DMVPN is a Cisco technology that reduces the effort of building interconnected site-to-site VPNs. Instead of manually configuring tunnels between every pair of routers, you configure a hub-and-spoke topology; DMVPN then facilitates a full mesh of tunnels between routers. section 16.3.1 section 16.4
Key operational facts:
- The hub distributes information to each spoke, allowing spokes to form tunnels with one another without manually configuring every tunnel. section 16.3.1
- DMVPN uses unencrypted GRE tunnels by default; GRE supports varied traffic, but unencrypted tunnels are not secure. section 16.3.1 section 16.4
- IPsec is recommended when VPN traffic crosses the internet, producing encrypted tunnels while DMVPN supplies the dynamic full-mesh behavior. section 16.3.1
- A full mesh improves direct connectivity between locations, while manual configuration becomes labor intensive and increasingly prone to errors as sites are added. section 16.3.1 section 16.4
Figure 16.18 DMVPN automatically creates a full mesh of IPsec tunnels after configuring a hub-and-spoke topology.
Use the figure to visualize how configuring a hub-and-spoke topology results in a full mesh of IPsec tunnels. section 16.3.1
