One interface, many peers
mGRE lets a router use one tunnel interface for many remote routers.
DMVPN: Complete Guide
Build a clear mental model of Dynamic Multipoint VPN, then practice GRE, mGRE, NHRP, IPsec, all three DMVPN phases, direct spoke paths, and evidence-led verification.
What You Will Learn
- What DMVPN is and why it is useful
- The most important facts to remember
- How mGRE, NHRP, routing and IPsec work together
- How a spoke finds another spoke
- The difference between Phase 1, Phase 2 and Phase 3
- How to choose a DMVPN phase
- How routing and IPsec fit into the design
- Simple definitions for common DMVPN terms
- Which lab to study next
DMVPN in One Minute
Dynamic Multipoint Virtual Private Network (DMVPN) is a Cisco WAN design. It normally uses one or more central routers called hubs and many branch routers called spokes.
Every spoke first connects to the hub. Depending on the DMVPN phase, two spokes may also create a direct tunnel when they need to exchange traffic. This saves hub bandwidth and can reduce delay between branches.
Automatic address discovery
NHRP tells routers which public or transport address belongs to a tunnel address.
Normal IP routing
EIGRP, OSPF, BGP or static routes carry branch network information across the tunnel.
Optional encryption
IPsec protects the tunnel when traffic crosses an untrusted network such as the Internet.
Important: DMVPN is not one protocol. It is a design that combines mGRE, NHRP, routing and usually IPsec.
Key Takeaways
- mGRE improves scale: one tunnel interface can communicate with many sites.
- NHRP finds peers: it maps a tunnel address to the peer's real transport address.
- Phase 1 uses the hub: all spoke-to-spoke traffic passes through the hub.
- Phase 2 builds direct tunnels: the route must point to the remote spoke.
- Phase 3 adds shortcuts: the hub can summarize routes while active traffic moves to a direct path.
- IPsec provides security: use it when DMVPN crosses the public Internet or another untrusted network.
Before You Start
You will understand this guide more easily if you already know the basics of IP routing, VPN tunnels, GRE and hub-and-spoke networks. The GRE foundation lab is a good starting point if GRE is new to you.
Why Use DMVPN?
With normal point-to-point GRE, every tunnel has one source and one destination. A few sites are easy to manage, but a large network needs many tunnel interfaces and many repeated peer settings. A full mesh becomes harder to build each time a new branch is added.
DMVPN removes much of that manual work. The hub can accept new spokes dynamically, and the spokes can learn how to reach one another only when traffic needs a direct path.
HubCentral NHRP server
IP underlayInternet, MPLS or private WAN
SpokesBranch routers that register with the hub
The Four Main Building Blocks
| Part | What it does | Simple way to remember it |
|---|---|---|
| mGRE | Lets one tunnel interface send GRE packets to many remote routers. | The shared tunnel |
| NHRP | Maps a private tunnel IP address to the router's transport address. | The address book |
| Routing | Advertises which LAN networks are behind each router. | The path chooser |
| IPsec | Encrypts and authenticates traffic across an untrusted network. | The security layer |
Underlay and overlay
The underlay is the real transport network. It must be able to carry packets between the routers' Internet-facing or WAN addresses. The overlay is the private tunnel network built on top of it.
Underlay address
The real address used to deliver the packet across the WAN. DMVPN calls this the NBMA address.
Overlay address
The private address on the DMVPN tunnel interface. Routing neighbors use this network.
How NHRP Helps Two Spokes Connect
mGRE can send packets to many places, but it still needs the correct transport destination. NHRP provides that information.
- Register: Each spoke tells the hub its tunnel address and current NBMA address.
- Ask: Spoke 1 needs Spoke 2, so it asks the hub for Spoke 2's NBMA address.
- Reply: NHRP returns the mapping for Spoke 2.
- Connect: When the selected DMVPN phase allows it, the spokes send traffic directly through an on-demand tunnel.
NBMA in plain English:
NBMA means the address used to reach a router through the transport network. On an Internet DMVPN, it is often the router's public IP address. NHRP maps the private tunnel address to this transport address.
