DMVPN - Dynamic Multipoint VPN in VyOS

DMVPN (Dynamic Multipoint VPN) is a technology for building dynamic mesh VPN networks that automatically establish tunnels between spoke nodes without having to pre-configure every possible connection.

Overview

DMVPN combines three key technologies to build scalable and flexible VPN networks:

NHRP (Next Hop Resolution Protocol) - RFC 2332
- A dynamic address resolution protocol for NBMA networks
- Allows spoke nodes to find one another to build direct tunnels
- Registration and address queries through the NHS (Next Hop Server)
mGRE (Multipoint GRE) - RFC 1702
- Multipoint Generic Routing Encapsulation
- A single tunnel interface for many remote peers
- Dynamic tunnel creation without pre-configuration
IPsec - RFC 4301
- Encryption and authentication of GRE traffic
- Data protection inside the tunnels
- IKE for key exchange

Key Features

Dynamic tunnels: Spoke nodes automatically build direct tunnels between one another
Scalability: New spokes can be added without changing the configuration of existing ones
Spoke-to-Spoke: Direct tunnels between spokes without transiting through the hub
Fault tolerance: Support for multiple hubs for redundancy
Simple configuration: Minimal setup on spoke nodes
Dynamic routing: Integration with BGP/EIGRP/OSPF

Architecture

                  ┌─────────────┐
                  │   Hub (NHS) │
                  │ 203.0.113.1 │
                  └──────┬──────┘
                         │
        ┌────────────────┼────────────────┐
        │                │                │
   ┌────▼────┐      ┌────▼────┐     ┌────▼────┐
   │ Spoke 1 │      │ Spoke 2 │     │ Spoke 3 │
   │  .10    │◄────►│  .20    │◄───►│  .30    │
   └─────────┘      └─────────┘     └─────────┘

   Spoke-to-Spoke tunnels are created automatically

Advantages over traditional VPN:

No need for N×(N-1)/2 tunnels to build a full mesh
The hub scales to hundreds of spokes
Spokes are added without changing the hub configuration
Automatic route optimization (spoke-to-spoke)

DMVPN Components

Hub (NHS - Next Hop Server)

Functions:

Central registration point for spoke nodes
NHRP mapping database (tunnel IP ↔ NBMA IP)
Processing of NHRP resolution requests
Sending redirects for spoke-to-spoke tunnels
Routing traffic between spokes (until a direct tunnel is created)

Requirements:

A static public IP address
Always reachable by spoke nodes
Must accept NHRP registrations

Spoke

Functions:

Registering its own tunnel IP ↔ NBMA IP mapping with the NHS
NHRP resolution requests to find other spokes
Building dynamic spoke-to-spoke tunnels
Processing NHRP redirects from the hub

Requirements:

May have a dynamic public IP
Must be able to reach the hub over the internet
Initiates NHRP registration and IPsec connections

DMVPN Phases

VyOS supports DMVPN Phase 2 and Phase 3 functionality:

Phase 2 - Spoke-to-Spoke on Demand

Characteristics:

Spokes have specific routes for networks behind other spokes
The hub can initiate an NHRP redirect
Spokes build a direct tunnel after a redirect from the hub
Route summarization on the hub is required

Configuration on the Hub:

set protocols nhrp tunnel tun0 redirect

Configuration on the Spoke:

set protocols nhrp tunnel tun0 shortcut

Phase 3 - Spoke-to-Spoke with Summarization

Characteristics:

Spokes use a default or summary route
NHRP redirect works with summarized routes
More scalable (fewer routes)
Automatic spoke-to-spoke creation after the first packet

Differences from Phase 2:

A single summary route on the spoke instead of many specific ones
The hub advertises a summary/default route
Redirect works without requiring specific routes

Hub Configuration

Basic Hub Configuration

# Tunnel interface
set interfaces tunnel tun0 address '10.255.0.1/24'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'enable'
set interfaces tunnel tun0 source-address '203.0.113.1'
set interfaces tunnel tun0 parameters ip key '1'

# NHRP on the Hub
set protocols nhrp tunnel tun0 cisco-authentication 'SecretNHRP123'
set protocols nhrp tunnel tun0 holding-time '300'
set protocols nhrp tunnel tun0 multicast 'dynamic'
set protocols nhrp tunnel tun0 redirect

# Allow GRE on the firewall
set firewall ipv4 input filter rule 200 action 'accept'
set firewall ipv4 input filter rule 200 protocol 'gre'
set firewall ipv4 input filter rule 200 description 'Allow GRE for DMVPN'

# Allow IPsec
set firewall ipv4 input filter rule 210 action 'accept'
set firewall ipv4 input filter rule 210 protocol 'esp'
set firewall ipv4 input filter rule 210 description 'Allow ESP for IPsec'

set firewall ipv4 input filter rule 211 action 'accept'
set firewall ipv4 input filter rule 211 destination port '500'
set firewall ipv4 input filter rule 211 protocol 'udp'
set firewall ipv4 input filter rule 211 description 'Allow ISAKMP'

set firewall ipv4 input filter rule 212 action 'accept'
set firewall ipv4 input filter rule 212 destination port '4500'
set firewall ipv4 input filter rule 212 protocol 'udp'
set firewall ipv4 input filter rule 212 description 'Allow NAT-T'

commit
save

NHRP Parameters on the Hub

cisco-authentication

NHRP authentication password (maximum 8 characters):

set protocols nhrp tunnel tun0 cisco-authentication 'MySecret1'

Important: The password must match on the hub and on all spokes.

holding-time

Lifetime of an NHRP registration entry (in seconds):

set protocols nhrp tunnel tun0 holding-time '300'

Default: 600 seconds. Spokes must re-register before it expires.

multicast

Multicast traffic handling:

set protocols nhrp tunnel tun0 multicast 'dynamic'

Options:

dynamic: Automatic replication of multicast to registered spokes
nhs: Send multicast only to the NHS (for spokes)
Omit: Multicast is not handled

Required for dynamic routing (OSPF/EIGRP) over DMVPN.

redirect

Send NHRP redirects to spoke nodes so they build direct tunnels:

set protocols nhrp tunnel tun0 redirect

Enables DMVPN Phase 2/3 functionality.

