Dual Hub Dual DMVPN Setup: Comparing Old vs New Cisco IOS Versions

The implementation of a **Dual Hub with Dual DMVPN (Dynamic Multipoint Virtual Private Network)** layout offers an efficient solution for enterprises seeking enhanced control over routing and redundancy. Although slightly more complex to set up compared to single-hub architectures, it delivers robust failover capabilities, optimized routing, and improved bandwidth utilization. 

This article will compare the setup and considerations for deploying a dual-hub, dual-DMVPN layout on older routers and the improvements observed in the latest Cisco IOS, post 15.9(3)M10.

---

### **Understanding Dual Hub with Dual DMVPN Architecture**

A **dual-hub, dual-DMVPN topology** involves two DMVPN clouds where:

- Each hub router is connected to a dedicated DMVPN subnet (or "cloud").

- Spoke routers connect to both DMVPN subnets via two GRE tunnel interfaces, creating routing redundancy.

This architecture enables better load balancing and more refined control over the routing protocol's decision-making process. By adjusting interface-level configurations such as bandwidth, cost, and delay, the spoke routers can prioritize one hub over the other in normal operation, while still providing seamless failover if one hub becomes unavailable.

---

### **Challenges in Older Cisco Routers**

On routers running older Cisco IOS versions, there were several challenges when configuring and managing a dual-hub DMVPN layout:

1. **Limited Scalability and Performance**  

   Older devices struggled with scaling DMVPN configurations involving multiple tunnels due to hardware constraints. GRE tunnel termination and encryption demanded significant processing power, leading to potential performance bottlenecks.

2. **Static Workarounds for Routing Protocol Metrics**  

   Manual tweaking of routing protocol metrics was often cumbersome. While EIGRP, OSPF, and BGP are commonly used in DMVPN setups, achieving fine-grained control over routing decisions often required complex configurations, which could become error-prone.

3. **Configuration Complexity**  

   Implementing QoS (Quality of Service), bandwidth controls, and routing adjustments across the two hubs and multiple spokes required detailed planning and was difficult to maintain.

4. **Security Enhancements**  

   Early IOS versions lacked the advanced security features needed for securely handling dynamic spoke-to-spoke communication.

---

### **Advantages of Cisco IOS 15.9(3)M10 and Later**

Cisco IOS 15.9(3)M10 introduces multiple enhancements that simplify the deployment and management of dual-hub, dual-DMVPN topologies. Here's how:

#### **1. Improved DMVPN Performance**

The newer IOS versions are optimized for modern hardware, providing:

- Better GRE and IPsec performance for handling multiple DMVPN clouds.

- Enhanced throughput for encrypted traffic.

- Support for new crypto algorithms that strengthen VPN security.

#### **2. Enhanced Routing Protocols**

Routing protocols now feature:

- **EIGRP DMVPN Stub Routing:** Reduces unnecessary routing updates to spokes, improving performance and efficiency.

- **Faster Convergence:** In the event of hub or tunnel failures, routing protocol convergence is quicker, minimizing downtime.

#### **3. Simplified QoS Configuration**

QoS policies can now be more easily applied to DMVPN interfaces, enabling:

- Dynamic prioritization of traffic across the tunnels.

- Better handling of bandwidth limitations and traffic shaping on spoke-to-hub links.

#### **4. Dynamic Metric Adjustments**

The newer IOS versions allow for better control over routing protocol metrics such as delay, cost, and bandwidth. This simplifies configuring the routing preferences for spoke routers:

- **Primary Hub Preference:** By setting a lower OSPF cost or EIGRP delay for the preferred hub, spokes automatically prioritize it.

- **Seamless Failover:** The secondary hub takes over without additional manual intervention.

#### **5. Security Enhancements**

- **IPsec VTI Integration:** Simplifies the configuration of secure tunnels.

- **IKEv2 Support:** Enhances tunnel establishment with faster and more secure key exchanges.

#### **6. Centralized Management with SD-WAN**

While not DMVPN-specific, newer Cisco IOS versions support integration with Cisco SD-WAN, enabling centralized configuration and monitoring of DMVPN clouds for larger deployments.

---

### **Configuration Steps: New vs. Old IOS**

#### **Old IOS Configuration Highlights**

1. Manually configure two GRE tunnels on each spoke router.

2. Establish NHRP (Next Hop Resolution Protocol) mappings for both DMVPN clouds.

3. Fine-tune routing metrics for hub preference.

4. Configure IPsec profiles for secure communication.

#### **New IOS Configuration Highlights**

1. Use enhanced NHRP commands for dynamic mapping and spoke-to-spoke tunneling.

2. Simplify IPsec integration with VTIs (Virtual Tunnel Interfaces).

3. Leverage EIGRP DMVPN stub routing or optimized OSPF configurations for faster convergence.

4. Enable new QoS policies for dynamic traffic prioritization.

---

### **Best Practices for Dual Hub, Dual DMVPN Setup**

1. **Plan Routing Metrics:** Clearly define primary and backup hub preferences using bandwidth or delay settings on the interfaces.