DMVPN Phase 1, Phase 2 and Phase 3
| Phase | Traffic path | Routing rule | Main trade-off |
|---|---|---|---|
| Phase 1 | Spoke-to-spoke traffic always goes through the hub. | A summary or default route toward the hub is enough. | Simple, but the hub carries all branch traffic. |
| Phase 2 | Spokes can build a direct tunnel after NHRP resolution. | The route must keep the remote spoke as the next hop. | Direct paths work, but hub route summarization is limited. |
| Phase 3 | The first packets may cross the hub; later packets use a direct shortcut. | The hub can advertise summaries or a default route. | More scalable, but redirect and shortcut behavior must be understood. |
Phase 1: hub only
The hub uses mGRE. Spokes normally use point-to-point GRE and cannot create direct spoke tunnels.
Phase 2: direct next hop
All routers use mGRE. The routing table must point to the remote spoke before a direct tunnel can form.
Phase 3: redirect and shortcut
The hub tells a spoke when a better direct path exists. The spokes then resolve each other through NHRP.
Which DMVPN Phase Should You Choose?
The phase changes how traffic moves and how much routing detail the spokes need. Use the design requirements—not only the phase number—to make the choice.
Choose Phase 1when simple, central forwarding is more important than direct branch paths.
Choose Phase 2when branches need direct paths and the network can carry specific spoke routes with the correct next hop.
Choose Phase 3when you need direct paths together with route summarization or a default route from the hub.
For a new scalable designPhase 3 is commonly the strongest starting point, subject to platform support and migration needs.
Do not mix up routing and forwarding: In Phase 3, a route may still point toward the hub even after NHRP creates a direct forwarding shortcut between two spokes.
Routing and IPsec
Routing chooses the logical path
DMVPN can work with EIGRP, OSPF, BGP, RIP or static routes. The important detail is the route's next-hop address. Phase 2 needs the remote spoke to remain the next hop. Phase 3 can use the hub as the routing next hop and then create a forwarding shortcut.
IPsec protects the traffic
GRE and NHRP do not encrypt data. If the underlay is the public Internet, use an IPsec tunnel-protection profile to provide confidentiality, integrity and peer authentication.
Build in the right order: First prove that the underlay works. Next bring up GRE, NHRP and routing. Add IPsec after the basic overlay is stable. This makes troubleshooting much easier.
DMVPN Terms in Simple English
| Term | Meaning |
|---|---|
| Hub | The central router that spokes register with and normally use to exchange routes. |
| Spoke | A branch router that connects to the hub and may create direct tunnels to other spokes. |
| NHS | Next Hop Server—the NHRP role normally performed by the hub. |
| NBMA address | The router's address on the transport network, often its public Internet address. |
| Tunnel address | The router's private IP address inside the DMVPN overlay. |
| NHRP redirect | A Phase 3 message from the hub telling a spoke that a better direct path exists. |
| NHRP shortcut | The direct spoke-to-spoke forwarding entry created after NHRP resolution. |
Recommended Study Order
- Review the detailed DMVPN introduction and design checks.
- Build point-to-point GRE and learn the underlay/overlay boundary.
- Build Phase 1 and prove that traffic crosses the hub.
- Build Phase 2 and trigger a direct spoke-to-spoke tunnel.
- Build Phase 3 and verify NHRP redirect and shortcut.
- Build the complete DMVPN over IPsec practical.
DMVPN Frequently Asked Questions
Why does DMVPN need NHRP?
mGRE has no fixed destination for every peer. NHRP maps a tunnel address to the peer's transport address so the router knows where to send the GRE packet.
Does GRE encrypt DMVPN traffic?
No. GRE carries the packets and supports routing traffic, but IPsec supplies encryption, integrity checking and peer authentication.
Which phases support direct spoke-to-spoke traffic?
Phase 2 and Phase 3 support direct spoke-to-spoke tunnels. Phase 1 always sends spoke-to-spoke traffic through the hub.
Why is Phase 3 easier to scale?
The hub can advertise a summary or default route while NHRP redirects active traffic to a direct spoke-to-spoke shortcut. Phase 2 normally needs more specific routes.
Can a spoke use a changing public IP address?
Yes. A spoke can register its current transport address with the hub. The hub address should remain stable so every spoke can find the NHRP server.