DMVPN Phase 2 with EIGRP Complete Technical Guide
Dynamic Multipoint VPN (DMVPN) is one of Cisco’s most powerful WAN technologies used to build scalable and secure VPN infrastructures across enterprise networks.
DMVPN allows multiple branch offices (spokes) to communicate securely over public networks such as the Internet while minimizing manual tunnel configuration.
In DMVPN Phase 2, Cisco introduced one of the most important enhancements:
This dramatically improves scalability, reduces hub load, decreases latency, and optimizes bandwidth utilization.
Table of Contents
- 1. Introduction to DMVPN
- 2. Understanding DMVPN Phase 1
- 3. Understanding DMVPN Phase 2
- 4. Role of NHRP
- 5. EIGRP in DMVPN
- 6. DMVPN Mathematical Concepts
- 7. Phase 1 vs Phase 2
- 8. Hub Configuration
- 9. Spoke Configuration
- 10. Verification Commands
- 11. Optimization Techniques
- 12. Security Enhancements
- 13. Cisco IOS 15.9(3)M10 Enhancements
- 14. Conclusion
1. Introduction to DMVPN
DMVPN stands for:
It combines several technologies:
- GRE (Generic Routing Encapsulation)
- mGRE (Multipoint GRE)
- NHRP (Next Hop Resolution Protocol)
- IPsec Encryption
- Dynamic Routing Protocols
The goal of DMVPN is to create scalable VPN architectures without requiring static tunnel definitions between every branch router.
2. Understanding DMVPN Phase 1
In DMVPN Phase 1:
- All spokes communicate through the hub.
- No direct spoke-to-spoke communication exists.
- The hub acts as the central transit point.
Traffic Flow
This creates:
- Higher latency
- More bandwidth consumption
- Increased hub CPU utilization
Scalability Problem
Suppose:
- 100 spokes exist
- Each branch communicates continuously
The hub becomes a bottleneck because all traffic passes through it.
3. Understanding DMVPN Phase 2
DMVPN Phase 2 solves this scalability issue.
After initial communication through the hub:
A direct tunnel forms dynamically between spokes.
Benefits
- Reduced latency
- Lower hub utilization
- Optimized bandwidth
- Better scalability
- Improved application performance
4. Role of NHRP
NHRP stands for:
NHRP acts like ARP for DMVPN networks.
It maps:
- Tunnel IP addresses
- Public NBMA addresses
Example Mapping
| Tunnel IP | Public IP |
|---|---|
| 10.0.0.2 | 192.168.1.2 |
| 10.0.0.3 | 192.168.1.3 |
NHRP Resolution Process
Expand Full NHRP Process
- Spoke sends traffic toward another spoke.
- Traffic initially reaches the hub.
- Hub replies with NHRP mapping.
- Spoke learns destination NBMA address.
- Direct GRE tunnel forms dynamically.
5. EIGRP in DMVPN
EIGRP is commonly used with DMVPN because:
- Fast convergence
- Low CPU utilization
- Efficient route advertisement
- Supports unequal-cost load balancing
EIGRP Metric Formula
Where:
- Bandwidth is measured in Kbps
- Delay is measured in tens of microseconds
Bandwidth Example
Lower metrics indicate better paths.
6. DMVPN Mathematical Concepts
Tunnel Scalability
Traditional VPN full mesh tunnels:
Where:
- \(n\) = number of sites
Example:
4950 tunnels are required in a traditional full mesh.
DMVPN avoids this scalability nightmare.
Latency Reduction
Phase 1 path:
Phase 2 path:
This reduces round-trip delay significantly.
7. Phase 1 vs Phase 2
| Feature | Phase 1 | Phase 2 |
|---|---|---|
| Spoke-to-Spoke Communication | No | Yes |
| Hub Dependency | High | Lower |
| Scalability | Limited | Better |
| Latency | Higher | Lower |
| Bandwidth Efficiency | Lower | Higher |
8. Hub Configuration
interface Tunnel0
ip address 10.0.0.1 255.255.255.0
tunnel source GigabitEthernet0/1
tunnel mode gre multipoint
ip nhrp network-id 1
ip nhrp map multicast dynamic
ip nhrp holdtime 600
ip nhrp authentication my-secret-key
no ip split-horizon eigrp 100
no ip next-hop-self eigrp 100
router eigrp 100
network 10.0.0.0 0.0.0.255
no auto-summary
Important Commands
| Command | Purpose |
|---|---|
| tunnel mode gre multipoint | Enables mGRE |
| ip nhrp network-id | Defines DMVPN cloud |
| no ip split-horizon eigrp | Allows spoke route advertisement |
| no ip next-hop-self eigrp | Preserves spoke next-hop information |
9. Spoke Configuration
interface Tunnel0
ip address 10.0.0.2 255.255.255.0
tunnel source GigabitEthernet0/1
tunnel mode gre multipoint
ip nhrp network-id 1
ip nhrp nhs 10.0.0.1
ip nhrp map 10.0.0.1 192.168.1.1
ip nhrp map multicast 192.168.1.1
ip nhrp holdtime 600
ip nhrp authentication my-secret-key
router eigrp 100
network 10.0.0.0 0.0.0.255
no auto-summary
10. Verification Commands
show dmvpn
show ip nhrp
show ip eigrp neighbors
show ip route eigrp
show crypto session
show interface tunnel0
show dmvpn Example
Legend: Attrb --> S - Static, D - Dynamic
Interface: Tunnel0
# Ent Peer NBMA Addr Peer Tunnel Add State
1 192.168.1.2 10.0.0.2 UP
2 192.168.1.3 10.0.0.3 UP
11. Optimization Techniques
1. Split Horizon Disabling
Normally EIGRP blocks routes learned from one interface from exiting the same interface.
DMVPN requires:
no ip split-horizon eigrp 100
2. Next-Hop Preservation
Without preserving next-hop:
- Spokes still send traffic through hub
Required command:
no ip next-hop-self eigrp 100
3. Route Summarization
Route summarization reduces routing table size.
Benefits:
- Lower CPU usage
- Smaller routing tables
- Faster convergence
12. Security Enhancements
DMVPN commonly uses:
- IPsec encryption
- NHRP authentication
- Tunnel authentication
- Routing authentication
IPsec Formula
Encryption protects tunnel traffic across public networks.
13. Cisco IOS 15.9(3)M10 Enhancements
Cisco IOS 15.9(3)M10 introduced several DMVPN improvements.
Key Enhancements
- Improved NHRP scalability
- Better spoke-to-spoke optimization
- Enhanced routing stability
- Improved EIGRP integration
- Optimized tunnel performance
- Better security handling
Performance Benefits
| Feature | Benefit |
|---|---|
| Enhanced NHRP | Faster tunnel establishment |
| Routing Optimization | Lower convergence time |
| GRE Enhancements | Reduced overhead |
| Security Improvements | Stronger encryption handling |
14. Conclusion
DMVPN Phase 2 represents a major improvement in scalable enterprise VPN design.
By enabling direct spoke-to-spoke communication, Cisco significantly reduced hub dependency while improving bandwidth utilization and lowering latency.
The combination of:
- mGRE
- NHRP
- EIGRP
- IPsec
creates a highly scalable and efficient WAN architecture suitable for modern enterprise deployments.
DMVPN Phase 2 transforms traditional hub-and-spoke VPNs into intelligent dynamic networks capable of efficient branch-to-branch communication.
