- [Instructor] For the NRC exam you need to be able
to configure and to verify a single hub DMVPN.
In this video,
we'll have an overview of what's involved with DMVPN
configuration and the important components of that.
And then in the next video,
we'll follow up with the configuration.
DMVPN stands for Dynamic Multipoint Virtual Private Network
and those are commonly used to build VPNs
with multiple sites.
So if you have a business with multiple branch locations,
for example that would be a common reason
that you'd use a DMVPN.
This is considered to be a full mesh capable network
meaning that not only do we have communication
between the central hub and each spoke
but we also have the ability to have dynamic spoke
to spoke tunnels established.
This allows the spokes to communicate with
one another directly without having to pass
traffic back through the central hub.
So that's much more efficient.
The tunnels between spokes can be established and torn
down on an as needed basis.
DMVPN uses Multipoint Generic Routing Encapsulation
or mGRE to accomplish this.
mGRE supports dynamic routing protocols.
And it allows a single router interface
to form multiple GRE tunnels.
So with a normal VPN,
you may have a hub and spoke topology that looks like this
where you configure the central HQ router as the hub
with an mGRE interface,
allowing multiple tunnels to form
so that you can interconnect your sites.
Optionally.
We could configure all of the routers
with mGRE interfaces so that we can have DMVPN tunnels form
between the spokes themselves on an as needed basis.
This is a much more scalable option
for a multi-side business.
But this begs the question,
how does a spoke router determine the IP address
of a router at another site?
Spokes are statically configured
with the IP address of the hub.
But if we start doing that between each and every spoke,
well, that's not very dynamic at all.
And we aren't gaining anything
in regard to ease of scalability.
The solution is the Next-Hop Resolution Protocol or NHRP.
I think of this as functionally
similar to how DNS works.
When you open a browser and you put in
a specific web address
your computer is going to query
a DNS server to resolve the web address to an IP address.
And the DNS server will provide
the IP address that corresponds to that web address.
NHRP uses a similar client server model
where the hub will act as a server
and the spokes act as the clients
since the hub is connected to all of the spokes.
The hub has awareness of all of the addresses needed
for communication between the spokes.
So for example,
we can see that our branch A router
has a tunnel interface IP address
of 10.1.1.5 with a physical interface
IP address of 192.168.10.5
The HQ router would be educated about this
correlation by the branch A router
and it would keep a copy of this information.
And it's local NHRP database.
This would be the same for all of the branch routers.
So it would have awareness of all the correlating tunnel
and physical IP addresses.
If branch B wants to communicate with branch A
under normal circumstances as we see here
that would require the traffic to travel
all the way back to the hub or the HQ router
before that is routed to the branch A site.
However,
if we use the DMVPN within NHRP
the branch B router would simply query the HQ hub
asking for the physical interface IP address
that is associated with the tunnel interface IP address
for branch A.
In this case we can see the tunnel interface is 10.1.1.5.
The HQ router would check the NHRP database
and see that the corresponding physical IP address
for branch A is 192.168.10.5.
And it would return this information back
to the branch B router.
Now branch B with an interface configured for mGRE.
Would be able to dynamically set up
a tunnel with the branch A router,
which would allow for more optimal traffic flow.
This also allows for much easier provisioning
for new spoke routers.
So that's an overview of what the DMVPN is
and why we'd want to use that.
In our next video,
we'll look at the necessary commands
for configuring a single hub DMVPN.