Tunnel Interface Parameters on the Hub

address

IP address in the DMVPN network (host address with prefix):

set interfaces tunnel tun0 address '10.255.0.1/24'

It is recommended to use private networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

encapsulation

Encapsulation type (GRE is used for DMVPN):

set interfaces tunnel tun0 encapsulation 'gre'

For DMVPN, always GRE (multipoint).

multicast enable

Enable multicast on the tunnel:

set interfaces tunnel tun0 multicast 'enable'

Required for NHRP multicast replication and dynamic routing.

source-address

Local IP address for the tunnel (NBMA address):

set interfaces tunnel tun0 source-address '203.0.113.1'

Must be a public IP or an IP on the WAN interface.

parameters ip key

GRE key used to identify the tunnel:

set interfaces tunnel tun0 parameters ip key '1'

Must match on the hub and on all spokes. Value: 0-4294967295.

mtu

Maximum packet size within the tunnel:

set interfaces tunnel tun0 mtu '1400'

Default: 1476 (1500 - 24 bytes of GRE header). Lower it when IPsec is used (down to 1400).

description

Interface description:

set interfaces tunnel tun0 description 'DMVPN Hub to Spoke Network'

Spoke Configuration

Basic Spoke Configuration

# Tunnel interface
set interfaces tunnel tun0 address '10.255.0.10/24'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'enable'
set interfaces tunnel tun0 source-address '198.51.100.10'
set interfaces tunnel tun0 parameters ip key '1'

# NHRP on the Spoke
set protocols nhrp tunnel tun0 cisco-authentication 'SecretNHRP123'
set protocols nhrp tunnel tun0 map '10.255.0.1/24' nbma-address '203.0.113.1'
set protocols nhrp tunnel tun0 map '10.255.0.1/24' register
set protocols nhrp tunnel tun0 nhs '10.255.0.1'
set protocols nhrp tunnel tun0 shortcut
set protocols nhrp tunnel tun0 multicast 'nhs'

# Firewall (same as the hub)
set firewall ipv4 input filter rule 200 action 'accept'
set firewall ipv4 input filter rule 200 protocol 'gre'

set firewall ipv4 input filter rule 210 action 'accept'
set firewall ipv4 input filter rule 210 protocol 'esp'

set firewall ipv4 input filter rule 211 action 'accept'
set firewall ipv4 input filter rule 211 destination port '500'
set firewall ipv4 input filter rule 211 protocol 'udp'

set firewall ipv4 input filter rule 212 action 'accept'
set firewall ipv4 input filter rule 212 destination port '4500'
set firewall ipv4 input filter rule 212 protocol 'udp'

commit
save

NHRP Parameters on the Spoke

nhs

Address of the Next Hop Server (the hub tunnel IP):

set protocols nhrp tunnel tun0 nhs '10.255.0.1'

You can specify several NHS entries for redundancy:

set protocols nhrp tunnel tun0 nhs '10.255.0.1'
set protocols nhrp tunnel tun0 nhs '10.255.0.2'

map

Static NHRP mapping (tunnel IP → NBMA IP):

set protocols nhrp tunnel tun0 map '10.255.0.1/32' nbma-address '203.0.113.1'

Purpose: Tells the spoke how to reach the hub before NHRP is established.

map options:

register: Automatic registration of the spoke with the NHS

set protocols nhrp tunnel tun0 map '10.255.0.1/24' register

shortcut

Allow the creation of spoke-to-spoke shortcuts:

set protocols nhrp tunnel tun0 shortcut

Enables DMVPN Phase 2/3 - spokes will build direct tunnels after a redirect from the hub.

multicast nhs

Send multicast traffic to the NHS:

set protocols nhrp tunnel tun0 multicast 'nhs'

Required for dynamic routing on the spoke (OSPF/EIGRP).

Tunnel Interface Parameters on the Spoke

Same as the hub, with these differences:

# Unique tunnel IP for each spoke
set interfaces tunnel tun0 address '10.255.0.10/24'  # Spoke 1
set interfaces tunnel tun0 address '10.255.0.20/24'  # Spoke 2
set interfaces tunnel tun0 address '10.255.0.30/24'  # Spoke 3

# source-address - the spoke's local public IP
set interfaces tunnel tun0 source-address '198.51.100.10'

# The remaining parameters are identical to the hub
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'enable'
set interfaces tunnel tun0 parameters ip key '1'

IPsec Integration

DMVPN is usually combined with IPsec to encrypt GRE traffic.

IPsec Profile for DMVPN

VyOS uses IPsec profiles bound to tunnel interfaces:

# IPsec profile
set vpn ipsec profile DMVPN-PROFILE authentication mode 'pre-shared-secret'
set vpn ipsec profile DMVPN-PROFILE authentication pre-shared-secret 'MyIPsecSecret123'
set vpn ipsec profile DMVPN-PROFILE bind tunnel 'tun0'
set vpn ipsec profile DMVPN-PROFILE esp-group 'DMVPN-ESP'
set vpn ipsec profile DMVPN-PROFILE ike-group 'DMVPN-IKE'

# ESP group (encryption)
set vpn ipsec esp-group DMVPN-ESP lifetime '3600'
set vpn ipsec esp-group DMVPN-ESP mode 'transport'
set vpn ipsec esp-group DMVPN-ESP pfs 'dh-group2'
set vpn ipsec esp-group DMVPN-ESP proposal 1 encryption 'aes256'
set vpn ipsec esp-group DMVPN-ESP proposal 1 hash 'sha256'

# IKE group (key exchange)
set vpn ipsec ike-group DMVPN-IKE ikev2-reauth
set vpn ipsec ike-group DMVPN-IKE key-exchange 'ikev2'
set vpn ipsec ike-group DMVPN-IKE lifetime '28800'
set vpn ipsec ike-group DMVPN-IKE proposal 1 dh-group '14'
set vpn ipsec ike-group DMVPN-IKE proposal 1 encryption 'aes256'
set vpn ipsec ike-group DMVPN-IKE proposal 1 hash 'sha256'

commit
save

IPsec Parameters

ESP Group (Encryption)

mode transport:

set vpn ipsec esp-group DMVPN-ESP mode 'transport'

DMVPN always uses transport mode (IPsec encrypts GRE rather than creating its own tunnel).

encryption:

set vpn ipsec esp-group DMVPN-ESP proposal 1 encryption 'aes256'

Recommended: aes256, aes128, aes256gcm128

hash:

set vpn ipsec esp-group DMVPN-ESP proposal 1 hash 'sha256'

Recommended: sha256, sha384, sha512

PFS (Perfect Forward Secrecy):

set vpn ipsec esp-group DMVPN-ESP pfs 'dh-group14'

Options: dh-group2, dh-group5, dh-group14, dh-group19, dh-group20

IKE Group (Key Exchange)

IKEv2:

set vpn ipsec ike-group DMVPN-IKE key-exchange 'ikev2'

IKEv2 is recommended for DMVPN (better for NAT traversal, faster reconnect).

DH Group:

set vpn ipsec ike-group DMVPN-IKE proposal 1 dh-group '14'

Group 14 (2048-bit) is the minimum for security.

Dead Peer Detection:

set vpn ipsec ike-group DMVPN-IKE dead-peer-detection action 'restart'
set vpn ipsec ike-group DMVPN-IKE dead-peer-detection interval '30'
set vpn ipsec ike-group DMVPN-IKE dead-peer-detection timeout '120'

Automatic recovery when a tunnel drops.

