Hands-On Lab: Configuring Basic DMVPN (mGRE with NHRP)

Lab Objective

Configure a hub router with a multipoint GRE (mGRE) tunnel interface and a spoke router with NHRP registration pointing to the hub, verifying the spoke's physical address is dynamically learned by the hub rather than manually configured.

Lab Purpose

The GRE tunnels configured in earlier labs were all point-to-point, requiring a dedicated tunnel interface for every spoke in a hub-and-spoke design — impractical at scale with dozens of sites. DMVPN solves this using a single multipoint tunnel interface on the hub combined with NHRP, which allows spokes to dynamically register themselves rather than each requiring a separately configured point-to-point tunnel.

Lab Topology

Hub ---- Gi0/1 ---- ISP ---- Gi0/1 ---- Spoke1

Hub: Gi0/1 (WAN) 203.0.113.17/30
Spoke1: Gi0/1 (WAN) 203.0.113.21/30

Tunnel0 on Hub: 172.16.200.1/24 (mGRE)
Tunnel0 on Spoke1: 172.16.200.2/24

Task 1: Configure Basic WAN Addressing

Configure both routers' WAN-facing interfaces.

Task 2: Configure the Hub's Multipoint GRE Tunnel

Configure Tunnel0 on the hub as multipoint GRE, with an NHRP network ID and no fixed tunnel destination.

Task 3: Configure the Spoke's Tunnel with NHRP Registration

Configure Tunnel0 on the spoke, pointing NHRP registration toward the hub's tunnel address and its actual physical (NBMA) address.

Task 4: Verify the Spoke Registers with the Hub

Confirm the hub's NHRP cache shows the spoke's dynamically learned physical address.

Task 5: Verify Connectivity Across the Tunnel

Confirm the spoke can ping the hub's tunnel address.

Solution and Verification

Hub(config)# interface gigabitethernet0/1
Hub(config-if)# ip address 203.0.113.17 255.255.255.252
Hub(config-if)# no shutdown

Spoke1(config)# interface gigabitethernet0/1
Spoke1(config-if)# ip address 203.0.113.21 255.255.255.252
Spoke1(config-if)# no shutdown

Hub(config)# interface tunnel0
Hub(config-if)# ip address 172.16.200.1 255.255.255.0
Hub(config-if)# tunnel mode gre multipoint
Hub(config-if)# tunnel source gigabitethernet0/1
Hub(config-if)# ip nhrp network-id 1

-- Notice there is no "tunnel destination" --
-- this is precisely what makes the tunnel
-- multipoint, capable of dynamically
-- communicating with any number of spokes
-- through a single interface, unlike the
-- point-to-point tunnels in earlier labs

Spoke1(config)# interface tunnel0
Spoke1(config-if)# ip address 172.16.200.2 255.255.255.0
Spoke1(config-if)# tunnel source gigabitethernet0/1
Spoke1(config-if)# tunnel mode gre multipoint
Spoke1(config-if)# ip nhrp network-id 1
Spoke1(config-if)# ip nhrp nhs 172.16.200.1 nbma 203.0.113.17

-- "nhs" (Next Hop Server) tells the spoke
-- where the hub is, mapping the hub's tunnel
-- address to its actual physical WAN address
-- -- this triggers automatic registration

Hub# show ip nhrp

172.16.200.2/32 via 172.16.200.2, Tunnel0 created
  NBMA address: 203.0.113.21
-- The hub automatically learned Spoke1's
-- physical WAN address through NHRP
-- registration, without ever having it
-- manually configured

Spoke1# ping 172.16.200.1

!!!!!
Success rate is 100 percent (5/5)

Key Takeaway

NHRP registration is what makes DMVPN's single mGRE interface on the hub practical at scale: rather than the hub needing a manually configured tunnel destination for every spoke as in a plain GRE design, each spoke announces its own physical address dynamically, and the hub's NHRP cache builds itself automatically as spokes come online — this is the foundational mechanism that later, more advanced DMVPN phases build upon for spoke-to-spoke direct tunneling.