Dual Hub Dual DMVPN Setup: Comparing Old vs New Cisco IOS Versions

🌐 Dual Hub Dual DMVPN – A Practical, Story-Driven Guide

Imagine your enterprise network as a transportation system.

You don’t want just one highway (hub)… because if it fails, everything stops.

So you build two highways, and every branch office (spoke) can use both.

That’s exactly what Dual Hub Dual DMVPN does.

---

📚 Table of Contents

• Architecture Explained
• Routing Decision Logic (Simple Math)
• Challenges in Old IOS
• Modern IOS Improvements
• Configuration Example
• CLI Output
• Best Practices
• Key Takeaways
• Related Articles

---

🏗️ Architecture Explained

• Two hubs → Hub1 & Hub2
• Two DMVPN clouds
• Each spoke connects to both hubs

👉 Result: Redundancy + Load balancing + Better control

---

📐 Routing Logic (Made Simple)

Routing decisions depend on metrics like delay, bandwidth, or cost.

Example (EIGRP Metric)

\[ Metric = \frac{10^7}{Bandwidth} + Delay \]

Lower metric = preferred path.

👉 If Hub1 has lower delay → traffic goes to Hub1 👉 If Hub1 fails → Hub2 takes over

Failover Logic

\[ Primary < Secondary \]

When primary path fails:

\[ Traffic \rightarrow Backup\ Hub \]

---

⚠️ Challenges in Older Cisco IOS

• High CPU usage (GRE + IPsec)
• Manual routing tweaks
• Complex configs
• Limited security features

Old CLI Example

interface Tunnel0
 ip nhrp map ...
 ip nhrp nhs ...

interface Tunnel1
ip nhrp map ...
ip nhrp nhs ... 

---

🚀 Cisco IOS 15.9(3)M10+ Improvements

• Better encryption performance 🔐
• Faster convergence ⚡
• Smarter routing (EIGRP stub)
• Simplified QoS 🎯
• IKEv2 support

👉 Less manual work, more automation

---

⚙️ Configuration Example (Modern)

interface Tunnel0 ip address 10.0.0.1 255.255.255.0 tunnel source Gig0/0 tunnel mode gre multipoint ip nhrp network-id 1 ip nhrp nhs 10.0.0.254

---

🖥️ CLI Output

Show DMVPN Status

Router#show dmvpn

Tunnel0, Type:Hub, NHRP Peers: 10
Tunnel1, Type:Hub, NHRP Peers: 10 

---

🛠️ Best Practices

• Use different ISPs for hubs 🌍
• Set clear routing metrics
• Monitor traffic regularly
• Test failover scenarios

---

💡 Key Takeaways

• Dual DMVPN improves reliability
• Modern IOS simplifies configuration
• Math helps control routing behavior
• Failover becomes seamless

---

🎯 Final Thought

Dual Hub Dual DMVPN isn’t just redundancy—it’s intelligent networking.

And with modern IOS, it’s finally practical to deploy at scale.

Redundant Interfaces in Cisco ASA Post-9.7: A Modern Approach to Interface Resiliency

🚀 Cisco ASA Interface Redundancy Post-9.7

📘 Introduction

Traditional ASA redundancy worked like a backup generator — idle until failure. Modern ASA (post-9.7) works more like a power grid — all lines active, sharing load.

💡 Core Shift: From Passive Redundancy ➝ Active Load Sharing

---

📊 Architecture Comparison

🔴 Pre-9.7 Redundant Interface

[Switch] | --------- | | [Active] [Standby] ASA Interface

Only one link carries traffic. The standby link is unused until failure. This leads to:

• Wasted bandwidth
• Slower failover recovery
• Single point of performance bottleneck

---

🟢 Post-9.7 EtherChannel Model

[Switch] / | \ Link1 Link2 Link3 \ | / [Port-Channel] | ASA

All links actively forward traffic simultaneously. If one fails, traffic automatically redistributes.

🎯 Key Insight: Failure does not interrupt traffic — it only reduces capacity.

---

🔗 EtherChannel Deep Explanation

What really happens inside EtherChannel?

EtherChannel uses a hashing algorithm (based on source/destination IP, MAC, or port) to distribute traffic across links.

This means:

• A single flow stays on one link (no packet reordering)
• Multiple flows are balanced across links

Example:

• User A → Link1
• User B → Link2
• User C → Link3

💡 Important: Load balancing is per-flow, not per-packet.

---

⚙️ LACP Deep Explanation

Why LACP matters

Without LACP, misconfigurations can create loops or blackholes.

LACP ensures:

• Both sides agree on channel membership
• Faulty links are removed automatically
• Consistency between switch and ASA

It continuously sends control packets (LACPDU) to monitor link health.

