what is the use cases to choose/prefer one of the below WAN VPN tech over other

[Ibrahim Jamil]

Hi

what is the use cases to choose/prefer one of the below VPN tech over other

DMVPN :as per my knowledge , DMVPN works over internet

GETVPN

FLEXvPN

[Rob Ingram]

Hi,

Try page 25 on this cisco live presentation

Ultimately:

DMVPN/FlexVPN - both work over the internet.

DMVPN is preferred for large scale Hub-Spoke + Spoke-to-Spoke

FlexVPN is preferred for Hub-Spoke, IOT and remote access

GETVPN - Private IP network only (MPLS), preserves IP header, so not routable on internet.

What is your use case? perhaps we can identify which best fits your requirements

HTH

[Ibrahim Jamil]

thanks RJI

Will post things here later , stay tuned :) ,

so far we choosed DMVPN  with dual hub , 2 x 2921 routers sits in DMZ Behind Firewall

any online document

thanks

[Rob Ingram]

Hi, You probably want to be running DMVPN Phase 3 and the Next Gen Encryption - use IKEv2 rather than v1 (isakmp).

Here are some useful links and examples:

https://www.cisco.com/c/en/us/about/security-center/next-generation-cryptography.html

http://www.labminutes.com/video/sec

https://integratingit.wordpress.com/2016/10/12/configuring-dmvpn-phase-3-dual-hub/

https://www.cisco.com/c/en/us/support/docs/security/dynamic-multipoint-vpn-dmvpn/211292-Configure-Phase-3-Hierarchical-DMVPN-wit.html

Good luck

[Ibrahim Jamil]

Hello Raji

thanks for usefull links

I need config example while the Dual VPN routers sits in DMZ behind  dual firewalls , non-of the above mentioned that

thanks

[Rob Ingram]

I doubt there are any/many post out there matching your exact scenario, but at a minimum you will need to allow the traffic on your firewall:

If not natting - UDP 500 and ESP
If natting UDP 500 and UDP 4500 (ESP would be encapsulated inside UDP 4500, so you don't specifically need to allow that).

If natting, when it comes to the configuration of the spokes you'd need to specify the nbma address of the Hub to be the natted IP address.

HTH