Previous Page Next Page

Chapter 16. Dynamic Multipoint VPN (DMVPN)

VPN-based security solutions are increasingly popular and have proven to be an effective and secure technology for protecting sensitive data that is traversing insecure channel mediums, such as the Internet.

Traditional IPsec-based site-to-site, hub-to-spoke VPN deployment models do not scale well and are adequate only for small- and medium-sized networks. As demand for IPsec-based VPN implementation grows, organizations with large-scale enterprise networks require scalable and dynamic IPsec solutions that interconnect sites across the Internet with reduced latency, while optimizing network performance and bandwidth utilization.

The Dynamic Multipoint VPN (DMVPN) technology is used for scaling IPsec VPN networks by offering a large-scale IPsec VPN deployment model that allows the network to expand and realize its full potential. DMVPN offers scalability that enables zero-touch deployment models.

This chapter provides a complete overview of the DMVPN solution architecture, implementation, and various deployment scenarios.

DMVPN Solution Architecture

DMVPN allows IPsec VPN networks to better scale hub-to-spoke and spoke-to-spoke designs, thereby optimizing performance and reducing latency for communications between sites.

DMVPN offers a wide range of benefits, including the following:

With networks becoming geographically distributed, network availability over a secure channel is becoming a critical factor in designing scalable IPsec VPN solution designs. DMVPN solution architecture is by far the most effective and scalable solution available.

DMVPN Network Designs

DMVPN was introduced in multiple phases to address the various topological needs.

Figure 16-1 depicts the DMVPN phases illustrating the various network designs that can be implemented.

Figure 16-2 illustrates how spoke-to-spoke traffic flow in a hierarchical DMVPN (tree-based) design differs between Phase 2 and Phase 3 implementations. Before Phase 3, spoke-to-spoke tunnels were established through regional hubs. In Phase 3, spoke-to-spoke tunnels are established directly with each other, bypassing both the regional and central hubs.

DMVPN Solution Components

The DMVPN solution is a combination of several protocols and relies on the following Cisco-enhanced standard technologies. The major functional components include the following:

How DMVPN Works

DMVPN builds a dynamic tunnel overlay network. With the aid of Figure 16-3, the following points explain how DMVPN works:

Figure 16-3. Site-to-Site DMVPN Network

The spoke-to-spoke tunnels are established on demand whenever traffic is sent between the spokes. Thereafter, packets can bypass the hub and use the spoke-to-spoke tunnel directly. Refer to Figure 16-3 to better understand how this feature works.

DMVPN Data Structures

The following is a list of DMVPN data structures and how the interaction works to form a complete framework, as illustrated in Figure 16-4:

Figure 16-4. DMVPN Data Structures

Previous Page Next Page