Hands-On Lab: Configuring OSPF over DMVPN

This hands-on lab runs OSPF as the dynamic routing protocol across the same DMVPN hub-and-spoke topology, configuring the tunnel interface as an OSPF point-to-multipoint network type to correctly handle the hub-and-spoke adjacency pattern without requiring the broadcast network type's DR/BDR election.

OSPF Point-to-Multipoint over DMVPNmGRE Network Type SelectionDMVPN OSPF Area Design

~4 min read · Updated Sep 27, 2026

Lab Objective

Configure OSPF on the same DMVPN hub-and-spoke topology used in the previous EIGRP lab, explicitly setting the tunnel interface's OSPF network type to point-to-multipoint, and verify neighbor relationships form correctly and routes propagate without the complications a mismatched network type would introduce.

Lab Purpose

OSPF's default network type on a multipoint GRE tunnel interface is non-broadcast, discussed earlier in this series, which requires manual neighbor statements — impractical on a DMVPN cloud where spokes register and de-register dynamically via NHRP. Point-to-multipoint, also covered earlier in this series, restores automatic neighbor discovery and avoids DR/BDR election entirely, making it the standard choice for OSPF over DMVPN.

Lab Topology

Same DMVPN topology as the previous EIGRP
lab, with EIGRP removed and OSPF configured
instead:

Hub ---- Tunnel0 (mGRE): 172.16.200.1/24
Spoke1 ---- Tunnel0: 172.16.200.2/24
Spoke2 ---- Tunnel0: 172.16.200.3/24

Task 1: Remove the Previous EIGRP Configuration

Remove EIGRP from all three routers, as the topology transitions to OSPF for this lab.

Task 2: Configure the Tunnel Interface's OSPF Network Type

Set the tunnel interface to point-to-multipoint network type on the hub and both spokes.

Task 3: Enable OSPF on the Tunnel and LAN Interfaces

Enable OSPF area 0 on the hub, both spokes, including their respective LANs.

Task 4: Verify Neighbor Relationships Form Without DR/BDR Election

Confirm the hub forms neighbor relationships with both spokes, with no DR or BDR role assigned to either.

Task 5: Verify Routes Propagate Correctly

Confirm each spoke's LAN is learned by the hub and by the other spoke.

Solution and Verification

Hub(config)# no router eigrp 100
Spoke1(config)# no router eigrp 100
Spoke2(config)# no router eigrp 100

Hub(config)# interface tunnel0
Hub(config-if)# ip ospf network point-to-multipoint

Spoke1(config)# interface tunnel0
Spoke1(config-if)# ip ospf network point-to-multipoint

Spoke2(config)# interface tunnel0
Spoke2(config-if)# ip ospf network point-to-multipoint

-- Setting this explicitly is essential --
-- leaving the tunnel at its default
-- non-broadcast network type would require
-- manual neighbor statements for every
-- spoke, defeating the purpose of DMVPN's
-- dynamic spoke registration entirely

Hub(config)# router ospf 1
Hub(config-router)# network 172.16.200.0 0.0.0.255 area 0
Hub(config-router)# network 192.168.10.0 0.0.0.255 area 0

Spoke1(config)# router ospf 1
Spoke1(config-router)# network 172.16.200.0 0.0.0.255 area 0
Spoke1(config-router)# network 192.168.11.0 0.0.0.255 area 0

Spoke2(config)# router ospf 1
Spoke2(config-router)# network 172.16.200.0 0.0.0.255 area 0
Spoke2(config-router)# network 192.168.12.0 0.0.0.255 area 0

Hub# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Interface
2.2.2.2          0     FULL/  -        00:01:45    Tunnel0
3.3.3.3          0     FULL/  -        00:01:52    Tunnel0
-- Both spokes formed neighbor relationships
-- automatically -- the "-" in place of a
-- DR/BDR role confirms point-to-multipoint
-- correctly skipped that election entirely,
-- treating each spoke relationship as its
-- own point-to-point adjacency

Hub# show ip route ospf

O    192.168.11.0/24 [110/1001] via 172.16.200.2, Tunnel0
O    192.168.12.0/24 [110/1001] via 172.16.200.3, Tunnel0
-- Both spoke LANs learned dynamically via
-- OSPF, requiring no manual neighbor
-- configuration anywhere in the topology

Spoke1# show ip route ospf

O    192.168.10.0/24 [110/1001] via 172.16.200.1, Tunnel0
O    192.168.12.0/24 [110/1002] via 172.16.200.1, Tunnel0
-- Spoke1 learned both the hub's LAN and
-- Spoke2's LAN, the latter routed via the
-- hub since basic OSPF over DMVPN, like
-- basic EIGRP over DMVPN in the previous
-- lab, does not build direct spoke-to-spoke
-- shortcuts on its own

Key Takeaway

Point-to-multipoint is the network type specifically suited to DMVPN's dynamic hub-and-spoke registration model, discussed conceptually in an earlier lab covering OSPF network types — it avoids both the manual neighbor statements non-broadcast would require and the unnecessary DR/BDR election broadcast mode would introduce, making it the standard, near-universal choice for running OSPF over an mGRE-based DMVPN tunnel regardless of how many spokes dynamically join or leave the cloud over time.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Final Comprehensive CCNP Troubleshooting Challenge (BGP, DMVPN, and QoS Integration)

This hands-on lab presents a complex multi-layer failure across an integrated BGP-over-DMVPN topology combined with QoS marking, requiring systematic diagnosis of a route reflector misconfiguration, an NHRP registration failure, and an incorrectly applied QoS policy simultaneously affecting the same network.

Continue

Hands-On Lab: Configuring BGP over DMVPN

This hands-on lab runs iBGP as the routing protocol across the same DMVPN hub-and-spoke topology used in the two previous labs, configuring the hub as a route reflector so spokes learn each other's routes without a full iBGP mesh, combining two previously separate concepts into one integrated design.

Continue

Hands-On Lab: Configuring EIGRP over DMVPN

This hands-on lab runs EIGRP as the dynamic routing protocol across the DMVPN hub-and-spoke topology built in earlier labs, verifying neighbor relationships form correctly across the multipoint tunnel and routes propagate without requiring per-spoke static configuration on the hub.

Continue

Hands-On Lab: Configuring HSRP MD5 Authentication

This hands-on lab configures MD5 authentication on an HSRP group, verifying two routers with matching authentication strings form a normal active/standby relationship while a router with a mismatched string is excluded from the group entirely.

Continue

Hands-On Lab: Configuring Cisco Umbrella-Style DNS Security via DNS Forwarding Redirection

This hands-on lab configures a router to redirect all client DNS queries toward a security-focused DNS resolver using DNS forwarding interception, approximating cloud-delivered DNS security enforcement without requiring per-client configuration changes.

Continue

Hands-On Lab: Configuring Cisco DNA Center Assurance-Style Health Scoring (Simulated via IP SLA and EEM)

This hands-on lab combines IP SLA monitoring with an EEM applet to simulate a simplified assurance-style health check, automatically classifying a link's health based on measured performance thresholds and logging a clear status change when the link degrades.

Continue