In DMVPN phase 3, what happens when spoke A first sends traffic to a host behind spoke B?
Show the answer
Say this first
Spoke A has only the hub's summary, so the first packets go to the hub. The hub sees a packet arrive on Tunnel0 and leave on Tunnel0, forwards it, and sends spoke A an NHRP redirect. Spoke A sends an NHRP resolution request for the destination, which the hub forwards to spoke B. Spoke B answers spoke A directly with its public address and the matching prefix from its routing table, which brings up IPsec between the spokes. Spoke A installs a shortcut for that prefix, and later packets go spoke to spoke.
Go deeper
Walk-through with addresses
| Device | Tunnel | NBMA | LAN |
|---|---|---|---|
| Hub R1 | 172.16.0.1 | 192.0.2.1 | 10.1.0.0/24 |
| Spoke A R2 | 172.16.0.2 | 198.51.100.2 | 10.2.0.0/24 |
| Spoke B R3 | 172.16.0.3 | 203.0.113.2 | 10.3.0.0/24 |
- R2 sends to 10.3.0.10 using the hub's summary 10.0.0.0/8 via 172.16.0.1.
- R1 forwards it to R3 and, because it hairpinned on Tunnel0, sends R2 a redirect.
- R2 sends a resolution request for 10.3.0.10. It is routed through R1 to R3.
- R3 replies directly to R2: 10.3.0.0/24 is at 172.16.0.3, NBMA 203.0.113.2. IKE and IPsec come up between R2 and R3.
- R2 installs the shortcut. On IOS 15.2 and later it appears as an NHRP route (code H, administrative distance 250), or as a next hop override (marked %) on an existing route.
- Unused shortcuts age out, and traffic falls back to the hub path.
Commands
Hub: ip nhrp redirect. Spokes: ip nhrp shortcut.
They will ask next
What does traceroute show?
The first run shows the hub's tunnel address as hop 1, then spoke B. A few seconds later the same trace shows spoke B's tunnel address as hop 1.
Is the NHRP redirect the same as an ICMP redirect?
No. An ICMP redirect tells a host to use another gateway on its subnet. The NHRP redirect tells a spoke to resolve a direct path. DMVPN tunnels carry
no ip redirectsso the hub does not also send ICMP redirects for every hairpinned packet.
Traps
- Saying spoke B's resolution reply comes back through the hub. In phase 3 it goes directly to spoke A.