Binding the Profile to the Tunnel

The IPsec profile is applied to the tunnel automatically:

set vpn ipsec profile DMVPN-PROFILE bind tunnel 'tun0'

After commit, all GRE packets through tun0 are automatically encrypted by IPsec.

Network ID

The Network ID groups DMVPN tunnels into logical networks:

set protocols nhrp tunnel tun0 network-id '1'

Use cases:

Isolating different DMVPN networks on the same router
Multiple DMVPN tunnels with different network-id values
A spoke registers only with an NHS that has a matching network-id

Example with multiple network-id values:

# Tunnel for production
set interfaces tunnel tun0 ...
set protocols nhrp tunnel tun0 network-id '1'

# Tunnel for development
set interfaces tunnel tun1 ...
set protocols nhrp tunnel tun1 network-id '2'

Dynamic Routing with DMVPN

DMVPN is usually combined with dynamic routing protocols to automatically exchange routes.

BGP over DMVPN

BGP is the most popular choice for DMVPN networks (especially for service providers).

Hub configuration:

# BGP on the Hub
set protocols bgp system-as '65000'
set protocols bgp parameters router-id '10.255.0.1'

# Spoke 1
set protocols bgp neighbor '10.255.0.10' remote-as '65001'
set protocols bgp neighbor '10.255.0.10' address-family ipv4-unicast

# Spoke 2
set protocols bgp neighbor '10.255.0.20' remote-as '65002'
set protocols bgp neighbor '10.255.0.20' address-family ipv4-unicast

# Spoke 3
set protocols bgp neighbor '10.255.0.30' remote-as '65003'
set protocols bgp neighbor '10.255.0.30' address-family ipv4-unicast

# Advertise networks
set protocols bgp address-family ipv4-unicast network '192.168.0.0/24'

Spoke configuration:

# BGP on Spoke 1
set protocols bgp system-as '65001'
set protocols bgp parameters router-id '10.255.0.10'

# Neighbor - the Hub
set protocols bgp neighbor '10.255.0.1' remote-as '65000'
set protocols bgp neighbor '10.255.0.1' address-family ipv4-unicast

# Advertise the local network
set protocols bgp address-family ipv4-unicast network '192.168.1.0/24'

Advantages of BGP:

Scalability (hundreds of spokes)
Flexible routing policy
Next-hop self on the hub for spoke-to-spoke
Support for attributes (communities, AS-path)

OSPF over DMVPN

OSPF requires broadcast/multicast, which DMVPN supports through NHRP multicast.

Hub configuration:

set interfaces tunnel tun0 ip ospf network 'broadcast'
set interfaces tunnel tun0 ip ospf priority '255'

set protocols ospf area '0' network '10.255.0.0/24'
set protocols ospf area '0' network '192.168.0.0/24'
set protocols ospf parameters router-id '10.255.0.1'

Spoke configuration:

set interfaces tunnel tun0 ip ospf network 'broadcast'
set interfaces tunnel tun0 ip ospf priority '0'

set protocols ospf area '0' network '10.255.0.0/24'
set protocols ospf area '0' network '192.168.1.0/24'
set protocols ospf parameters router-id '10.255.0.10'

Important:

The hub must be the DR (priority 255)
Spokes are DROther (priority 0)
NHRP multicast dynamic on the hub
NHRP multicast nhs on the spokes

EIGRP over DMVPN

EIGRP is a good fit for DMVPN (especially in Cisco-compatible environments).

Note: VyOS uses FRR, which does not support EIGRP natively. Use BGP or OSPF for EIGRP scenarios.

Dual-Hub Redundancy

For mission-critical networks, multiple hubs are configured for fault tolerance.

Dual-Hub Topology

         ┌─────────────┐        ┌─────────────┐
         │   Hub 1     │        │   Hub 2     │
         │ 203.0.113.1 │        │ 203.0.113.2 │
         │ 10.255.0.1  │        │ 10.255.0.2  │
         └──────┬──────┘        └──────┬──────┘
                │                      │
       ┌────────┼──────────────────────┼────────┐
       │        │                      │        │
  ┌────▼────┐  │                      │   ┌────▼────┐
  │ Spoke 1 │  │                      │   │ Spoke 3 │
  │  .10    │  │                      │   │  .30    │
  └─────────┘  │                      │   └─────────┘
               │                      │
          ┌────▼────┐                 │
          │ Spoke 2 │                 │
          │  .20    │◄────────────────┘
          └─────────┘

Hub 1 Configuration

# Tunnel tun0
set interfaces tunnel tun0 address '10.255.0.1/24'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'enable'
set interfaces tunnel tun0 source-address '203.0.113.1'
set interfaces tunnel tun0 parameters ip key '1'

# NHRP Hub 1
set protocols nhrp tunnel tun0 cisco-authentication 'SecretNHRP123'
set protocols nhrp tunnel tun0 holding-time '300'
set protocols nhrp tunnel tun0 multicast 'dynamic'
set protocols nhrp tunnel tun0 redirect

# IPsec
set vpn ipsec profile DMVPN-PROFILE authentication mode 'pre-shared-secret'
set vpn ipsec profile DMVPN-PROFILE authentication pre-shared-secret 'MyIPsecSecret123'
set vpn ipsec profile DMVPN-PROFILE bind tunnel 'tun0'
set vpn ipsec profile DMVPN-PROFILE esp-group 'DMVPN-ESP'
set vpn ipsec profile DMVPN-PROFILE ike-group 'DMVPN-IKE'

# BGP for dual-hub
set protocols bgp system-as '65000'
set protocols bgp parameters router-id '10.255.0.1'
set protocols bgp neighbor '10.255.0.2' remote-as '65000'  # Hub 2 iBGP
set protocols bgp neighbor '10.255.0.2' address-family ipv4-unicast

commit
save

Hub 2 Configuration

Same as Hub 1 but with different addresses:

set interfaces tunnel tun0 address '10.255.0.2/24'
set interfaces tunnel tun0 source-address '203.0.113.2'

set protocols bgp parameters router-id '10.255.0.2'
set protocols bgp neighbor '10.255.0.1' remote-as '65000'  # Hub 1 iBGP

Spoke Configuration for Dual-Hub

The spoke is configured with two NHS entries:

# Tunnel
set interfaces tunnel tun0 address '10.255.0.10/24'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'enable'
set interfaces tunnel tun0 source-address '198.51.100.10'
set interfaces tunnel tun0 parameters ip key '1'

# NHRP with two NHS entries
set protocols nhrp tunnel tun0 cisco-authentication 'SecretNHRP123'
set protocols nhrp tunnel tun0 shortcut
set protocols nhrp tunnel tun0 multicast 'nhs'

# Hub 1
set protocols nhrp tunnel tun0 map '10.255.0.1/32' nbma-address '203.0.113.1'
set protocols nhrp tunnel tun0 map '10.255.0.1/32' register
set protocols nhrp tunnel tun0 nhs '10.255.0.1'

