LogoفارسیFA

Hands-On Lab: Configuring Basic DMVPN (mGRE with NHRP)

This hands-on lab configures a basic single-hub DMVPN topology using a multipoint GRE tunnel and NHRP, demonstrating how a spoke dynamically registers its physical address with the hub without requiring a separate point-to-point tunnel per spoke.

DMVPN ConfigurationmGRE TunnelNHRP Registration

~3 min read · Updated Sep 23, 2026

Lab Objective

Configure a hub router with a multipoint GRE (mGRE) tunnel interface and a spoke router with NHRP registration pointing to the hub, verifying the spoke's physical address is dynamically learned by the hub rather than manually configured.

Lab Purpose

The GRE tunnels configured in earlier labs were all point-to-point, requiring a dedicated tunnel interface for every spoke in a hub-and-spoke design — impractical at scale with dozens of sites. DMVPN solves this using a single multipoint tunnel interface on the hub combined with NHRP, which allows spokes to dynamically register themselves rather than each requiring a separately configured point-to-point tunnel.

Lab Topology

Hub ---- Gi0/1 ---- ISP ---- Gi0/1 ---- Spoke1

Hub: Gi0/1 (WAN) 203.0.113.17/30
Spoke1: Gi0/1 (WAN) 203.0.113.21/30

Tunnel0 on Hub: 172.16.200.1/24 (mGRE)
Tunnel0 on Spoke1: 172.16.200.2/24

Task 1: Configure Basic WAN Addressing

Configure both routers' WAN-facing interfaces.

Task 2: Configure the Hub's Multipoint GRE Tunnel

Configure Tunnel0 on the hub as multipoint GRE, with an NHRP network ID and no fixed tunnel destination.

Task 3: Configure the Spoke's Tunnel with NHRP Registration

Configure Tunnel0 on the spoke, pointing NHRP registration toward the hub's tunnel address and its actual physical (NBMA) address.

Task 4: Verify the Spoke Registers with the Hub

Confirm the hub's NHRP cache shows the spoke's dynamically learned physical address.

Task 5: Verify Connectivity Across the Tunnel

Confirm the spoke can ping the hub's tunnel address.

Solution and Verification

Hub(config)# interface gigabitethernet0/1
Hub(config-if)# ip address 203.0.113.17 255.255.255.252
Hub(config-if)# no shutdown

Spoke1(config)# interface gigabitethernet0/1
Spoke1(config-if)# ip address 203.0.113.21 255.255.255.252
Spoke1(config-if)# no shutdown

Hub(config)# interface tunnel0
Hub(config-if)# ip address 172.16.200.1 255.255.255.0
Hub(config-if)# tunnel mode gre multipoint
Hub(config-if)# tunnel source gigabitethernet0/1
Hub(config-if)# ip nhrp network-id 1

-- Notice there is no "tunnel destination" --
-- this is precisely what makes the tunnel
-- multipoint, capable of dynamically
-- communicating with any number of spokes
-- through a single interface, unlike the
-- point-to-point tunnels in earlier labs

Spoke1(config)# interface tunnel0
Spoke1(config-if)# ip address 172.16.200.2 255.255.255.0
Spoke1(config-if)# tunnel source gigabitethernet0/1
Spoke1(config-if)# tunnel mode gre multipoint
Spoke1(config-if)# ip nhrp network-id 1
Spoke1(config-if)# ip nhrp nhs 172.16.200.1 nbma 203.0.113.17

-- "nhs" (Next Hop Server) tells the spoke
-- where the hub is, mapping the hub's tunnel
-- address to its actual physical WAN address
-- -- this triggers automatic registration

Hub# show ip nhrp

172.16.200.2/32 via 172.16.200.2, Tunnel0 created
  NBMA address: 203.0.113.21
-- The hub automatically learned Spoke1's
-- physical WAN address through NHRP
-- registration, without ever having it
-- manually configured

Spoke1# ping 172.16.200.1

!!!!!
Success rate is 100 percent (5/5)

Key Takeaway

NHRP registration is what makes DMVPN's single mGRE interface on the hub practical at scale: rather than the hub needing a manually configured tunnel destination for every spoke as in a plain GRE design, each spoke announces its own physical address dynamically, and the hub's NHRP cache builds itself automatically as spokes come online — this is the foundational mechanism that later, more advanced DMVPN phases build upon for spoke-to-spoke direct tunneling.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring HSRP for IPv6

This hands-on lab configures HSRP for IPv6 between two routers, demonstrating the option to use an automatically generated link-local virtual address rather than manually assigning one, and verifies failover behavior mirrors the IPv4 HSRP lab covered earlier in this series.

Continue

Hands-On Lab: Configuring SVI Autostate Exclude

This hands-on lab configures SVI autostate exclude on a monitoring port within a VLAN, preventing that single inactive port from incorrectly bringing down the SVI for an entire VLAN that still has other active member ports.

Continue

Hands-On Lab: Configuring Private VLANs (PVLANs)

This hands-on lab configures a full Private VLAN structure with a primary VLAN and both isolated and community secondary VLANs, demonstrating fine-grained Layer 2 isolation within a single IP subnet beyond what the simple protected-port feature from an earlier lab can achieve.

Continue

Hands-On Lab: Configuring VLAN Access Control Lists (VACLs)

This hands-on lab configures a VLAN Access Control List using a VLAN access-map to filter traffic within a single VLAN at Layer 2, something a standard router-applied ACL cannot achieve since traffic never leaves the VLAN to reach a routed interface.

Continue

Hands-On Lab: Configuring Storm Control

This hands-on lab configures storm control thresholds on a switch port to limit broadcast and multicast traffic, simulating a broadcast storm and verifying the switch suppresses excess traffic before it can overwhelm the network.

Continue

Hands-On Lab: Configuring PVLAN Edge (Protected Ports)

This hands-on lab configures PVLAN Edge (protected ports) on two access ports within the same VLAN, isolating them from each other at Layer 2 while both retain normal connectivity to an uplink port, demonstrating a lightweight isolation feature that requires no separate VLAN.

Continue
Previous ArticleNext Article