How to Configure DMVPN Phase 2 Using EIGRP in Cisco Networks

DMVPN Phase 2 with EIGRP Complete Technical Guide

Dynamic Multipoint VPN (DMVPN) is one of Cisco’s most powerful WAN technologies used to build scalable and secure VPN infrastructures across enterprise networks.

DMVPN allows multiple branch offices (spokes) to communicate securely over public networks such as the Internet while minimizing manual tunnel configuration.

In DMVPN Phase 2, Cisco introduced one of the most important enhancements:

Direct Spoke-to-Spoke Communication

This dramatically improves scalability, reduces hub load, decreases latency, and optimizes bandwidth utilization.

---

Table of Contents

• 1. Introduction to DMVPN
• 2. Understanding DMVPN Phase 1
• 3. Understanding DMVPN Phase 2
• 4. Role of NHRP
• 5. EIGRP in DMVPN
• 6. DMVPN Mathematical Concepts
• 7. Phase 1 vs Phase 2
• 8. Hub Configuration
• 9. Spoke Configuration
• 10. Verification Commands
• 11. Optimization Techniques
• 12. Security Enhancements
• 13. Cisco IOS 15.9(3)M10 Enhancements
• 14. Conclusion

---

1. Introduction to DMVPN

DMVPN stands for:

\[ \text{Dynamic Multipoint Virtual Private Network} \]

It combines several technologies:

• GRE (Generic Routing Encapsulation)
• mGRE (Multipoint GRE)
• NHRP (Next Hop Resolution Protocol)
• IPsec Encryption
• Dynamic Routing Protocols

The goal of DMVPN is to create scalable VPN architectures without requiring static tunnel definitions between every branch router.

---

2. Understanding DMVPN Phase 1

In DMVPN Phase 1:

• All spokes communicate through the hub.
• No direct spoke-to-spoke communication exists.
• The hub acts as the central transit point.

Traffic Flow

\[ Spoke_A \rightarrow Hub \rightarrow Spoke_B \]

This creates:

• Higher latency
• More bandwidth consumption
• Increased hub CPU utilization

Scalability Problem

Suppose:

• 100 spokes exist
• Each branch communicates continuously

The hub becomes a bottleneck because all traffic passes through it.

---

3. Understanding DMVPN Phase 2

DMVPN Phase 2 solves this scalability issue.

After initial communication through the hub:

\[ Spoke_A \leftrightarrow Spoke_B \]

A direct tunnel forms dynamically between spokes.

Benefits

• Reduced latency
• Lower hub utilization
• Optimized bandwidth
• Better scalability
• Improved application performance

---

4. Role of NHRP

NHRP stands for:

\[ \text{Next Hop Resolution Protocol} \]

NHRP acts like ARP for DMVPN networks.

It maps:

• Tunnel IP addresses
• Public NBMA addresses

Example Mapping

Tunnel IP	Public IP
10.0.0.2	192.168.1.2
10.0.0.3	192.168.1.3

NHRP Resolution Process

Expand Full NHRP Process

1. Spoke sends traffic toward another spoke.
2. Traffic initially reaches the hub.
3. Hub replies with NHRP mapping.
4. Spoke learns destination NBMA address.
5. Direct GRE tunnel forms dynamically.

---

5. EIGRP in DMVPN

EIGRP is commonly used with DMVPN because:

• Fast convergence
• Low CPU utilization
• Efficient route advertisement
• Supports unequal-cost load balancing

EIGRP Metric Formula

\[ Metric = \left( \frac{10^7}{Bandwidth} + Delay \right) \times 256 \]

Where:

• Bandwidth is measured in Kbps
• Delay is measured in tens of microseconds

Bandwidth Example

\[ \frac{10^7}{100000} = 100 \]

Lower metrics indicate better paths.

---

6. DMVPN Mathematical Concepts

Tunnel Scalability

Traditional VPN full mesh tunnels:

\[ \frac{n(n-1)}{2} \]

Where:

• \(n\) = number of sites

Example:

\[ \frac{100(99)}{2}=4950 \]

4950 tunnels are required in a traditional full mesh.

DMVPN avoids this scalability nightmare.

