How does NHRP work in DMVPN?
Show the answer
Say this first
NHRP maps an overlay tunnel address to the underlay (NBMA) address that GRE packets must be sent to. Each spoke has the hub configured as its next hop server and sends it a registration: my tunnel address is 172.16.0.2 and my public address is 198.51.100.2. The hub builds its table from those registrations. When a spoke needs another spoke's public address, it sends a resolution request, and the answer lets it build a direct tunnel. Entries are refreshed and expire with a hold time.
Go deeper
Hub
interface Tunnel0
ip nhrp network-id 1
ip nhrp map multicast dynamicmap multicast dynamic copies multicast (routing hellos) to every spoke that has registered.
Spoke
interface Tunnel0
ip nhrp network-id 1
ip nhrp nhs 172.16.0.1 nbma 192.0.2.1 multicastThat one-line form replaces the older three lines: ip nhrp map 172.16.0.1 192.0.2.1,
ip nhrp map multicast 192.0.2.1 and ip nhrp nhs 172.16.0.1.
Message types
Registration request and reply, resolution request and reply, purge, error, and in phase 3 the redirect (traffic indication).
Details interviewers like
- The network ID is local to the router, but it must be set because it enables NHRP on the interface. Keeping it the same everywhere avoids confusion.
ip nhrp authenticationis a clear-text string of up to 8 characters. It separates DMVPN clouds; it is not security.ip nhrp holdtimedefaults to 7200 seconds on IOS, and spokes re-register before it runs out.
They will ask next
What breaks if the hub lacks
ip nhrp map multicast dynamic?Routing hellos from the hub never reach the spokes, so EIGRP or OSPF adjacencies do not form, even though unicast pings across the tunnel work.
The spoke sits behind NAT. Which address does the hub record?
The post-NAT address it sees in the packets, and spoke-to-spoke tunnels use that.
show dmvpnmarks such entries with N (NATed). IPsec runs over UDP 4500 in that case.
Traps
- Calling NHRP a routing protocol. It resolves addresses; a routing protocol still provides the prefixes.