# DMVPN Dual HUB

> DMVPN with dual-hub redundancy on VyOS - dynamic mesh VPN using NHRP, mGRE, and IPsec for enterprise and service provider networks with automatic failover

Source: https://opennix.org/en/docs/vyos/examples/dmvpn/


DMVPN lets you build a dynamic mesh VPN with automatic spoke-to-spoke tunnel establishment.

## Scenario

- Service Provider: Centralized HUB for many spokes
- Enterprise: Headquarters (HUB) ↔ Branches (spokes)
- Dynamic: Spokes can connect and disconnect dynamically

## Topology

```
         HUB-1         HUB-2
           │             │
      ┌────┼────┬────────┼────┐
      │    │    │        │    │
   Spoke1 Spoke2 Spoke3 Spoke4 Spoke5

Spokes can build direct tunnels between themselves
```

## VyOS HUB Configuration

```bash
# Tunnel interface
set interfaces tunnel tun0 address '10.255.0.1/24'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'enable'
set interfaces tunnel tun0 parameters ip key '1'

# NHRP
set protocols nhrp tunnel tun0 cisco-authentication 'SecretNHRP'
set protocols nhrp tunnel tun0 holding-time '300'
set protocols nhrp tunnel tun0 multicast 'dynamic'
set protocols nhrp tunnel tun0 redirect
```

## VyOS Spoke Configuration

```bash
# Tunnel
set interfaces tunnel tun0 address '10.255.0.10/24'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 source-address '198.51.100.10'
set interfaces tunnel tun0 remote '203.0.113.1'

# NHRP
set protocols nhrp tunnel tun0 cisco-authentication 'SecretNHRP'
set protocols nhrp tunnel tun0 map 10.255.0.1 register
set protocols nhrp tunnel tun0 nhs 10.255.0.1
set protocols nhrp tunnel tun0 shortcut
```

## References

- [VyOS DMVPN](https://docs.vyos.io/en/latest/configuration/vpn/dmvpn.html)
- [RFC 2332 - NBMA Next Hop Resolution Protocol](https://datatracker.ietf.org/doc/html/rfc2332)
- [DMVPN Official Example](https://docs.vyos.io/en/latest/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.html)