Sign in Subscribe
CCNP-ENARSI

Understanding and Configuring NHRP in DMVPN

NHRP serves as the control plane for DMVPN networks, enabling dynamic tunnel endpoint discovery and direct spoke-to-spoke communication. This post covers essential NHRP configuration for single hub DMVPN deployments, including authentication, timers, and optimization features.

Jay Whale

• 3 min read
Understanding and Configuring NHRP in DMVPN

Next Hop Resolution Protocol (NHRP) forms the control plane backbone of Dynamic Multipoint VPN (DMVPN) networks, enabling dynamic discovery of tunnel endpoints and direct spoke-to-spoke communication. While DMVPN provides the overlay infrastructure, NHRP handles the critical task of mapping logical overlay addresses to physical underlay addresses, making scalable hub-and-spoke VPN architectures possible without static tunnel configurations.

NHRP's Role in DMVPN Architecture

NHRP operates as a client-server protocol within DMVPN, where the hub router functions as the Next Hop Server (NHS) and spoke routers act as Next Hop Clients (NHC). The protocol maintains a dynamic mapping database that associates tunnel IP addresses with their corresponding Non-Broadcast Multi-Access (NBMA) addresses - typically the public IP addresses of the physical interfaces.

When a spoke router needs to communicate with another spoke, NHRP enables direct tunnel establishment without traffic hairpinning through the hub. This optimization dramatically improves bandwidth utilization and reduces latency in spoke-to-spoke communications, particularly critical in DMVPN Phase 2 and Phase 3 deployments.

Core NHRP Configuration Components

NHRP configuration involves several key elements that must be properly aligned across all DMVPN participants. The fundamental configuration begins with enabling NHRP on the tunnel interface and defining the network identifier.

Hub Router NHRP Configuration

The hub router requires minimal NHRP configuration as it primarily serves as the central mapping server:

interface Tunnel0
 ip address 10.1.1.1 255.255.255.0
 ip nhrp network-id 100
 ip nhrp map multicast dynamic
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint

The ip nhrp network-id 100 command establishes a unique identifier for this DMVPN cloud. All participants must use the same network ID to participate in the same NHRP domain. The ip nhrp map multicast dynamic command enables dynamic multicast replication to registered spokes, essential for routing protocol adjacencies.

Spoke Router NHRP Configuration

Spoke routers require more detailed NHRP configuration to register with the hub and participate in dynamic mapping:

interface Tunnel0
 ip address 10.1.1.10 255.255.255.0
 ip nhrp network-id 100
 ip nhrp nhs 10.1.1.1 nbma 203.0.113.1 multicast
 ip nhrp registration no-unique
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint

The ip nhrp nhs command specifies the Next Hop Server (hub) with both its tunnel IP address and NBMA address. The multicast keyword enables the spoke to receive multicast traffic from the hub. The ip nhrp registration no-unique command allows the spoke to register even if another device with the same tunnel IP exists, useful in redundant scenarios.

Advanced NHRP Configuration for DMVPN Optimization

NHRP Hold Times and Registration

Optimizing NHRP timers improves convergence and reduces unnecessary control plane traffic:

interface Tunnel0
 ip nhrp holdtime 300
 ip nhrp registration timeout 60

The hold time determines how long NHRP mappings remain valid without refresh. The registration timeout controls how frequently spokes re-register with the hub. Shorter values provide faster convergence but increase control plane overhead.

NHRP Authentication

Securing NHRP communications prevents unauthorized devices from joining the DMVPN cloud:

interface Tunnel0
 ip nhrp authentication cisco123

All DMVPN participants must use identical authentication keys for successful NHRP operation.

NHRP Redirect and Shortcut Configuration

For DMVPN Phase 3 optimization, configure NHRP redirect on the hub and shortcut on spokes:

! Hub configuration
interface Tunnel0
 ip nhrp redirect

! Spoke configuration  
interface Tunnel0
 ip nhrp shortcut

NHRP redirect instructs the hub to send redirect messages when it forwards traffic between spokes. NHRP shortcut enables spokes to establish direct tunnels upon receiving redirect messages.

Verification and Troubleshooting Commands

Several show commands provide insight into NHRP operation and help identify configuration issues:

Router# show ip nhrp
10.1.1.10/32 via 10.1.1.10
   Tunnel0 created 00:05:23, expire 00:04:36
   Type: dynamic, Flags: registered nhop 
   NBMA address: 198.51.100.10

The show ip nhrp command displays the current NHRP mapping table, showing registered spokes and their NBMA addresses.

Router# show ip nhrp brief
   Target             Via            NBMA           Mode   Intfc   Claimed
   10.1.1.10/32       10.1.1.10      198.51.100.10   dynamic  Tu0    < >

Use show dmvpn for a comprehensive view of DMVPN status including NHRP mappings, IPsec sessions, and tunnel states.

Common NHRP Configuration Issues

Mismatched network IDs represent the most frequent configuration error, preventing spokes from registering with the hub. Verify network ID consistency across all devices using show ip nhrp.

Incorrect NBMA address specification in the ip nhrp nhs command prevents initial registration. Ensure the NBMA address matches the hub's actual source interface IP address.

Missing multicast mapping prevents routing protocol operation over DMVPN. Verify multicast capability using show ip nhrp multicast.

What's Next

With NHRP properly configured and operational, the next step involves implementing IPsec protection for DMVPN tunnels. Understanding how IPsec integrates with NHRP and GRE in DMVPN environments requires careful attention to crypto map configurations and their interaction with dynamic tunnel endpoints.

CCNP ENARSI study resources