# Hub 2
set protocols nhrp tunnel tun0 map '10.255.0.2/32' nbma-address '203.0.113.2'
set protocols nhrp tunnel tun0 map '10.255.0.2/32' register
set protocols nhrp tunnel tun0 nhs '10.255.0.2'

# IPsec
set vpn ipsec profile DMVPN-PROFILE authentication mode 'pre-shared-secret'
set vpn ipsec profile DMVPN-PROFILE authentication pre-shared-secret 'MyIPsecSecret123'
set vpn ipsec profile DMVPN-PROFILE bind tunnel 'tun0'
set vpn ipsec profile DMVPN-PROFILE esp-group 'DMVPN-ESP'
set vpn ipsec profile DMVPN-PROFILE ike-group 'DMVPN-IKE'

# BGP to both hubs
set protocols bgp system-as '65001'
set protocols bgp parameters router-id '10.255.0.10'
set protocols bgp neighbor '10.255.0.1' remote-as '65000'  # Hub 1
set protocols bgp neighbor '10.255.0.1' address-family ipv4-unicast
set protocols bgp neighbor '10.255.0.2' remote-as '65000'  # Hub 2
set protocols bgp neighbor '10.255.0.2' address-family ipv4-unicast

# Advertise the local network
set protocols bgp address-family ipv4-unicast network '192.168.1.0/24'

commit
save

Failover:

The spoke registers with both NHS entries
BGP adjacencies with both hubs
If Hub 1 fails, traffic switches to Hub 2 automatically
Spoke-to-spoke tunnels keep working

Practical Example: Yandex Cloud Service Provider Hub

Scenario

A service provider hosts a DMVPN hub in Yandex Cloud to connect many client branch offices.

Topology:

Hub: VyOS in Yandex Cloud (public IP: 158.160.10.50)
Spoke 1: Client A, Moscow office (dynamic IP)
Spoke 2: Client A, Saint Petersburg office (dynamic IP)
Spoke 3: Client B, Yekaterinburg office (static IP: 95.163.20.100)

Networks:

DMVPN tunnel: 10.100.0.0/24
Hub: 10.100.0.1
Client A, Moscow: 10.100.0.10, LAN 192.168.10.0/24
Client A, SPb: 10.100.0.11, LAN 192.168.11.0/24
Client B, Yekaterinburg: 10.100.0.20, LAN 192.168.20.0/24

Hub Configuration in Yandex Cloud

# Tunnel interface
set interfaces tunnel tun0 address '10.100.0.1/24'
set interfaces tunnel tun0 description 'DMVPN Hub for Service Provider'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'enable'
set interfaces tunnel tun0 source-address '10.128.0.10'  # Internal IP of the VM in Yandex Cloud
set interfaces tunnel tun0 parameters ip key '100'
set interfaces tunnel tun0 mtu '1400'

# NHRP Hub configuration
set protocols nhrp tunnel tun0 cisco-authentication 'YC_DMVPN_2025'
set protocols nhrp tunnel tun0 holding-time '600'
set protocols nhrp tunnel tun0 multicast 'dynamic'
set protocols nhrp tunnel tun0 redirect
set protocols nhrp tunnel tun0 network-id '100'

# IPsec profile
set vpn ipsec profile YC-DMVPN authentication mode 'pre-shared-secret'
set vpn ipsec profile YC-DMVPN authentication pre-shared-secret 'SuperSecretYC2025!'
set vpn ipsec profile YC-DMVPN bind tunnel 'tun0'
set vpn ipsec profile YC-DMVPN esp-group 'YC-ESP'
set vpn ipsec profile YC-DMVPN ike-group 'YC-IKE'

# ESP group
set vpn ipsec esp-group YC-ESP lifetime '3600'
set vpn ipsec esp-group YC-ESP mode 'transport'
set vpn ipsec esp-group YC-ESP pfs 'dh-group14'
set vpn ipsec esp-group YC-ESP proposal 1 encryption 'aes256gcm128'
set vpn ipsec esp-group YC-ESP proposal 1 hash 'sha256'
set vpn ipsec esp-group YC-ESP proposal 2 encryption 'aes256'
set vpn ipsec esp-group YC-ESP proposal 2 hash 'sha256'

# IKE group
set vpn ipsec ike-group YC-IKE ikev2-reauth
set vpn ipsec ike-group YC-IKE key-exchange 'ikev2'
set vpn ipsec ike-group YC-IKE lifetime '28800'
set vpn ipsec ike-group YC-IKE proposal 1 dh-group '14'
set vpn ipsec ike-group YC-IKE proposal 1 encryption 'aes256gcm128'
set vpn ipsec ike-group YC-IKE proposal 1 hash 'sha256'
set vpn ipsec ike-group YC-IKE proposal 2 dh-group '14'
set vpn ipsec ike-group YC-IKE proposal 2 encryption 'aes256'
set vpn ipsec ike-group YC-IKE proposal 2 hash 'sha256'
set vpn ipsec ike-group YC-IKE dead-peer-detection action 'restart'
set vpn ipsec ike-group YC-IKE dead-peer-detection interval '30'
set vpn ipsec ike-group YC-IKE dead-peer-detection timeout '120'

# BGP for routing (each client has its own AS)
set protocols bgp system-as '65500'
set protocols bgp parameters router-id '10.100.0.1'

# Client A spokes (iBGP within client A)
set protocols bgp neighbor '10.100.0.10' remote-as '65001'
set protocols bgp neighbor '10.100.0.10' description 'Client A - Moscow'
set protocols bgp neighbor '10.100.0.10' address-family ipv4-unicast

set protocols bgp neighbor '10.100.0.11' remote-as '65001'
set protocols bgp neighbor '10.100.0.11' description 'Client A - SPb'
set protocols bgp neighbor '10.100.0.11' address-family ipv4-unicast

# Client B spoke
set protocols bgp neighbor '10.100.0.20' remote-as '65002'
set protocols bgp neighbor '10.100.0.20' description 'Client B - Ekaterinburg'
set protocols bgp neighbor '10.100.0.20' address-family ipv4-unicast

# Advertise networks in Yandex Cloud (if any)
set protocols bgp address-family ipv4-unicast network '10.128.0.0/24'

# Firewall rules for DMVPN
set firewall ipv4 name WAN_LOCAL rule 100 action 'accept'
set firewall ipv4 name WAN_LOCAL rule 100 protocol 'gre'
set firewall ipv4 name WAN_LOCAL rule 100 description 'Allow GRE for DMVPN'

set firewall ipv4 name WAN_LOCAL rule 110 action 'accept'
set firewall ipv4 name WAN_LOCAL rule 110 protocol 'esp'
set firewall ipv4 name WAN_LOCAL rule 110 description 'Allow ESP for IPsec'

set firewall ipv4 name WAN_LOCAL rule 111 action 'accept'
set firewall ipv4 name WAN_LOCAL rule 111 destination port '500'
set firewall ipv4 name WAN_LOCAL rule 111 protocol 'udp'
set firewall ipv4 name WAN_LOCAL rule 111 description 'Allow ISAKMP'

set firewall ipv4 name WAN_LOCAL rule 112 action 'accept'
set firewall ipv4 name WAN_LOCAL rule 112 destination port '4500'
set firewall ipv4 name WAN_LOCAL rule 112 protocol 'udp'
set firewall ipv4 name WAN_LOCAL rule 112 description 'Allow NAT-T'