2. **Monitor and Optimize Performance:** Use tools like NetFlow or SNMP to monitor traffic and troubleshoot any bottlenecks.

3. **Implement Redundancy:** Ensure hubs are located in different geographic locations to avoid single points of failure.

4. **Test Failover:** Simulate hub failures to verify that spokes seamlessly reroute traffic to the backup hub.

---

### **Conclusion**

The transition to Cisco IOS 15.9(3)M10 and later brings significant improvements for dual-hub, dual-DMVPN architectures. Enhanced routing protocol performance, simplified configurations, and robust security make it easier to deploy and maintain such setups. While older routers and IOS versions were functional, they often required more manual intervention and suffered from performance limitations. The newer advancements ensure that enterprises can achieve the full potential of DMVPN for secure, scalable, and efficient connectivity.

Setting Up Dual Hub DMVPNs: Redundancy Made Easy with Modern Cisco IOS

Dual Hub DMVPN: Complete Configuration & Optimization Guide

📚 Table of Contents

• Introduction
• Why Dual Hub DMVPN
• Deployment Models
• Single DMVPN
• Dual DMVPN
• Routing Protocols
• IOS Enhancements
• CLI Examples
• Key Takeaways
• Related Articles

📖 Introduction

Dynamic Multipoint Virtual Private Network (DMVPN) is a scalable VPN solution that allows secure communication over public networks. When combined with a dual hub architecture, it provides high availability and redundancy.

💡 Core Concept: DMVPN uses GRE + IPsec + NHRP to dynamically build tunnels.

🚀 Why Dual Hub DMVPN?

• High Availability
• Fault Tolerance
• Load Sharing
• Reduced Downtime

🔽 Expand: Real-world Scenario

If Hub1 fails, spokes automatically reroute traffic to Hub2, ensuring uninterrupted service.

🧩 Deployment Models

1. Single DMVPN Cloud

• One tunnel interface
• Two hubs (dual NHS)
• Simple design

2. Dual DMVPN Cloud

• Two tunnel interfaces
• Separate routing domains
• Advanced traffic control

📡 Single DMVPN Configuration

In this model, all routers belong to the same DMVPN cloud.

Configuration Code

interface Tunnel0
 ip address 192.168.1.2 255.255.255.0
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 tunnel key 100
 tunnel protection ipsec profile IPSEC_PROFILE
 ip nhrp map 192.168.1.1 HUB1_PUBLIC_IP
 ip nhrp map 192.168.1.3 HUB2_PUBLIC_IP
 ip nhrp network-id 1
 ip nhrp nhs 192.168.1.1
 ip nhrp nhs 192.168.1.3

🔽 Expand Explanation

NHRP maps logical tunnel IPs to physical IPs. Dual NHS ensures redundancy.

🔁 Dual DMVPN Configuration

Each spoke connects to two hubs using separate tunnels.

interface Tunnel0
 ip address 192.168.1.2 255.255.255.0
 tunnel source GigabitEthernet0/0
 tunnel key 100
 ip nhrp nhs 192.168.1.1

interface Tunnel1
 ip address 192.168.2.2 255.255.255.0
 tunnel source GigabitEthernet0/1
 tunnel key 200
 ip nhrp nhs 192.168.2.1

🔽 Expand Benefits

Provides granular control and allows traffic engineering using routing metrics.

📊 Routing Protocols

EIGRP

• Easy metric manipulation
• Fast convergence

OSPF

• More complex
• Requires tuning

🔽 Expand Deep Comparison

EIGRP allows delay/bandwidth tuning, while OSPF uses cost-based routing requiring more manual adjustments.

⚙️ Cisco IOS 15.9 Enhancements

• Improved NHRP convergence
• DMVPN Phase 3 optimization
• Enhanced IPsec encryption
• Advanced logging tools

💡 Insight: Phase 3 enables direct spoke-to-spoke communication.

💻 CLI Output Examples

Show DMVPN Status

show dmvpn

Legend: Attrb --> S - Static, D - Dynamic
Tunnel0, NHRP Details
Type:Spoke, NHRP Peers:2
Peer NBMA Addr: 10.1.1.1
Peer NBMA Addr: 10.1.1.2

Debug Output

*Mar 1 12:00:01: NHRP: Resolution request sent
*Mar 1 12:00:02: NHRP: Resolution reply received

🔽 Expand CLI Explanation

Shows tunnel peers and NHRP resolution process.

