What is DMVPN, and what problem does it solve?
Show the answer
Say this first
DMVPN (Dynamic Multipoint VPN) is a Cisco design where one hub configuration serves hundreds of spokes and spokes can build direct tunnels to each other on demand. It combines multipoint GRE (one tunnel interface, many peers), NHRP (spokes register their public address with the hub and look each other up), an IPsec profile that encrypts the GRE, and a routing protocol across the tunnel. Spokes can have dynamic public addresses, and adding a spoke does not change the hub.
Go deeper
The pieces
- mGRE:
tunnel mode gre multipoint, notunnel destination. NHRP supplies the destinations. - NHRP: the overlay's address resolution. It maps a tunnel address to the public (NBMA) address to send the GRE packet to.
- IPsec:
tunnel protection ipsec profile, with wildcard keys or certificates so any spoke can connect. - Routing: EIGRP, OSPF or BGP over the tunnel.
Why not static tunnels
A full mesh of N sites needs N(N-1)/2 tunnels: 1225 for 50 sites, each configured on both ends. With DMVPN every spoke configures only the hub, the hub configures no spokes, and spoke-to-spoke tunnels appear when traffic needs them and time out when it stops.
They will ask next
Is DMVPN a standard?
Its parts are: GRE (RFC 2784), NHRP (RFC 2332) and IPsec. DMVPN as a solution is Cisco. Other vendors offer similar designs, such as Juniper and Fortinet ADVPN.
How is DMVPN different from SD-WAN?
DMVPN is a configured overlay that relies on routing protocols, with no central controller. SD-WAN adds a controller for policy and keys, application-aware path choice across several transports, and central management. Cisco's Catalyst SD-WAN overlay is not built on DMVPN.
Traps
- Saying DMVPN needs a static tunnel per spoke on the hub. The hub has one mGRE interface for all of them.