CCIE DMVPN GRE NHRP

DMVPN — GRE, mGRE & NHRP

By Ioannis Alexander Konstas · October 2026

Dynamic Multipoint VPN (DMVPN) simplifies the deployment of large-scale hub-and-spoke VPNs. Understanding the underlying components—GRE, mGRE, and NHRP—is critical for mastering the DMVPN architecture for the CCIE Enterprise Infrastructure exam.

1 Point-to-Point GRE

Standard Generic Routing Encapsulation (GRE) creates a point-to-point tunnel. This requires the configuration of an explicit tunnel destination on the tunnel interface. There is a strict one-to-one mapping between the local tunnel interface and the remote endpoint.

Standard GRE Configuration

interface Tunnel0
 tunnel source Gi0/0
 tunnel destination 2.2.2.2

In this model, the router knows exactly where to build the tunnel. It is perfectly suited for site-to-site connections where the endpoints are known and static. However, scaling this to hundreds of spokes becomes an administrative nightmare, as each spoke requires a dedicated tunnel interface and subnet on the hub.

2 Multipoint GRE (mGRE)

To solve the hub-and-spoke scalability issue, we use Multipoint GRE (mGRE). With mGRE, the hub doesn't need to specify a single destination. Instead, it uses a single tunnel interface to serve all spokes (e.g., Spoke1, Spoke2, ... Spoke100).

mGRE Interface Mode

interface Tunnel0
 tunnel mode gre multipoint

Notice that the tunnel destination command is entirely absent.

Key Insight: mGRE provides the ability to send encapsulated packets out of multiple dynamic endpoints, but natively, it doesn't know WHERE to send them. It needs an external mechanism to resolve the destinations.

3 NHRP — The Resolution Protocol

The Next Hop Resolution Protocol (NHRP) solves the "where to send" problem inherent to mGRE. Spokes proactively register their tunnel IP (overlay) to physical IP (underlay) mappings with the hub (the NHRP Server or NHS).

Spoke1: Tunnel IP 10.0.0.11 → Physical IP 200.1.1.11
Spoke2: Tunnel IP 10.0.0.12 → Physical IP 200.1.1.12

The hub dynamically builds an NHRP mapping table from these registrations.

The ARP Analogy: Just as ARP resolves a logical IP address to a physical MAC address on an Ethernet segment, NHRP resolves a logical DMVPN Tunnel IP to a physical Underlay IP address.

4 Overlay vs Underlay

Understanding DMVPN requires strict separation between the overlay and underlay networks.

Network Layer	Description	Routing Protocol Role
Overlay	The tunnel IP addresses (e.g., `10.0.0.x`).	Where dynamic routing protocols like OSPF, EIGRP, or BGP form neighbor adjacencies.
Underlay	The physical transport network (e.g., public ISPs, MPLS).	Provides the actual end-to-end transport IP reachability for the encapsulated packets.

CCIE Definition: "NHRP resolves DMVPN overlay tunnel addresses into underlay transport addresses."

5 The DMVPN Stack

DMVPN is not a single protocol, but a combination of three technologies working together seamlessly:

GRE = The encapsulation protocol used for tunnel creation.
NHRP = The destination resolution database.
IPsec = The encryption payload ensuring data confidentiality and integrity (though optional, it's universally deployed).

      Summary:

      mGRE says, "I can send to multiple peers from one interface."

      NHRP says, "Here is exactly where to send to reach a specific peer."

      Without NHRP, mGRE wouldn't know where the spokes are located. Without mGRE, NHRP wouldn't have a multipoint tunnel interface to utilize.

6 Hub vs Spoke Configuration

Let's look at the baseline configuration for a DMVPN Phase 1 or Phase 2 hub and spoke.

Hub Router Configuration

interface Tunnel0
 ip address 10.0.0.1 255.255.255.0
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp network-id 1
 ip nhrp map multicast dynamic

Spoke Router Configuration

interface Tunnel0
 ip address 10.0.0.11 255.255.255.0
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 ip nhrp network-id 1
 ip nhrp nhs 10.0.0.1
 ip nhrp map 10.0.0.1 100.1.1.1
 ip nhrp map multicast 100.1.1.1

← Back to Overview