Sign in Subscribe
CCNP-ENARSI

Configuring Single Hub DMVPN with GRE and mGRE

Comprehensive guide to configuring single hub DMVPN using GRE and mGRE technologies. Covers hub and spoke router configurations, verification commands, and troubleshooting methodology for scalable VPN deployments.

Jay Whale

• 4 min read
Configuring Single Hub DMVPN with GRE and mGRE

Understanding Single Hub DMVPN Architecture

Dynamic Multipoint VPN (DMVPN) revolutionizes traditional hub-and-spoke VPN deployments by enabling dynamic spoke-to-spoke connectivity without requiring static tunnel configurations. In a single hub DMVPN topology, the hub router maintains permanent mGRE tunnels to all spokes, while spokes can dynamically establish direct tunnels to each other when needed.

The foundation of DMVPN relies on three core technologies: multipoint GRE (mGRE) tunnels for the overlay network, Next Hop Resolution Protocol (NHRP) for dynamic address resolution, and IPSec for encryption. This VPN setup guide focuses on the GRE and mGRE configuration aspects that make DMVPN scalable beyond traditional point-to-point solutions.

Hub Router Configuration

The hub router serves as the NHRP server and requires an mGRE tunnel interface configured for multipoint operation. Here's the essential configuration:

interface Tunnel0
 ip address 10.0.0.1 255.255.255.0
 no ip redirects
 ip mtu 1400
 ip nhrp authentication DMVPN_KEY
 ip nhrp map multicast dynamic
 ip nhrp network-id 100
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 tunnel key 123456

Critical parameters in this configuration include tunnel mode gre multipoint, which enables the mGRE functionality, and ip nhrp map multicast dynamic, allowing dynamic spoke registration for multicast traffic replication. The tunnel key provides an additional layer of tunnel identification beyond source and destination addressing.

The hub must also be configured with proper routing to advertise reachability to spoke networks. Using EIGRP as the routing protocol:

router eigrp 100
 network 10.0.0.0 0.0.0.255
 network 192.168.1.0 0.0.0.255
 no auto-summary

Spoke Router Configuration

Spoke routers use point-to-multipoint GRE tunnels with static NHRP mappings to the hub. Each spoke configuration follows this pattern:

interface Tunnel0
 ip address 10.0.0.10 255.255.255.0
 no ip redirects
 ip mtu 1400
 ip nhrp authentication DMVPN_KEY
 ip nhrp map 10.0.0.1 198.51.100.1
 ip nhrp map multicast 198.51.100.1
 ip nhrp network-id 100
 ip nhrp nhs 10.0.0.1
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 tunnel key 123456

The spoke configuration includes ip nhrp nhs 10.0.0.1 to designate the Next Hop Server (hub), and ip nhrp map 10.0.0.1 198.51.100.1 to create a static mapping between the hub's tunnel IP and its NBMA (physical) address. The ip nhrp map multicast command ensures multicast traffic reaches the hub for routing protocol adjacencies.

Spoke routing configuration mirrors the hub's setup:

router eigrp 100
 network 10.0.0.0 0.0.0.255
 network 192.168.10.0 0.0.0.255
 no auto-summary

Verification and Troubleshooting

Successful DMVPN operation requires verification at multiple layers. Start with NHRP registration status on the hub:

Hub# show ip nhrp
10.0.0.10/32 via 10.0.0.10
   Tunnel0 created 00:05:23, expire 01:54:37
   Type: dynamic, Flags: unique registered used nhop
   NBMA address: 203.0.113.10

This output confirms spoke registration with the hub's NHRP cache. On spoke routers, verify the NHS relationship:

Spoke# show ip nhrp nhs
10.0.0.1 RE via 10.0.0.1
   Tunnel0 created 00:05:45, expire 01:54:15
   Type: static, Flags: implicit used
   NBMA address: 198.51.100.1

The "RE" flag indicates the NHS is reachable and responding. Test end-to-end connectivity and examine the tunnel interface statistics:

Hub# show interfaces tunnel0
Tunnel0 is up, line protocol is up
  Hardware is Tunnel
  Internet address is 10.0.0.1/24
  MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec
  Tunnel linestate evaluation up
  Tunnel source 198.51.100.1 (GigabitEthernet0/0)
  Tunnel Subblocks:
    Tunnel0 source tracking subblock associated with GigabitEthernet0/0
     Set of tunnels with source GigabitEthernet0/0, 1 member (includes iterators), on interface

Advanced Configuration Considerations

Production DMVPN deployments require additional optimization. Configure NHRP holdtime to match your network's stability requirements:

interface Tunnel0
 ip nhrp holdtime 300

For environments with asymmetric routing or complex topologies, disable split-horizon on the hub to ensure proper route advertisement:

interface Tunnel0
 no ip split-horizon eigrp 100

Monitor NHRP traffic and resolution requests using debug commands during troubleshooting:

debug ip nhrp
debug tunnel events

Common Implementation Pitfalls

Several configuration mistakes can prevent proper DMVPN operation. Mismatched network-id values between hub and spokes will prevent NHRP registration. Incorrect NBMA address mappings cause registration failures and should be verified against actual interface addressing.

MTU mismatches between physical and tunnel interfaces can cause fragmentation issues. The recommended practice is setting tunnel MTU to 1400 bytes to accommodate GRE and potential IPSec overhead while avoiding fragmentation on standard 1500-byte Ethernet links.

What's Next

With the foundation of single hub DMVPN using GRE and mGRE established, the next logical step is implementing IPSec encryption to secure the DMVPN overlay. This involves configuring crypto maps, transform sets, and ISAKMP policies that integrate seamlessly with the existing mGRE infrastructure while maintaining the dynamic spoke-to-spoke capabilities that make DMVPN so powerful for enterprise deployments.

CCNP ENARSI study resources