Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

DMVPN with Static Routes

Have anybody done a DMVPN using static routes instead of using EIGRP or OSPF ? I'm trying to explore the idea to see if I can work around the Single DMVPN using dual hub. Thanks.

Please post your experiences if any. Thanks.

New Member

Re: DMVPN with Static Routes

Any update on this ?

New Member

Re: DMVPN with Static Routes

nope.. no update.

New Member

Re: DMVPN with Static Routes

I assume the following implys that I can use Dual Hub - dual DMVPN layout if I don't use multicast routing protocol on the 2nd layout. I dun need dynamic tunnels on the 2nd hub, just on the first.

From CCO -

Dual Hub - Dual DMVPN Layout

The dual hub with dual DMVPN layout is slightly more difficult to set up, but it does give you better control of the routing across the DMVPN. The idea is to have a two separate DMVPN "clouds". Each hub (two in this case) is connected to one DMVPN subnet ("cloud") and the spokes are connected to both DMVPN subnets ("clouds"). Since the spoke routers are routing neighbors with both hub routers over the two GRE tunnel interfaces, you can use interface configuration differences (such as bandwidth, cost and delay) to modify the dynamic routing protocol metrics to prefer one hub over the other hub when they are both up.

Note: The above issue is usually only relevant if the hub routers are co-located. When they are not co-located, normal dynamic routing will likely end up preferring the correct hub router, even if the destination network can be reached via either hub router.

You can use either p-pGRE or mGRE tunnel interfaces on the spoke routers. Multiple p-pGRE interfaces on a spoke router can use the same tunnel source ... IP address, but multiple mGRE interfaces on a spoke router must have a unique tunnel source ... IP address. This is because when IPsec is initiating, the first packet is an ISAKMP packet which needs to be associated with one of the mGRE tunnels. The ISAKMP packet only has the destination IP address (remote IPsec peer address) with which to make this association. This address is matched against the tunnel source ... address, but since both tunnels have the same tunnel source ... address, the first mGRE tunnel interface is always matched. This means that incoming multicast data packets may be associated with the wrong mGRE interface, breaking any dynamic routing protocol.

GRE packets themselves do not have this problem since they have the tunnel key ... value to differentiate between the two mGRE interfaces. Cisco is currently looking into methods of removing the unique tunnel source ... IP address restriction when using multiple mGRE tunnel interfaces on the same router. In the meantime, p-pGRE tunnels will be used in this dual hub with dual DMVPN layout. In the p-pGRE tunnel case, both the tunnel source ... and the tunnel destination ... IP addresses can be used for matching.

CreatePlease login to create content