Documentation
VyOS Documentation
VyOS Configuration Examples
DMVPN Dual HUB

DMVPN Dual HUB

DMVPN lets you build a dynamic mesh VPN with automatic spoke-to-spoke tunnel establishment.

Scenario

  • Service Provider: Centralized HUB for many spokes
  • Enterprise: Headquarters (HUB) ↔ Branches (spokes)
  • Dynamic: Spokes can connect and disconnect dynamically

Topology

         HUB-1         HUB-2
           │             │
      ┌────┼────┬────────┼────┐
      │    │    │        │    │
   Spoke1 Spoke2 Spoke3 Spoke4 Spoke5

Spokes can build direct tunnels between themselves

VyOS HUB Configuration

# Tunnel interface
set interfaces tunnel tun0 address '10.255.0.1/24'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'enable'
set interfaces tunnel tun0 parameters ip key '1'

# NHRP
set protocols nhrp tunnel tun0 cisco-authentication 'SecretNHRP'
set protocols nhrp tunnel tun0 holding-time '300'
set protocols nhrp tunnel tun0 multicast 'dynamic'
set protocols nhrp tunnel tun0 redirect

VyOS Spoke Configuration

# Tunnel
set interfaces tunnel tun0 address '10.255.0.10/24'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 source-address '198.51.100.10'
set interfaces tunnel tun0 remote '203.0.113.1'

# NHRP
set protocols nhrp tunnel tun0 cisco-authentication 'SecretNHRP'
set protocols nhrp tunnel tun0 map 10.255.0.1 register
set protocols nhrp tunnel tun0 nhs 10.255.0.1
set protocols nhrp tunnel tun0 shortcut

References

Reviewed by OpenNix LLC · Last updated on
PPPoE over L2TPOpenVPN with LDAP Authentication