🎯 Key Takeaways

• Dual Hub DMVPN ensures redundancy
• Single cloud = simple, less control
• Dual cloud = complex, more control
• EIGRP preferred for flexibility
• IOS 15.9 improves performance significantly

📘 Conclusion

Dual hub DMVPN designs provide scalable, resilient, and efficient networking solutions. Choosing between single and dual DMVPN depends on complexity vs control requirements.

The Evolution of GRE over IPsec: Old Way vs. New Way Post-ASA 9.7

🔐 GRE over IPsec (Cisco ASA 9.7) – Old vs New Way Explained

This guide explains how GRE over IPsec evolved in Cisco ASA environments. We will break down the old complex method and the new simplified ASA 9.7 method in a structured, beginner-friendly way.

---

📚 Table of Contents

• Introduction
• What is GRE?
• What is IPsec?
• Simple Networking Math (Encapsulation Model)
• Old Way (Pre-ASA 9.7)
• New Way (ASA 9.7+)
• Comparison Table
• CLI Output Examples
• Key Takeaways
• Related Articles

---

🌐 Introduction

GRE over IPsec is used to securely connect remote networks over the internet.

It combines:

• GRE → for encapsulating multiple protocols
• IPsec → for encryption and security

Together, they create a secure tunnel between sites.

---

📦 What is GRE?

Generic Routing Encapsulation (GRE) is a tunneling protocol.

GRE = "Wraps packets inside another packet"

Example:

Original Packet → [IP Packet]
GRE Tunnel → [GRE Header + IP Packet]

---

🔒 What is IPsec?

IPsec encrypts traffic so it cannot be read during transmission.

IPsec = "Locks the packet so only receiver can open it"

It ensures:

• Confidentiality 🔐
• Integrity 🧾
• Authentication ✔️

---

📐 Simple Math Behind GRE + IPsec Encapsulation

Let’s understand overhead in simple form.

Original Packet Size:

\[ P = 1500 \text{ bytes} \]

GRE adds overhead:

\[ G = 24 \text{ bytes} \]

IPsec adds overhead:

\[ I = 50 \text{ bytes} \]

Total Packet Size:

\[ T = P + G + I \]

\[ T = 1500 + 24 + 50 = 1574 \text{ bytes} \]

👉 More encapsulation = more overhead = slightly lower performance

---

⚠️ Old Way (Pre-ASA 9.7)

This method was complex and required multiple devices.

Key Problems

• GRE handled by routers
• IPsec handled by ASA
• More configuration effort
• Higher latency

Configuration Example

interface Tunnel0 ip address 192.168.1.1 255.255.255.0 tunnel source 10.1.1.1 tunnel destination 10.2.2.2 access-list GRE_ACL permit gre host 10.1.1.1 host 10.2.2.2 crypto map GRE_MAP 10 match address GRE_ACL crypto map GRE_MAP 10 set peer 10.2.2.2 crypto map GRE_MAP interface outside

CLI Output

Show Output

Tunnel Status: UP
Crypto Map Applied: YES
Routing: STATIC

---

🚀 New Way (ASA 9.7+)

Cisco introduced native GRE support in ASA 9.7.

Now ASA handles BOTH GRE + IPsec together

Benefits

• Less configuration
• No external router required
• Better performance
• Supports dynamic routing

Configuration Example

interface Tunnel0 ip address 192.168.1.1 255.255.255.0 tunnel source interface outside tunnel destination 10.2.2.2 tunnel protection ipsec profile GRE_IPSEC_PROFILE

---

📊 Old vs New Comparison

Feature	Old Way	New Way (ASA 9.7+)
GRE Handling	Router	ASA
IPsec Handling	ASA	ASA
Complexity	High	Low
Routing Support	Static mostly	Dynamic (OSPF/BGP)
Performance	Lower	Higher

---

🖥️ CLI Output Simulation

New ASA Output

Tunnel0 is UP
IPsec SA Established
GRE encapsulation active
Dynamic Routing: OSPF Enabled

Old Setup Output

Tunnel0 is UP
Crypto Map Applied
External Router Required
Routing: STATIC ONLY

---

💡 Key Takeaways

• GRE = packet encapsulation
• IPsec = encryption layer
• Old method = complex multi-device setup
• New method = unified ASA solution
• Performance improves with ASA 9.7+

---

🎯 Final Conclusion

The transition from the old GRE-over-IPsec method to ASA 9.7’s integrated approach significantly reduces complexity and improves performance.

For modern enterprise networks, the new method is clearly the recommended design.