DMVPN configuration

From Wiki Knowledge Base | Teltonika
This is the approved revision of this page, as well as being the most recent.

Introduction[edit | edit source]

Dynamic Multipoint VPN (DMVPN) is a dynamic tunneling form of a virtual private network (VPN) supported on Cisco routers. This article contains step-by-step instructions on how to configure DMVPN between a "Hub" and two "Spokes" using RUT9xx routers.

Prerequisites and overview[edit | edit source]

You will need:

  • At least two RUT9xx routers
  • A PC to configure the routers
  • (optional) A Cisco router
  • HUB has to be reachable from spokes (HUB must have Public IP address, or has to be in the same WAN network as Spokes)

Configuration scheme:

Dmvpn overview.png

Spoke configuration[edit | edit source]

This section contains information on how to configure DMVPN Spokes. Firstly, we'll configure the DMVPN instance to make to the connection possible. Then we'll set the Border Gateway Protocol (BGP) parameters as our dynamic routing solution.

Note: at the moment, BGP is the only stable dynamic routing solution that can work with DMVPNs.

Spoke configuration: DMVPN[edit | edit source]


Navigate to the Services → VPN → DMVPN page and follow the instructions provided below.

Step 1: create a new DMVPN instance:
Dmvpn 1 v1.png


Step 2: configure DMVPN parameters:
Dmvpn 2 1 v1.png


Step 3: configure GRE parameters:
Dmvpn 2 2 v1.png


Step 4: configure IPsec parameters:
Dmvpn 2 3 v1.png


Step 5: configure NHRP parameters or leave default values:
Dmvpn 2 4 v1.png


Step 6: save changes


Repeat this on different routers as many times as the number of Spokes that you need. Remember that other Spokes will have different LAN, WAN and GRE IP addresses.

Spoke configuration: BGP[edit | edit source]


Navigate to the Network → Routing → Dynamic Routes → BGP Protocol page and follow the instructions provided below.

Step 1: enable BGP:
Dmvpn 5 1 v1.png


Step 2: configure BGP instance:
Dmvpn 4 2 v1.png


Step 3: configure BGP peer:
Dmvpn 5 3 v1.png


Step 4: save changes

Hub configuration[edit | edit source]

Hub configuration: DMVPN[edit | edit source]


Navigate to the Services → VPN → DMVPN page and follow the instructions provided below.

Step 1: create a new DMVPN instance:
Dmvpn 2 0 v1.png


Step 2: configure DMVPN parameters:
Dmvpn 3 1 v1.png


Step 3: configure GRE parameters:
Dmvpn 3 2 v1.png


Step 4: configure IPsec parameters:
Dmvpn 3 3 v1.png


Step 5: configure NHRP parameters or leave default values:
Dmvpn 3 4 v1.png


Step 6: save changes

Hub configuration: BGP[edit | edit source]


Navigate to the Network → Routing → Dynamic Routes → BGP Protocol page and follow the instructions provided below.

Step 1: enable BGP:
Dmvpn 4 1 v1.png


Step 2: configure BGP instance:
Dmvpn 4 2 v1.png


Step 3: configure BGP peer group:
Dmvpn 4 3 v1.png


Step 4: save changes

Cisco configuration[edit | edit source]

If you plan on using a Cisco router with this topology, you can use the configuration provided in this section. The configuration is set in accordance with the configuration scheme in section 2 of this article.

Cisco Spoke configuration: DMVPN[edit | edit source]


crypto isakmp policy 1
encr aes
hash md5
authenticatio pre-share
group 5
!
crypto isakmp key 1234 address 192.168.1.30
!
!
crypto ipsec transform-set DMVPN-TS esp-3des esp-md5-sha256
mode transport
!
crypto ipsec profile DMVPN
set security-association lifetime secnds 86400
set transform-set DMVPN-TS 
!
interface Tunnel0
description mGRE - DMVPN Tunnel
ip address 10.1.1.1 255.255.255.0
ip nhrp network-id 1
ip nhrp nhs 10.1.1.3 nbma 192.168.1.30
ip nhrp shortcut
ip nhrp redirect
tunnel source GigabitEthernet0/0/1
tunnel destination 192.168.1.30
tunnel key 1234
tunnel protectio ipsec profile DMVPN
!
interface GigabitEthernet0/0/1
description Wired DMVPN
ip address 192.168.1.100 255.255.255.0
negotiation auto

Cisco Spoke configuration: BGP[edit | edit source]


router bgp 65001
bgp log-neighbor-changes
network 10.1.1.0 mask 255.255.255.0
neighbor spokes-ibgp peer-group
neighbor spokes-ibgp remote-as 65001
neighbor spokes-ibgp route-reflector-client
neighbor spokes-ibgp soft-reconfiguration inbound
neighbor 10.1.1.3 peer-group spokes-ibgp

Cisco Hub configuration[edit | edit source]


interface Tunnel0
description mGRE - DMVPN Tunnel
ip address 10.1.1.1 255.255.255.0
ip nhrp network-id 1
ip nhrp nhs dynamic nbma multicast
ip nhrp shortcut
ip nhrp redirect
tunnel source GigabitEthernet0/0/1
tunnel key 1234
tunnel protection ipsec profile DMVPN
!
router bgp 65001
bgp log-neighbor-changes
network 10.1.1.0 mask 255.255.255.0
neighbor spokes-ibgp peer-group
neighbor spokes-ibgp remote-as 65001
neighbor spokes-ibgp route-reflector-client
neighbor spokes-ibgp soft-reconfiguration inbound
neighbor 10.1.1.3 peer-group spokes-ibgp
neighbor 10.1.1.2 peer-group spokes-ibgp