Latency Reduction

Phase 1 path:

\[ Latency = Spoke \rightarrow Hub + Hub \rightarrow Spoke \]

Phase 2 path:

\[ Latency = Spoke \rightarrow Spoke \]

This reduces round-trip delay significantly.

---

7. Phase 1 vs Phase 2

Feature	Phase 1	Phase 2
Spoke-to-Spoke Communication	No	Yes
Hub Dependency	High	Lower
Scalability	Limited	Better
Latency	Higher	Lower
Bandwidth Efficiency	Lower	Higher

---

8. Hub Configuration

interface Tunnel0
 ip address 10.0.0.1 255.255.255.0
 tunnel source GigabitEthernet0/1
 tunnel mode gre multipoint
 ip nhrp network-id 1
 ip nhrp map multicast dynamic
 ip nhrp holdtime 600
 ip nhrp authentication my-secret-key

 no ip split-horizon eigrp 100
 no ip next-hop-self eigrp 100

router eigrp 100
 network 10.0.0.0 0.0.0.255
 no auto-summary

Important Commands

Command	Purpose
tunnel mode gre multipoint	Enables mGRE
ip nhrp network-id	Defines DMVPN cloud
no ip split-horizon eigrp	Allows spoke route advertisement
no ip next-hop-self eigrp	Preserves spoke next-hop information

---

9. Spoke Configuration

interface Tunnel0
 ip address 10.0.0.2 255.255.255.0
 tunnel source GigabitEthernet0/1
 tunnel mode gre multipoint

 ip nhrp network-id 1
 ip nhrp nhs 10.0.0.1

 ip nhrp map 10.0.0.1 192.168.1.1
 ip nhrp map multicast 192.168.1.1

 ip nhrp holdtime 600
 ip nhrp authentication my-secret-key

router eigrp 100
 network 10.0.0.0 0.0.0.255
 no auto-summary

---

10. Verification Commands

show dmvpn

show ip nhrp

show ip eigrp neighbors

show ip route eigrp

show crypto session

show interface tunnel0

show dmvpn Example

Legend: Attrb --> S - Static, D - Dynamic

Interface: Tunnel0

# Ent Peer NBMA Addr Peer Tunnel Add State
1 192.168.1.2 10.0.0.2 UP
2 192.168.1.3 10.0.0.3 UP

---

11. Optimization Techniques

1. Split Horizon Disabling

Normally EIGRP blocks routes learned from one interface from exiting the same interface.

DMVPN requires:

no ip split-horizon eigrp 100

2. Next-Hop Preservation

Without preserving next-hop:

• Spokes still send traffic through hub

Required command:

no ip next-hop-self eigrp 100

3. Route Summarization

Route summarization reduces routing table size.

\[ Summary = 10.0.0.0/16 \]

Benefits:

• Lower CPU usage
• Smaller routing tables
• Faster convergence

---

12. Security Enhancements

DMVPN commonly uses:

• IPsec encryption
• NHRP authentication
• Tunnel authentication
• Routing authentication

IPsec Formula

\[ Ciphertext = Encryption(Plaintext,Key) \]

Encryption protects tunnel traffic across public networks.

---

13. Cisco IOS 15.9(3)M10 Enhancements

Cisco IOS 15.9(3)M10 introduced several DMVPN improvements.

Key Enhancements

• Improved NHRP scalability
• Better spoke-to-spoke optimization
• Enhanced routing stability
• Improved EIGRP integration
• Optimized tunnel performance
• Better security handling

Performance Benefits

Feature	Benefit
Enhanced NHRP	Faster tunnel establishment
Routing Optimization	Lower convergence time
GRE Enhancements	Reduced overhead
Security Improvements	Stronger encryption handling

---

14. Conclusion

DMVPN Phase 2 represents a major improvement in scalable enterprise VPN design.

By enabling direct spoke-to-spoke communication, Cisco significantly reduced hub dependency while improving bandwidth utilization and lowering latency.

The combination of:

• mGRE
• NHRP
• EIGRP
• IPsec

creates a highly scalable and efficient WAN architecture suitable for modern enterprise deployments.

Final Takeaway:

DMVPN Phase 2 transforms traditional hub-and-spoke VPNs into intelligent dynamic networks capable of efficient branch-to-branch communication.