🎯 Real-world Tip: Always use LACP instead of static EtherChannel.

---

💻 Configuration Example

📌 Code

interface GigabitEthernet0/0
 channel-group 1 mode active

interface GigabitEthernet0/1
 channel-group 1 mode active

interface GigabitEthernet0/2
 channel-group 1 mode active

interface Port-channel1
 nameif outside
 security-level 0
 ip address 192.168.1.1 255.255.255.0
 lacp max-bundle 8

📟 Verification

ASA# show lacp neighbor

Port      Status
Gi0/0     Active
Gi0/1     Active
Gi0/2     Active

💡 Best Practice: Minimum 2 links, ideally 3+ for resilience.

---

🏗️ High Availability Design

📊 Topology Diagram

[Core Switch] / | \ Link1 Link2 Link3 / | \ [ASA-1] [ASA-2] (Failover Pair)

Both ASAs connect via EtherChannel to the switch.

• Traffic continues even if one link fails
• No full failover triggered unnecessarily
• Better uptime and stability

🎯 Design Advantage: Avoids unnecessary failover events.

---

🧠 Advanced Understanding

Why MAC persistence matters

Changing MAC addresses causes ARP instability.

Persistent MAC ensures:

• No ARP refresh delays
• No traffic drops during failover
• Stable network behavior

Why preemption is less relevant now

In old systems, only one link was active → preemption mattered.

Now:

• All links active
• No “primary vs backup” concept

So preemption becomes irrelevant at interface level.

---

🏁 Conclusion

• ✔ Active-active redundancy
• ✔ Load sharing improves performance
• ✔ LACP automates stability
• ✔ EtherChannel simplifies architecture

🚀 Final Insight: Modern ASA redundancy is about efficiency, not just backup.

---

📚 Related Articles

• Simplified NAT Configuration
• Security Contexts
• Traffic Policing
• Time-Based ACLs
• IP Address Translation

---

✍️ Data Dive with Subham

Simplified MAC Address Management in Cisco ASA Failover Post-9.7

Cisco ASA Failover MAC Address Handling

Understanding Pre-9.7 vs Post-9.7 Behavior in Active/Standby & Active/Active Deployments

In Cisco Adaptive Security Appliance (ASA) environments, maintaining network consistency during failover is critical, particularly when handling MAC address assignments. In earlier ASA versions, such as pre-9.7, administrators had to be mindful of potential disruptions when primary and secondary units came online at different times.

However, with the release of ASA software version 9.7 and later, Cisco introduced enhancements that greatly simplified the handling of MAC addresses during failover, improving network reliability and minimizing potential disruptions.

🔽 Pre-9.7 Approach: Virtual MAC Addresses

Before ASA 9.7, when configuring Active/Standby failover, the MAC addresses for the interfaces on the primary unit were used on both units when the primary was active.

If the secondary unit booted first and became active, it used its own burned-in MAC addresses. Once the primary came online, MAC addresses would shift — causing ARP and switch table relearning.

To prevent this, administrators configured virtual MAC addresses.

interface GigabitEthernet0/1
 mac-address 0011.2233.4455 standby 0011.2233.4456
        

✔ Guaranteed consistent MAC usage regardless of boot order ❌ Required manual configuration on every interface

🔽 Post-9.7 Enhancements: Automatic MAC Synchronization

Starting with ASA 9.7, Cisco introduced Auto MAC Address Sync, removing the need for manual virtual MAC configuration in Active/Standby setups.

• Primary MACs auto-synced to standby
• No MAC change during failover
• Reduced ARP & switch disruptions

ASA# show failover mac
Interface Gi0/1 MAC synchronized
Interface Gi0/2 MAC synchronized

🔽 Active/Active Failover Considerations

In Active/Active configurations, administrators still define MAC addresses per failover group to ensure consistency.

failover group 1
 mac-address 0011.2233.4455
failover group 2
 mac-address 0011.2233.4466
        

🔽 ASA 9.7+ Failover Configuration Example

1. Enable Failover

failover
failover lan unit primary
failover lan interface failover-link GigabitEthernet0/3
failover link stateful-link GigabitEthernet0/3
        

2. Configure Standby IP

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
        

3. Verify Status

ASA# show failover
This host: Primary - Active
Other host: Secondary - Standby Ready

💡 Key Takeaways

• Pre-9.7 ASAs required manual virtual MAC configuration
• ASA 9.7+ automatically synchronizes MAC addresses
• Active/Standby is now zero-touch for MAC handling
• Active/Active still requires MACs per failover group
• Upgrading significantly reduces operational risk

Cisco ASA Failover MAC Handling • Structured Technical Reference