# DMVPN Dual HUB

> DMVPN с резервированием двух хабов на VyOS - динамическая mesh-сеть на NHRP, mGRE и IPsec с автоматическим переключением при отказе.

Source: https://opennix.org/docs/vyos/examples/dmvpn/


DMVPN позволяет создать dynamic mesh VPN с автоматическим spoke-to-spoke tunnel establishment.

## Сценарий

- Service Provider: Централизованный HUB для множества spokes
- Enterprise: Headquarters (HUB) ↔ Branches (spokes)
- Dynamic: Spokes могут подключаться/отключаться dynamically

## Топология

```
         HUB-1         HUB-2
           │             │
      ┌────┼────┬────────┼────┐
      │    │    │        │    │
   Spoke1 Spoke2 Spoke3 Spoke4 Spoke5

Spokes могут создавать direct tunnels между собой
```

## VyOS HUB Configuration

```bash
# Tunnel interface
set interfaces tunnel tun0 address '10.255.0.1/24'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'enable'
set interfaces tunnel tun0 parameters ip key '1'

# NHRP
set protocols nhrp tunnel tun0 cisco-authentication 'SecretNHRP'
set protocols nhrp tunnel tun0 holding-time '300'
set protocols nhrp tunnel tun0 multicast 'dynamic'
set protocols nhrp tunnel tun0 redirect
```

## VyOS Spoke Configuration

```bash
# Tunnel
set interfaces tunnel tun0 address '10.255.0.10/24'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 source-address '198.51.100.10'
set interfaces tunnel tun0 remote '203.0.113.1'

# NHRP
set protocols nhrp tunnel tun0 cisco-authentication 'SecretNHRP'
set protocols nhrp tunnel tun0 map 10.255.0.1 register
set protocols nhrp tunnel tun0 nhs 10.255.0.1
set protocols nhrp tunnel tun0 shortcut
```

## Ссылки

- [VyOS DMVPN](https://docs.vyos.io/en/latest/configuration/vpn/dmvpn.html)
- [RFC 2332 - NBMA Next Hop Resolution Protocol](https://datatracker.ietf.org/doc/html/rfc2332)
- [DMVPN Official Example](https://docs.vyos.io/en/latest/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.html)