Lab 06 — DMVPN Phase 3 — West Region Dual-Hub

Active Nodes

Active routers in this lab: HUB-WC-1, HUB-WC-2, SPK-WC-1, SPK-WC-2, SPK-WC-3, EDGE-2

Key Concepts

DMVPN Phase 3 — Shortcut Routing

Phase 3 introduces NHRP shortcuts that allow spoke-to-spoke traffic to bypass the hub after the initial flow is established. The hub sends an NHRP Redirect to the source spoke (like an ICMP redirect), telling it to resolve the destination spoke directly. The source spoke then sends an NHRP Resolution Request directly to the destination, receives the NBMA address, and builds a direct spoke-to-spoke tunnel. ip nhrp redirect on hubs and ip nhrp shortcut on spokes enable this.

Dual-Hub NHS Redundancy

Both HUB-WC-1 (primary) and HUB-WC-2 (secondary) are configured as NHS servers on each spoke. The spoke uses priority values to prefer HUB-WC-1: ip nhrp nhs 172.16.10.254 nbma 100.64.210.1 priority 1 cluster 1. If the primary hub becomes unavailable, NHRP falls back to the secondary hub within seconds. The cluster 1 groups the two NHS into a redundancy set — the spoke only uses one at a time based on priority.

EIGRP Named Mode Over DMVPN

Named mode EIGRP (router eigrp NAME with address-family) provides a consistent configuration hierarchy. Disabling split-horizon on hub tunnel interfaces (no split-horizon under af-interface Tunnel0) allows the hub to re-advertise spoke routes back out the same tunnel interface to other spokes. MD5 authentication protects EIGRP hellos on the tunnel. In Phase 3, spoke summary routes (summary-address) reduce NHRP resolution overhead.

Critical Configuration

HUB-WC-1Primary DMVPN Hub — West172.16.10.254

interface Tunnel0
 ip address 172.16.10.254 255.255.255.0
 ip nhrp authentication Jm5#bQ9@nW
 ip nhrp map multicast dynamic
 ip nhrp network-id 100
 ip nhrp redirect
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 tunnel key 100

router eigrp DMVPN-FABRIC
 address-family ipv4 unicast autonomous-system 100
  af-interface Tunnel0
   authentication mode md5
   authentication key-chain DMVPN-AUTH
   no split-horizon
  topology base
   redistribute connected
  network 172.16.10.0 0.0.0.255

SPK-WC-1DMVPN Spoke — Phase 3 shortcut172.16.10.1

interface Tunnel0
 ip address 172.16.10.1 255.255.255.0
 ip nhrp authentication Jm5#bQ9@nW
 ip nhrp map 172.16.10.254 100.64.210.1
 ip nhrp map 172.16.10.253 100.64.211.1
 ip nhrp nhs 172.16.10.254 nbma 100.64.210.1 priority 1 cluster 1
 ip nhrp nhs 172.16.10.253 nbma 100.64.211.1 priority 5 cluster 1
 ip nhrp shortcut
 tunnel mode gre multipoint

Verification

show ip nhrp

Expected: Hub shows dynamic mappings for all spoke NBMA addresses. Spoke shows static hub mapping plus dynamic shortcut entries after spoke-to-spoke traffic flows.

show ip eigrp neighbors

Expected: Spoke has EIGRP adjacency to both HUB-WC-1 and HUB-WC-2 via Tunnel0. After Phase 3 shortcut, direct spoke-to-spoke neighbors may appear.

show ip nhrp shortcut

Expected: After spoke-to-spoke ping, shortcut entries appear with NBMA address of remote spoke and expiry timer.

traceroute 10.10.12.1 source 10.10.11.1

Initially via hub (3 hops: spoke → hub → spoke). After Phase 3 shortcut established: 2 hops (direct spoke-to-spoke). Verify NHRP redirect worked.

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.