← Back to Lab Index
Lab 07 §3.2.a Expert ⏱ 75 min

DMVPN Phase 3 — Dual-Hub & Per-Tunnel QoS

Deploy DMVPN Phase 3 with dual-hub redundancy, IKEv2 encryption, spoke-to-spoke shortcuts, and per-tunnel QoS.

Network Topology
MPLS CORE + PE EDGE DMVPN WEST DMVPN EAST CUSTOMER EDGE + BORDER CORE-1 10.255.1.1 CORE-2 10.255.1.2 CORE-3 10.255.1.3 CORE-4 10.255.1.4 EDGE-1 10.255.2.1 EDGE-2 10.255.2.2 EDGE-3 10.255.2.3 EDGE-4 10.255.2.4 HUB-WC-1 172.16.10.254 HUB-WC-2 172.16.10.253 HUB-EC-1 172.16.20.254 HUB-EC-2 172.16.20.253 SPK-WC-1 .10.1 SPK-WC-2 .10.2 SPK-WC-3 .10.3 SPK-EC-1 .20.1 SPK-EC-2 .20.2 SPK-EC-3 .20.3 BORDER-1 10.255.3.1 BORDER-2 10.255.3.2 CE-CORP-1 10.255.6.1 CE-CORP-2 10.255.6.2 P Router (CORE) PE Router (EDGE) DMVPN Hub DMVPN Spoke Border (ASBR) Customer Edge (CE) AS 65000 — OSPF Area 0 — LDP

Prerequisites

Task Sheet — CCIE Exam Format

Task 1Hard
Configure mGRE tunnel0 on HUB-WC-1 (172.16.10.254/24) and HUB-WC-2 (172.16.10.253/24). Set NHRP network-id 10, authentication 'Jm5#bQ9@nW'.
✓ Verify: show ip nhrp
Task 2Hard
Enable 'ip nhrp redirect' on both hubs (enables Phase 3 shortcut signaling). Enable 'ip nhrp shortcut' on all spokes.
✓ Verify: show ip nhrp shortcut
Task 3Hard
Configure IKEv2 with AES-256/SHA256/DH-14. Use PSK 'Kp7$rV2@mN'. Apply IPsec profile to tunnel interfaces.
✓ Verify: show crypto ikev2 sa
Task 4Expert
Configure EIGRP named mode AS 100 over the DMVPN tunnel. Enable 'no split-horizon' on hub tunnel interfaces. Verify spoke-to-spoke routes.
✓ Verify: show eigrp address-family ipv4 neighbors
Task 5Hard
Apply per-tunnel QoS: create policy-map PM-DMVPN-EGRESS with LLQ for voice (DSCP EF), CBWFQ for data. Apply outbound on tunnel0.
✓ Verify: show policy-map interface tunnel0
Task 6Expert
Verify spoke-to-spoke traffic path (SPK-WC-1 to SPK-WC-2) uses direct tunnel (not via hub) after NHRP shortcut established.
✓ Verify: show ip nhrp detail

Key Concepts

DMVPN Phase 3 uses NHRP 'redirect' on hubs and 'shortcut' on spokes. When spoke A sends traffic to spoke B via hub, the hub sends an NHRP redirect back to spoke A. Spoke A then sends an NHRP resolution request to learn spoke B's NBMA (public) address and builds a direct spoke-to-spoke tunnel — bypassing the hub for subsequent traffic.

Dual-hub NHS (Next Hop Server) provides redundancy: spokes register with both hubs and use one as primary, the other as fallback. EIGRP over DMVPN requires 'no split-horizon' on hub tunnel interfaces so routes learned from one spoke are re-advertised to other spokes. Without this, spoke-to-spoke routing fails.

Per-tunnel QoS (§3.2.a.iii) applies a QoS policy to each individual spoke tunnel rather than the hub physical interface. This enables per-spoke bandwidth shaping and prioritization — critical in hub-and-spoke WAN where spokes have varying link speeds. Configure 'service-policy output' on the tunnel interface.

Verification Commands

show ip nhrp
All spokes registered: Type: dynamic, NBMA address present
show crypto ikev2 sa
All IKEv2 sessions: READY (RD status)
show ip nhrp shortcut
Spoke-to-spoke shortcuts after first traffic flow
show policy-map interface tunnel0
QoS classes: Voice class with priority, LLQ active

Common Mistakes & Troubleshooting

Spokes not registering with hub

Check NHRP network-id matches on hub and spoke. Verify authentication string matches exactly. Check underlay routing — spoke must have route to hub's physical IP (NBMA address).

IKEv2 SA not forming

Check proposal parameters match (encryption, integrity, DH group). Verify PSK matches. Use 'debug crypto ikev2' to see negotiation. Check ACL not blocking UDP 500/4500.

Split-horizon blocking spoke routes

Add 'no ip split-horizon eigrp 100' under hub tunnel interface. Without this, hub will not re-advertise routes learned from spoke A back to spoke B.

Solution Configs

Attempt the tasks yourself before viewing solutions.
Type SOLUTION to unlock.

HUB-WC-1

! See solution-configs/HUB-WC-1.cfg
Study Timer
45:00
CCIE EI v1.0 Blueprint: §3.2.a  ·  ← All Labs  ·  Independent study resource. Not affiliated with Cisco Systems, Inc.
⬇ Initial Configs — Load These to Start the Lab
⬇ HUB-WC-1-initial.cfg ⬇ HUB-WC-2-initial.cfg ⬇ SPK-WC-1-initial.cfg ⬇ SPK-WC-2-initial.cfg ⬇ SPK-WC-3-initial.cfg
Solution Configs — Reveal After Completing Tasks
⬇ HUB-WC-1.cfg

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.