CCIE or Null!

DMVPN, a staple in any large scale VPN network, or a cheap internet backup solution for a primary MPLS network. We all know the great thing about DMVPN is the fact it creates a single mGRE tunnel interface in which multiple connections can be made to/from (trust me if you ever have to manage a router with  500+ GRE tunnels  you will quickly learn to love DMVPN) and the fact that mGREs can create tunnels automatically between spokes putting less load on the hub router is another major advantage. It also increases network performance due the fact in a typical hub/spoke topology if two spokes need to communicate between themselves the hub router must decrypt the traffic from spoke1 and then encrypt it again to send it to spoke2, just for spoke2 to decrypt the data again when it receives the data (assuming you are running IPSec over your tunnels). So you have some double encryption/decryption/encapsulation going on there, not very optimal at all.

The question is how does DMVPN know how to create these tunnels, and what mechanism is it that allows DMVPN to create all these tunnels, well that would be NHRP Next Hop Resolution Protocol. NHRP works off a server/client relationship, where the NHRP clients (let’s call them next hop clients/NHCs) register with their next hop server (NHS), it’s the responsibility of the NHS to track all of its NHCs this is done with registration request and reply packets. When two spokes need to communicate between themselves the spokes send over a resolution request packet and the NHS responds with a resolution reply packet, with that information the spokes need to build a tunnel directly between themselves.

So let’s take a quick look at how process occurs between some Cisco routers:

Here is an overview of 2 NHC’s registering with their NHS:

10.1.1.1 / 192.168.1.1 – NHS
10.1.2.1 / 192.168.1.2 – NHC
10.1.3.1 / 192.168.1.3 – NHC

Taking a closer look these NHRP packets they are comprised of a few different parts:

From top to bottom this packet starts off pretty normal, you see the normal L2/L3 information, and the GRE tunnel (since NHRP runs through a GRE tunnel) right after that we get to the NHRP portion of the packet. Now RFC 2332 defines these portions:

• Fixed Header – This portion is always the same, and just covers some basic information NHRP version, Ethertypes of the physical medium, address family information, and etc.
• Mandatory Part – This is where the NHRP packet type is defined (Registration request/reply, resolution request/reply, etc) and tunnel interface (Displayed as the protocol address)  and physical interface (displayed as the NBMA address) IP addresses are contained.
• Client Information Entries CIE: Which contains specific information for clients such as MTU and hold down times.

NHRP Packets

Above is a quick screenshot of some of the NHRP packet types. You can the NHC at 10.1.3.1 attempts to register with 10.1.1.1 (the NHS) until the NHS sends its registration reply. Then you can see 10.1.3.1 sending a resolution request to the NHS, this represents the NHC at 10.1.3.1 attempting to reach the NHC at 10.1.2.1 after 10.1.3.1 receives its response from the NHS, 10.1.3.1 sends its it reply directly the NHC at 10.1.2.1. Clearing the NHRP cache on the Cisco router actually forces it to transmit a purge packets.

And now for a closer look:

The fixed header shown above, always includes the same information no matter which NHRP packet type is sent. Not too much to look at the NHRP version, address family, protocol type, and so forth.

The Mandatory Part of the header is what defines the NHRP packet type, this packet was the NHRP resolution request sent from the 10.1.3.1 (a NHC) to 10.1.1.1 (the NHS) when 192.168.1.3 attempted to ping 192.168.1.2 another NHC on the DMVPN network. Something I want to clarify here is the fact there are a lot of different IP addresses shown here. The Source NBMA address is the IP of the physical interface, the Source Protocol Address is the address of DMVPN tunnel on the NHC, and the Destination Protocol Address is the IP address of the DMVPN tunnel of the other NHC we are trying to reach.  So NBMA Addresses are for physical interfaces and Protocol Addresses for the logical tunnels. After all that you’ll notice the Client Information Entry at the bottom. (Also keep in mind there are many other parts to the NHRP packet I did not show)

So there was a real quick and dirty run down on NHRP the protocol that makes DMVPN possible. It all really boils down to NHCs registering with the NHS, the NHS keeping all the NHC information in a cached local database, and the NHC’s asking for NHRP resolutions from the NHS when they want to spin up tunnels directly between NHCs. You can find a much more in depth discussion of NHRP in RFC 2332