Cisco DMVPN: Hub-and-Spoke Architecture and Phase 3 Configuration

April 15, 2026·2 min read·294 words

Cisco DMVPN Phase 3 (Dynamic Multipoint VPN) for hub-and-spoke networks with dynamic spoke-to-spoke connectivity. The successor to traditional point-to-point site-to-site VPNs. Scales to 500+ spokes. DMVPN Phase 3 configuration guide using NHRP + mGRE + IPsec.

DMVPN Phases

Phase 1: hub-and-spoke only (inter-spoke traffic routed through the hub)
Phase 2: dynamic spoke-to-spoke connectivity with complex routing
Phase 3: spoke-to-spoke connectivity with simple routing (modern standard)
NHRP: Next Hop Resolution Protocol for spoke discovery

Components

mGRE (multipoint GRE): 1 logical multipoint tunnel
NHRP: maps tunnel IP addresses to spoke public IP addresses
IPsec: GRE traffic encryption
IGP: EIGRP / OSPF for routing (BGP is not mandatory)

Hub Configuration

interface Tunnel0
ip address 10.0.0.1 255.255.255.0
ip nhrp authentication NhrpPass
ip nhrp network-id 1
ip nhrp map multicast dynamic
ip nhrp redirect (Phase 3)
ip ospf network point-to-multipoint
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel protection ipsec profile IPSEC-PROF

Spoke Configuration

interface Tunnel0
ip address 10.0.0.2 255.255.255.0
ip nhrp authentication NhrpPass
ip nhrp network-id 1
ip nhrp nhs 10.0.0.1 (hub tunnel IP address)
ip nhrp map 10.0.0.1 203.0.113.1 (hub public IP address)
ip nhrp shortcut (Phase 3)
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel protection ipsec profile IPSEC-PROF

EIGRP Routing

router eigrp 100
network 10.0.0.0 0.0.0.255
no auto-summary
On the hub: no split-horizon (required for Phase 2)
Phase 3: disables split horizon differently

Scalability and Limitations

Hub: 500-1000 spokes maximum, depending on hardware
Redundancy: 2 hubs for HA
NHRP cache: critical for troubleshooting
Modern alternative: SD-WAN (Cisco Catalyst 8000 with Viptela)

DMVPN vs. SD-WAN

DMVPN: robust custom solution with no controller
SD-WAN: centralized orchestration, better UX and modern features
2026 trend: gradual migration from DMVPN to SD-WAN

Order from OPTINOC

Cisco ISR/ASR DMVPN. Migration to Catalyst 8000 SD-WAN. Training + POC. Quote within 48 hours.