroute 10.3.0.10 source 10.2.0.1
Type escape sequence to abort.
Tracing the route to 10.3.0.10
VRF info: (vrf in name/id, vrf out name/id)
  1 172.16.0.3 19 msec 18 msec 18 msec
  2 10.3.0.10 19 msec 19 msec 19 msec

Mistakes people make

• Forgetting ip nhrp map multicast dynamic on the hub. Unicast works but EIGRP hellos never reach the spokes.
• Configuring ip nhrp redirect without ip nhrp shortcut on the spokes, or the other way round. Traffic keeps hairpinning through the hub.
• Using an IKEv2 profile that matches only the hub's address on spokes. Spoke-to-spoke IKE then fails, because the peer is another spoke.
• Blocking UDP 500 and 4500 between spokes. Hub tunnels work, shortcuts never come up, and traffic stays on the hub path.
• Forgetting that the summary includes the hub's own LAN. That is fine here, but plan the summary so it covers every spoke prefix.