# Apply the firewall to the WAN interface
set firewall ipv4 input filter rule 1000 action 'jump'
set firewall ipv4 input filter rule 1000 jump-target 'WAN_LOCAL'
set firewall ipv4 input filter rule 1000 inbound-interface name 'eth0'

# Allow forwarding between spokes (for spoke-to-spoke)
set firewall ipv4 forward filter rule 200 action 'accept'
set firewall ipv4 forward filter rule 200 inbound-interface name 'tun0'
set firewall ipv4 forward filter rule 200 outbound-interface name 'tun0'

commit
save

Spoke Configuration (Client A, Moscow)

# Tunnel interface
set interfaces tunnel tun0 address '10.100.0.10/24'
set interfaces tunnel tun0 description 'DMVPN to YC Hub - Client A Moscow'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'enable'
set interfaces tunnel tun0 source-address '192.0.2.50'  # Spoke WAN IP
set interfaces tunnel tun0 parameters ip key '100'
set interfaces tunnel tun0 mtu '1400'

# NHRP Spoke configuration
set protocols nhrp tunnel tun0 cisco-authentication 'YC_DMVPN_2025'
set protocols nhrp tunnel tun0 map '10.100.0.1/32' nbma-address '158.160.10.50'
set protocols nhrp tunnel tun0 map '10.100.0.1/32' register
set protocols nhrp tunnel tun0 nhs '10.100.0.1'
set protocols nhrp tunnel tun0 shortcut
set protocols nhrp tunnel tun0 multicast 'nhs'
set protocols nhrp tunnel tun0 network-id '100'

# IPsec profile (identical to the hub)
set vpn ipsec profile YC-DMVPN authentication mode 'pre-shared-secret'
set vpn ipsec profile YC-DMVPN authentication pre-shared-secret 'SuperSecretYC2025!'
set vpn ipsec profile YC-DMVPN bind tunnel 'tun0'
set vpn ipsec profile YC-DMVPN esp-group 'YC-ESP'
set vpn ipsec profile YC-DMVPN ike-group 'YC-IKE'

set vpn ipsec esp-group YC-ESP lifetime '3600'
set vpn ipsec esp-group YC-ESP mode 'transport'
set vpn ipsec esp-group YC-ESP pfs 'dh-group14'
set vpn ipsec esp-group YC-ESP proposal 1 encryption 'aes256gcm128'
set vpn ipsec esp-group YC-ESP proposal 1 hash 'sha256'
set vpn ipsec esp-group YC-ESP proposal 2 encryption 'aes256'
set vpn ipsec esp-group YC-ESP proposal 2 hash 'sha256'

set vpn ipsec ike-group YC-IKE ikev2-reauth
set vpn ipsec ike-group YC-IKE key-exchange 'ikev2'
set vpn ipsec ike-group YC-IKE lifetime '28800'
set vpn ipsec ike-group YC-IKE proposal 1 dh-group '14'
set vpn ipsec ike-group YC-IKE proposal 1 encryption 'aes256gcm128'
set vpn ipsec ike-group YC-IKE proposal 1 hash 'sha256'
set vpn ipsec ike-group YC-IKE proposal 2 dh-group '14'
set vpn ipsec ike-group YC-IKE proposal 2 encryption 'aes256'
set vpn ipsec ike-group YC-IKE proposal 2 hash 'sha256'
set vpn ipsec ike-group YC-IKE dead-peer-detection action 'restart'
set vpn ipsec ike-group YC-IKE dead-peer-detection interval '30'
set vpn ipsec ike-group YC-IKE dead-peer-detection timeout '120'

# BGP
set protocols bgp system-as '65001'
set protocols bgp parameters router-id '10.100.0.10'

# Neighbor to the Hub
set protocols bgp neighbor '10.100.0.1' remote-as '65500'
set protocols bgp neighbor '10.100.0.1' description 'YC Hub'
set protocols bgp neighbor '10.100.0.1' address-family ipv4-unicast

# iBGP to the other Client A spoke (SPb)
set protocols bgp neighbor '10.100.0.11' remote-as '65001'
set protocols bgp neighbor '10.100.0.11' description 'Client A - SPb'
set protocols bgp neighbor '10.100.0.11' address-family ipv4-unicast

# Advertise the local network
set protocols bgp address-family ipv4-unicast network '192.168.10.0/24'

# Firewall
set firewall ipv4 input filter rule 200 action 'accept'
set firewall ipv4 input filter rule 200 protocol 'gre'

set firewall ipv4 input filter rule 210 action 'accept'
set firewall ipv4 input filter rule 210 protocol 'esp'

set firewall ipv4 input filter rule 211 action 'accept'
set firewall ipv4 input filter rule 211 destination port '500'
set firewall ipv4 input filter rule 211 protocol 'udp'

set firewall ipv4 input filter rule 212 action 'accept'
set firewall ipv4 input filter rule 212 destination port '4500'
set firewall ipv4 input filter rule 212 protocol 'udp'

commit
save

Verifying the Connection

On the Hub:

# Show the NHRP cache (registered spokes)
show ip nhrp cache

# Show NHS status
show ip nhrp nhs

# Show IPsec SAs
show vpn ipsec sa

# Show BGP neighbors
show ip bgp summary

# Show BGP routes
show ip bgp

On the Spoke:

# Check NHRP registration
show ip nhrp cache

# Check the NHS
show ip nhrp nhs

# Check shortcut tunnels
show ip nhrp shortcut

# Check IPsec SAs
show vpn ipsec sa

# Ping the hub
ping 10.100.0.1 source-address 10.100.0.10

# Ping another spoke (initiates spoke-to-spoke)
ping 10.100.0.20 source-address 10.100.0.10

# Check BGP
show ip bgp summary
show ip route bgp

Practical Example: VK Cloud Enterprise Branch Connectivity

Scenario

An enterprise hosts a DMVPN hub in VK Cloud to connect its branch offices.

