DMVPN with FVRF

Overview

Consider the configuration for separating underlay and overlay networks with FVRF in DMVPN (Dynamic Multipoint VPN) Internet VPN .

DMVPN(Dynamic Multipoint VPN) Overview

The default GRE tunnel or IPSec VTI is a point-to-point connection. If there are multiple sites communicating via Internet VPN, point-to-point connections are not efficient. Tunnel interface configurations can be complicated.

Therefore, we use DMVPN, which is based on multipoint GRE (hereafter referred to as mGRE) tunnels. The mGRE tunnel allows for a multi-access overlay network. That is, an overlay network that allows two or more routers to be connected on the same network. Routing protocols can be run on the mGRE tunnel to dynamically learn route information via the overlay network. However, mGRE tunnels are not broadcast multi-access networks like Ethernet. It is a non-broadcast multi-access network like Frame Relay. Therefore, a little additional configuration is required to make routing protocols such as OSPF/EIGRP work.

The data communicated via the mGRE tunnel is then encrypted with IPSec and transferred over the underlay network. After automatically establishing ISAKMP/IPSec SA between appropriate routers, the data is encrypted, encapsulated with appropriate headers, and forwarded over the Internet (underlay network). When point-to-point GRE tunnels, the destination IP address of the new IP header to be encapsulated is preconfigured. The mGRE tunnel dynamically resolves the destination IP address of the new IP header by NHRP.

Similar to point-to-point GRE tunnels, the DMVPN mGRE tunnel (overlay network) and the Internet (underlay network) can be logically separated by VRF.

Overlay Network VRF : FVRF
Underlay Network VRF : IVRF

The following figure shows how the overlay and underlay networks are separated by VRF only for the router at Company A site 1.

Key Points for DMVPN (VRF-aware) Configuration

mGRE Tunnel Interface

The important thing about the mGRE tunnel interface is the configuration about NHRP. Allows NHRP to dynamically resolve the correspondence between the IP address of the overlay network and the IP address of the underlay network. NHRP itself has little to do with VRF, but let’s look back at the NHRP commands. Note that what we are describing here is NHRP Phase 2.

NHS NHRP Configuration

The mGRE configuration commands for the Next Hop Server (NHS), which manages the correspondence between overlay and underlay IP addresses, are as follows.

Use the tunnel mode gre multipoint command to make it an mGRE interface. mGRE configuration does not need tunnel destination. The destination IP address of the underlay network is resolved by NHRP.

The tunnel source command determines the source IP address of the new IP header to be added when forwarding over an underlay. tunnel source is the IP address of the underlay.

Specify arbitrary network ID with the ip nhrp network-id command. The network ID is meaningful locally and does not have to match other devices. However, it is usually specified as a network ID that is common to all devices on the mGRE tunnel.

Then, the ip nhrp map multicast dynamic command allows multicast (broadcast) packets to be forwarded in unicast (underlay) to dynamically learned NHCs. Since mGRE is a non-broadcast multi-access network, this configuration is to allow pseudo-broadcasting.

NHC NHRP Configuration

The NHC registers information on its own overlay and underlay addresses with the NHS. And the underlay network address is needed when forwarding packets on mGRE. To do so, NHC will query the NHS for the required underlay address.

The mGRE configuration command for NHC (Next Hop Client) is as follows.

The NHC registers the correspondence between its own overlay and underlay addresses with the NHS. Configure the overlay address of the NHS to which registered by using the ip nhrp nhs command. Then, configure the underlay address corresponding to the overlay address of the NHS with the ip nhrp map command.

Configure the underlay address to encapsulate when forwarding multicast (broadcast) over the mGRE tunnel with the ip nhrp map multicast command. In most cases, the NHS underlay address is specified. This means that multicast (broadcast) is most often configured to forward only to the NHS.

The following diagram is a simple example of the NHS/NHS commands so far. For simplicity, only one NHC is used; think similarly when adding additional NHCs.

In this example, the IP address of Lo0 in FVRF is used as the underlay address. The underlay address does not necessarily have to be the IP address of the physical interface. Connectivity through the underlay network is acceptable.

NHS/NHC VRF and IPSec Configuration

In common with NHS/NHC, the mGRE tunnel is configured as follows. These configurations are for separating the mGRE tunnel and underlay with VRF and encrypting the data in the mGRE tunnel with IPSec.

The mGRE tunnel itself is an overlay network interface, similar to a point-to-point GRE tunnel. Therefore, please use ip vrf forwarding to assign it to the IVRF of the overlay network. The appropriate overlay network IP address must also be configured.

Packets via mGRE are actually forwarded in the FVRF of the underlay network, so the tunnel vrf command is used to correspond to the FVRF. Then, associate an IPSec profile with the tunnel protection command to encrypt all packets on the Tunnel with IPSec.

crypto keyring

Like IPSec VTI, DMVPN’s IPSec communication is performed through an underlay network. Therefore, configure based on the FVRF routing table; specify the VRF in the crypto keyring.

When DMVPN, IPSec peers are established dynamically, so the IP address of the peer is not specified explicitly. Specify “0.0.0.0” both as the peer’s address and mask.

Summary

Advanced IP Routing

• Overview of Cisco Route-map
• Cisco Route-map Configuration
• GRE Tunnel Interface – Virtual Point-to-Point Connection
• GRE Tunnel Interface Configuration Example
• Overview of VRF/VRF-Lite – Virtually separating the router –
• Cisco VRF Configuration and Verification Commands
• Cisco Layer 3 VPN with VRF-Lite Configuration Example
• What Is FVRF(Front door VRF)?
• Point-to-point GRE Tunnel without FVRF
• Point-to-point GRE tunnel with FVRF (tunnel vrf command)
• IPSec VTI with FVRF
• IPSec VTI with FVRF Configuration Example
• DMVPN with FVRF
• DMVPN with FVRF Configuration Example Part1
• DMVPN with FVRF Configuration Example Part2