Cisco DMVPN: Hub-and-Spoke Architecture and Phase 3 Configuration
·2 min read·294 words
Cisco DMVPN Phase 3 (Dynamic Multipoint VPN) for hub-and-spoke networks with dynamic spoke-to-spoke connectivity. The successor to traditional point-to-point site-to-site VPNs. Scales to 500+ spokes. DMVPN Phase 3 configuration guide using NHRP + mGRE + IPsec.
DMVPN Phases
- Phase 1: hub-and-spoke only (inter-spoke traffic routed through the hub)
- Phase 2: dynamic spoke-to-spoke connectivity with complex routing
- Phase 3: spoke-to-spoke connectivity with simple routing (modern standard)
- NHRP: Next Hop Resolution Protocol for spoke discovery
Components
- mGRE (multipoint GRE): 1 logical multipoint tunnel
- NHRP: maps tunnel IP addresses to spoke public IP addresses
- IPsec: GRE traffic encryption
- IGP: EIGRP / OSPF for routing (BGP is not mandatory)
Hub Configuration
- interface Tunnel0
- ip address 10.0.0.1 255.255.255.0
- ip nhrp authentication NhrpPass
- ip nhrp network-id 1
- ip nhrp map multicast dynamic
- ip nhrp redirect (Phase 3)
- ip ospf network point-to-multipoint
- tunnel source GigabitEthernet0/0
- tunnel mode gre multipoint
- tunnel protection ipsec profile IPSEC-PROF
Spoke Configuration
- interface Tunnel0
- ip address 10.0.0.2 255.255.255.0
- ip nhrp authentication NhrpPass
- ip nhrp network-id 1
- ip nhrp nhs 10.0.0.1 (hub tunnel IP address)
- ip nhrp map 10.0.0.1 203.0.113.1 (hub public IP address)
- ip nhrp shortcut (Phase 3)
- tunnel source GigabitEthernet0/0
- tunnel mode gre multipoint
- tunnel protection ipsec profile IPSEC-PROF
EIGRP Routing
- router eigrp 100
- network 10.0.0.0 0.0.0.255
- no auto-summary
- On the hub: no split-horizon (required for Phase 2)
- Phase 3: disables split horizon differently
Scalability and Limitations
- Hub: 500-1000 spokes maximum, depending on hardware
- Redundancy: 2 hubs for HA
- NHRP cache: critical for troubleshooting
- Modern alternative: SD-WAN (Cisco Catalyst 8000 with Viptela)
DMVPN vs. SD-WAN
- DMVPN: robust custom solution with no controller
- SD-WAN: centralized orchestration, better UX and modern features
- 2026 trend: gradual migration from DMVPN to SD-WAN
Order from OPTINOC
Cisco ISR/ASR DMVPN. Migration to Catalyst 8000 SD-WAN. Training + POC. Quote within 48 hours.