Topology:

Hub: VyOS in VK Cloud (public IP: 95.142.100.200)
Spoke 1: Kazan branch (192.168.100.0/24)
Spoke 2: Nizhny Novgorod branch (192.168.101.0/24)
Spoke 3: Samara branch (192.168.102.0/24)

DMVPN tunnel: 172.16.0.0/24

Hub Configuration in VK Cloud

# Tunnel interface
set interfaces tunnel tun0 address '172.16.0.1/24'
set interfaces tunnel tun0 description 'VK Cloud DMVPN Hub for Enterprise'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'enable'
set interfaces tunnel tun0 source-address '10.0.1.10'  # Internal IP of the VM in VK Cloud
set interfaces tunnel tun0 parameters ip key '200'
set interfaces tunnel tun0 mtu '1400'

# NHRP Hub
set protocols nhrp tunnel tun0 cisco-authentication 'VK_Ent_25'
set protocols nhrp tunnel tun0 holding-time '600'
set protocols nhrp tunnel tun0 multicast 'dynamic'
set protocols nhrp tunnel tun0 redirect

# IPsec
set vpn ipsec profile VK-ENTERPRISE authentication mode 'pre-shared-secret'
set vpn ipsec profile VK-ENTERPRISE authentication pre-shared-secret 'EnterpriseVK!2025'
set vpn ipsec profile VK-ENTERPRISE bind tunnel 'tun0'
set vpn ipsec profile VK-ENTERPRISE esp-group 'VK-ESP'
set vpn ipsec profile VK-ENTERPRISE ike-group 'VK-IKE'

set vpn ipsec esp-group VK-ESP lifetime '3600'
set vpn ipsec esp-group VK-ESP mode 'transport'
set vpn ipsec esp-group VK-ESP pfs 'dh-group19'
set vpn ipsec esp-group VK-ESP proposal 1 encryption 'aes256gcm128'
set vpn ipsec esp-group VK-ESP proposal 1 hash 'sha256'

set vpn ipsec ike-group VK-IKE ikev2-reauth
set vpn ipsec ike-group VK-IKE key-exchange 'ikev2'
set vpn ipsec ike-group VK-IKE lifetime '28800'
set vpn ipsec ike-group VK-IKE proposal 1 dh-group '19'
set vpn ipsec ike-group VK-IKE proposal 1 encryption 'aes256gcm128'
set vpn ipsec ike-group VK-IKE proposal 1 hash 'sha256'
set vpn ipsec ike-group VK-IKE dead-peer-detection action 'restart'
set vpn ipsec ike-group VK-IKE dead-peer-detection interval '30'
set vpn ipsec ike-group VK-IKE dead-peer-detection timeout '120'

# OSPF for routing between branches
set interfaces tunnel tun0 ip ospf network 'broadcast'
set interfaces tunnel tun0 ip ospf priority '255'

set protocols ospf area '0' network '172.16.0.0/24'
set protocols ospf area '0' network '10.0.1.0/24'
set protocols ospf parameters router-id '172.16.0.1'

# Firewall
set firewall ipv4 input filter rule 300 action 'accept'
set firewall ipv4 input filter rule 300 protocol 'gre'

set firewall ipv4 input filter rule 310 action 'accept'
set firewall ipv4 input filter rule 310 protocol 'esp'

set firewall ipv4 input filter rule 311 action 'accept'
set firewall ipv4 input filter rule 311 destination port '500'
set firewall ipv4 input filter rule 311 protocol 'udp'

set firewall ipv4 input filter rule 312 action 'accept'
set firewall ipv4 input filter rule 312 destination port '4500'
set firewall ipv4 input filter rule 312 protocol 'udp'

commit
save

Spoke Configuration (Kazan Branch)

# Tunnel
set interfaces tunnel tun0 address '172.16.0.10/24'
set interfaces tunnel tun0 description 'DMVPN to VK Cloud Hub - Kazan Branch'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'enable'
set interfaces tunnel tun0 source-address '93.80.50.100'  # Branch WAN IP
set interfaces tunnel tun0 parameters ip key '200'
set interfaces tunnel tun0 mtu '1400'

# NHRP
set protocols nhrp tunnel tun0 cisco-authentication 'VK_Ent_25'
set protocols nhrp tunnel tun0 map '172.16.0.1/32' nbma-address '95.142.100.200'
set protocols nhrp tunnel tun0 map '172.16.0.1/32' register
set protocols nhrp tunnel tun0 nhs '172.16.0.1'
set protocols nhrp tunnel tun0 shortcut
set protocols nhrp tunnel tun0 multicast 'nhs'

# IPsec (identical to the hub)
set vpn ipsec profile VK-ENTERPRISE authentication mode 'pre-shared-secret'
set vpn ipsec profile VK-ENTERPRISE authentication pre-shared-secret 'EnterpriseVK!2025'
set vpn ipsec profile VK-ENTERPRISE bind tunnel 'tun0'
set vpn ipsec profile VK-ENTERPRISE esp-group 'VK-ESP'
set vpn ipsec profile VK-ENTERPRISE ike-group 'VK-IKE'

set vpn ipsec esp-group VK-ESP lifetime '3600'
set vpn ipsec esp-group VK-ESP mode 'transport'
set vpn ipsec esp-group VK-ESP pfs 'dh-group19'
set vpn ipsec esp-group VK-ESP proposal 1 encryption 'aes256gcm128'
set vpn ipsec esp-group VK-ESP proposal 1 hash 'sha256'

set vpn ipsec ike-group VK-IKE ikev2-reauth
set vpn ipsec ike-group VK-IKE key-exchange 'ikev2'
set vpn ipsec ike-group VK-IKE lifetime '28800'
set vpn ipsec ike-group VK-IKE proposal 1 dh-group '19'
set vpn ipsec ike-group VK-IKE proposal 1 encryption 'aes256gcm128'
set vpn ipsec ike-group VK-IKE proposal 1 hash 'sha256'
set vpn ipsec ike-group VK-IKE dead-peer-detection action 'restart'
set vpn ipsec ike-group VK-IKE dead-peer-detection interval '30'
set vpn ipsec ike-group VK-IKE dead-peer-detection timeout '120'

# OSPF
set interfaces tunnel tun0 ip ospf network 'broadcast'
set interfaces tunnel tun0 ip ospf priority '0'

set protocols ospf area '0' network '172.16.0.0/24'
set protocols ospf area '0' network '192.168.100.0/24'
set protocols ospf parameters router-id '172.16.0.10'

# Firewall
set firewall ipv4 input filter rule 300 action 'accept'
set firewall ipv4 input filter rule 300 protocol 'gre'

set firewall ipv4 input filter rule 310 action 'accept'
set firewall ipv4 input filter rule 310 protocol 'esp'

set firewall ipv4 input filter rule 311 action 'accept'
set firewall ipv4 input filter rule 311 destination port '500'
set firewall ipv4 input filter rule 311 protocol 'udp'

set firewall ipv4 input filter rule 312 action 'accept'
set firewall ipv4 input filter rule 312 destination port '4500'
set firewall ipv4 input filter rule 312 protocol 'udp'

commit
save

Operational Commands

Checking NHRP

show ip nhrp cache

Show the NHRP cache (known mappings):

show ip nhrp cache

Example output on the Hub:

Iface    Type    Protocol    NBMA            Tunnel          Flags
tun0     dynamic nhrp        198.51.100.10   10.255.0.10/32  registered UP
tun0     dynamic nhrp        198.51.100.20   10.255.0.20/32  registered UP
tun0     dynamic nhrp        95.163.20.100   10.255.0.30/32  registered UP

Flags:

registered: The spoke is registered with the NHS
UP: The tunnel is active
dynamic: The entry was created dynamically

show ip nhrp nhs

Show Next Hop Server status:

show ip nhrp nhs

Example output on the Spoke:

Iface    NBMA            Tunnel          Flags
tun0     203.0.113.1     10.255.0.1/32   UP

show ip nhrp shortcut

Show active spoke-to-spoke shortcuts:

show ip nhrp shortcut

Example output:

Iface    Target          Via             Type
tun0     192.168.2.0/24  10.255.0.20     shortcut

Meaning: traffic to 192.168.2.0/24 goes directly to 10.255.0.20 (spoke-to-spoke).

