Jump to content

Dynamic Multipoint Virtual Private Network

From Wikipedia, the free encyclopedia

Dynamic Multipoint Virtual Private Network (DMVPN)[1] is a dynamic tunneling form of a virtual private network (VPN) supported on Cisco IOS-based routers, and Huawei AR G3 routers,[2] and on Unix-like operating systems.

Process

[edit]

DMVPN provides the capability for creating a dynamic-mesh VPN network without having to pre-configure (static) all possible tunnel end-point peers, including IPsec (Internet Protocol Security) and ISAKMP (Internet Security Association and Key Management Protocol) peers.[3] DMVPN is initially configured to build out a hub-and-spoke network by statically configuring the hubs (VPN headends) on the spokes, no change in the configuration on the hub is required to accept new spokes. Using this initial hub-and-spoke network, tunnels between spokes can be dynamically built on demand (dynamic-mesh) without additional configuration on the hubs or spokes.[citation needed] This dynamic-mesh capability alleviates the need for any load on the hub to route data between the spoke networks.

Technologies

[edit]
  • Next Hop Resolution Protocol, RFC 2332
  • Generic Routing Encapsulation (GRE), RFC 1701, or multipoint GRE if spoke-to-spoke tunnels are desired
  • An IP-based routing protocol, EIGRP, OSPF, RIPv2, BGP or ODR (DMVPN hub-and-spoke only).[4]
  • IPsec (Internet Protocol Security) using an IPsec profile, which is associated with a virtual tunnel interface in IOS software. All traffic sent via the tunnel is encrypted per the policy configured (IPsec transform set)

Internal routing

[edit]

Routing protocols such as OSPF, EIGRP v1 or v2 or BGP are generally run between the hub and spoke to allow for growth and scalability. Both EIGRP and BGP allow a higher number of supported spokes per hub.[5]

Encryption

[edit]

As with GRE tunnels, DMVPN allows for several encryption schemes (including none) for the encryption of data traversing the tunnels. For security reasons Cisco recommend that customers use AES.[6]

Phases

[edit]

DMVPN has three phases that route data differently.

  • Phase 1: All traffic flows from spokes to and through the hub.
  • Phase 2: Start with Phase 1 then allows spoke-to-spoke tunnels based on demand and triggers.
  • Phase 3: Starts with Phase 1 and improves scalability of and has fewer restrictions than Phase 2.

References

[edit]
  1. ^ Cisco engineers. "Dynamic Multipoint IPsec VPNs (Using Multipoint GRE/NHRP to Scale IPsec VPNs)". Cisco. Cisco. Retrieved 24 September 2017.
  2. ^ Huawei DSVPN Configuration
  3. ^ Kurniadi, S. H.; Utami, E.; Wibowo, F. W. (Dec 2018). "Building Dynamic Mesh VPN Network using MikroTik Router". Journal of Physics: Conference Series. 1140: 012039. doi:10.1088/1742-6596/1140/1/012039. ISSN 1742-6596.
  4. ^ DMVPN Design Guide: Using a Routing Protocol Across the VPN
  5. ^ DMVPN Design Guide: Routing Protocol Configuration
  6. ^ DMVPN Design Guide: Best Practices and Known Limitations
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Dynamic_Multipoint_Virtual_Private_Network&oldid=1187881230"