Checking IPsec

show vpn ipsec sa

Show IPsec Security Associations:

show vpn ipsec sa

Example output:

Connection        State    Uptime    Bytes In/Out
tun0-1            up       00:15:23  1.2M/856K
tun0-2            up       00:10:45  523K/412K

show vpn ipsec status

Show the overall IPsec status:

show vpn ipsec status

Checking the Tunnel

show interfaces tunnel

Show all tunnel interfaces:

show interfaces tunnel

show interfaces tunnel tun0

Detailed information about the tunnel:

show interfaces tunnel tun0

Example output:

tun0: <POINTOPOINT,MULTICAST,UP,LOWER_UP> mtu 1400 qdisc pfifo_fast
    link/ipip 203.0.113.1 peer 0.0.0.0
    inet 10.255.0.1/24 brd 10.255.0.255 scope global tun0
    RX:  bytes    packets     errors    dropped    overrun      mcast
           1.2M       8543          0          0          0          0
    TX:  bytes    packets     errors    dropped    carrier   collisions
         856.3K       5432          0          0          0          0

ping through the tunnel

Check connectivity over DMVPN:

# Ping a tunnel IP
ping 10.255.0.10

# Ping a network behind a spoke
ping 192.168.1.1

# Ping specifying the source
ping 10.255.0.10 source-address 10.255.0.1

Checking Routing

show ip route

Show the routing table:

show ip route

Look for routes through the tun0 interface.

show ip bgp

Show the BGP table:

show ip bgp

show ip bgp summary

A brief summary of BGP neighbors:

show ip bgp summary

show ip ospf neighbor

Show OSPF neighbors:

show ip ospf neighbor

Traffic Diagnostics

monitor interfaces tunnel tun0 traffic

Real-time traffic monitoring:

monitor interfaces tunnel tun0 traffic

To exit: Ctrl+C

tcpdump on the tunnel

Capture packets for detailed diagnostics:

sudo tcpdump -i tun0 -nn

Example - watch GRE only:

sudo tcpdump -i tun0 -nn proto gre

Troubleshooting

The Tunnel Does Not Come Up

Symptoms:

show ip nhrp cache on the hub is empty
show ip nhrp nhs on the spoke shows DOWN
No connectivity through the tunnel

Checklist:

Check GRE on the firewall

On the hub and spoke:

show firewall ipv4 input filter

There must be a rule allowing GRE (protocol 47).

Check IPsec

show vpn ipsec sa

If no SA is established:

Check the pre-shared-secret (it must match)
Check the ESP/IKE groups (they must match)
Check the firewall for UDP 500, 4500 and ESP

Check NHRP authentication

The cisco-authentication password must match on the hub and spoke.

Check source-address on the spoke

show interfaces tunnel tun0

source-address must be a real WAN IP or an IP on the WAN interface.

Check connectivity to the hub

ping 203.0.113.1  # The hub public IP

If it does not ping, there are routing/firewall problems reaching the hub.

NHRP Registration Does Not Happen

Symptoms:

The tunnel is UP, but the spoke does not appear in show ip nhrp cache on the hub
On the spoke, show ip nhrp nhs shows DOWN

Solution:

Check the NHRP map on the spoke:

show protocols nhrp tunnel tun0

There must be a map with register for the hub:

map 10.255.0.1/32 nbma-address 203.0.113.1 register

Check holding-time on the hub:

show protocols nhrp tunnel tun0

Make sure holding-time is sufficient (300-600 seconds).

Check network-id:

If network-id is used, it must match on the hub and spoke.

Restart NHRP on the spoke:

restart nhrp tunnel tun0

Spoke-to-Spoke Tunnels Are Not Created

Symptoms:

Hub-to-spoke works
Spoke-to-spoke traffic goes through the hub
show ip nhrp shortcut on the spoke is empty

Solution:

Check redirect on the hub:

show protocols nhrp tunnel tun0

redirect must be enabled.

Check shortcut on the spoke:

show protocols nhrp tunnel tun0

shortcut must be enabled.

Check routing on the spoke:

Spokes must have routes to networks behind other spokes through the hub:

show ip route

If there are no routes, the problem is with dynamic routing (BGP/OSPF).

Initiate spoke-to-spoke traffic:

ping 192.168.2.1  # A network behind another spoke

After the first packets go through the hub, a shortcut should be created.

Check NHRP resolution:

show log | match nhrp

Look for NHRP resolution requests and responses.

IPsec SA Is Constantly Recreated

Symptoms:

show vpn ipsec sa shows a low uptime
The tunnel works but is unstable
Logs show constant SA recreation

Solution:

Check Dead Peer Detection:

show vpn ipsec ike-group

Make sure DPD is configured correctly:

action: restart
interval: 30
timeout: 120

Check the MTU:

Too large an MTU can cause problems. Try:

set interfaces tunnel tun0 mtu '1400'
commit

Check NAT traversal:

If the spoke is behind NAT, make sure UDP 4500 is open.

Check the lifetime:

show vpn ipsec esp-group
show vpn ipsec ike-group

Too short a lifetime causes frequent rekeying.

DMVPN Performance Is Low

Symptoms:

Slow data transfer through the tunnel
High latency
Packet loss

Solution:

Check the MTU:

Packet fragmentation reduces performance:

# PMTU test
ping 10.255.0.1 size 1400 do-not-fragment

If the packets do not pass, lower the MTU:

set interfaces tunnel tun0 mtu '1380'
commit

Check MSS clamping:

For TCP traffic, configure MSS clamping:

set firewall ipv4 forward filter rule 50 action 'accept'
set firewall ipv4 forward filter rule 50 protocol 'tcp'
set firewall ipv4 forward filter rule 50 tcp flags syn
set firewall ipv4 forward filter rule 50 tcp mss '1360:1536'
commit

Check the CPU load:

show system cpu

GRE + IPsec require CPU. If the load is high, the problem is with the hardware.

Check the WAN bandwidth:

monitor interfaces eth0 traffic

The WAN link may be saturated.

Disable compression (if enabled):

GRE compression is usually unnecessary and reduces performance.

Multicast Traffic Does Not Pass

Symptoms:

OSPF adjacencies do not form
Multicast applications do not work
EIGRP hellos do not pass

Solution:

Check multicast on the tunnel:

show interfaces tunnel tun0

It must show multicast enable.

Check NHRP multicast:

On the hub:

show protocols nhrp tunnel tun0

It must show multicast dynamic.

On the spoke:

show protocols nhrp tunnel tun0

It must show multicast nhs.

Check IGMP:

show ip igmp groups

Test multicast:

On a spoke, send multicast:

sudo ping -I tun0 224.0.0.5

On other spokes, monitor:

sudo tcpdump -i tun0 -nn dst 224.0.0.5

Best Practices

Security

Use strong authentication

NHRP authentication of at least 8 characters
IPsec pre-shared-secret of at least 20 characters
Consider certificates for IPsec

Modern cryptography

AES-256-GCM for ESP encryption
SHA-256 minimum for the hash
DH group 14 minimum (19/20 is better)
IKEv2 instead of IKEv1

Restrict the firewall

Allow GRE/IPsec only from known sources (where possible):

set firewall ipv4 input filter rule 200 action 'accept'
set firewall ipv4 input filter rule 200 protocol 'gre'
set firewall ipv4 input filter rule 200 source group address-group 'KNOWN_SPOKES'

Key rotation

Periodically change:

The NHRP authentication password
IPsec pre-shared-secrets
Set the IKE/ESP lifetime for automatic rekeying

Scalability

Use BGP for large networks

BGP scales better than OSPF for hundreds of spokes:

Flexible routing policy
Attributes for traffic engineering
Route reflectors for even greater scale

Summary routes on the hub

Do not advertise specific /32 routes to spokes - use summarization.

DMVPN Phase 3

For large networks, use Phase 3 (summary routes + shortcut).

Monitor hub resources

The hub is a critical component; monitor:

CPU utilization
Memory usage
NHRP cache size
IPsec SA count

Reliability

Dual-hub architecture

For mission-critical networks, use two hubs:

Different public IPs
Different data centers/clouds
Spokes with two NHS entries

Dead Peer Detection

Configure DPD for fast detection of drops:

set vpn ipsec ike-group DMVPN-IKE dead-peer-detection action 'restart'
set vpn ipsec ike-group DMVPN-IKE dead-peer-detection interval '30'
set vpn ipsec ike-group DMVPN-IKE dead-peer-detection timeout '120'

NHRP holding-time

Balance between overhead and failure-detection speed:

300-600 seconds for stable networks
120-300 seconds for unstable WANs

Backup routes

Configure floating static routes as a backup for DMVPN.

Performance

Correct MTU

Determine the optimal MTU for your network:

Standard: 1400 for GRE + IPsec
Test PMTU: ping size <value> do-not-fragment
MSS clamping for TCP

Minimize overhead

Do not use compression unless necessary
Use a GRE key only if isolation is needed
Avoid nested tunnels

Offloading (if available)

On supported hardware, enable crypto offloading for IPsec.

QoS

For critical traffic, configure QoS:

set traffic-policy shaper DMVPN-SHAPER bandwidth '100mbit'
set traffic-policy shaper DMVPN-SHAPER class 10 match 'voice' ip dscp 'ef'
set traffic-policy shaper DMVPN-SHAPER class 10 bandwidth '20%'
set traffic-policy shaper DMVPN-SHAPER class 10 priority '1'

set interfaces tunnel tun0 traffic-policy out 'DMVPN-SHAPER'

Management and Monitoring

Documentation

Document:

The DMVPN topology (which spoke is where)
The IP addressing plan (tunnel IPs, NBMA IPs)
BGP AS numbers
Contacts for each spoke

Monitoring

Set up monitoring for:

NHRP cache size on the hub
IPsec SA status
BGP/OSPF neighbor state
Bandwidth utilization
Packet loss/latency

Logging

Enable logs for DMVPN events:

set system syslog global facility local7 level 'debug'
set system syslog host 192.168.1.100 facility local7 level 'info'

Centralized management

For large networks, use:

Ansible for configuration automation
Git for config versioning
The VyOS API for programmatic management

Regular testing

Periodically test:

Failover on dual-hub
Spoke-to-spoke tunnels
Performance (throughput, latency)
Recovery after failures

Comparison with Other VPN Technologies

Characteristic	DMVPN	WireGuard	IPsec Site-to-Site	OpenVPN
Spoke-to-Spoke	Yes, dynamic	No (manual)	No (manual)	No (manual)
Scalability	Excellent (hundreds of spokes)	Good	Poor (N*N tunnels)	Moderate
Spoke configuration	Minimal	Simple	Per peer	Simple (server-client)
Dynamic spoke IPs	Yes	Yes	Limited	Yes
Performance	Good	Excellent	Good	Moderate
Multicast	Yes (through NHRP)	No	No	No
Dynamic routing	Yes (BGP/OSPF)	Not natively	Yes (BGP/OSPF)	Yes (BGP/OSPF)
NAT traversal	Yes (through NAT-T)	Yes	Yes (NAT-T)	Yes
Redundancy	Yes (dual-hub)	Manual	Manual	Manual
Standardization	RFC	RFC	RFC	No (de facto)

When to use DMVPN:

A service provider with many clients
An enterprise with many branch offices
Spoke-to-spoke tunnels are needed
Scalability is critical
Dynamic routing is required

When NOT to use DMVPN:

A small number of sites (2-3) - use WireGuard or IPsec
Simplicity matters more than functionality - use WireGuard
Performance is critical - use WireGuard
No experience with NHRP/GRE - use WireGuard

Resources and Further Reading

Official Documentation

VyOS Command Reference

# Show all NHRP commands
show ip nhrp ?

# Show all IPsec commands
show vpn ipsec ?

# Show all tunnel commands
show interfaces tunnel ?

Cloud Platforms

Community and Support

VyOS Community Forums
VyOS Slack
VyOS GitHub
OpenNIX Support - for commercial support

Conclusion

DMVPN is a powerful technology for building scalable VPN networks with dynamic spoke-to-spoke tunnels. VyOS provides full DMVPN support including NHRP, mGRE and IPsec integration.

Key advantages of DMVPN:

Scalability to hundreds of spoke nodes
Automatic creation of spoke-to-spoke tunnels
Minimal configuration on the spokes
Support for dynamic IP addresses
Integration with dynamic routing
Fault tolerance through dual-hub

Recommendations:

For service provider networks, DMVPN is ideal
For enterprises with many branch offices, DMVPN is an excellent choice
For small networks (2-5 sites), consider WireGuard
Use BGP for large, scalable networks
Configure dual-hub for mission-critical networks
Monitor and test regularly

DMVPN in VyOS delivers enterprise-grade functionality for building complex VPN infrastructures with excellent scalability and reliability.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

L2TP/IPsec VPN Firewall in VyOS