Re: DMVPN ipsec tunnel establishment concept question

how R2 knows that it should send the packet through hub?
ans) its part of the dmvpn functionality, its derived from the interaction
between CEF and NHRP. The configuration of NHS is done on the tunnel
interface, so the spokes are already aware of the hub. Till the time we have
glean adjacency in cef for the remote spoke's next-hop (NHRP: Encapsulation
failed failed messages are received from hub), the local spoke will redirect
traffic to other spokes via the hub.

how the tunnel establishment works here?
ans) tunnels will be up as hub-spoke all participate in IGP and IGP relies
on the tunnels. Plus NHRP interaction between hub and spoke needs the
hub-spoke tunnel. after cache timeout, nhrp database rebuild needs
interaction between the hub and spoke. So hub-spoke tunnel stays up.

What is the impact of dmvpn here on voice traffic?
ans) haven't heard of any issues on voice..the initial setup and distortion
depends more on the link latency between spoke1-hub, hub-spoke2 and
vice-versa. The actual time needed in nhrp resolution and switchover is
minimal.

p.s. you shud post security related posts on the security GS forum for more
participation. :)

cheers

Swap
#19804

On Fri, Apr 9, 2010 at 6:55 AM, jeremy co <jeremy.cool14_at_gmail.com> wrote:

> Hi folks,
>
>
> R2-------------R1(HUB)--------------------R3
>
> I faced a doubt on ipsec part of the dmvpn. I've got 3 questions:
>
> As the first packet from R2 has to go via hub since it doesn't now about
> R3's NBMA address.In the mean while that it tries to resolve NMBA address
> of R3 , still having glean adjacency , it sends packets through
> hub.(another
> question here is how R2 knows that it should send the packet through hub
> ???? since all of the routes coming from R1 to R2 have the next-hop of
> R3).
>
>
> Second question is how the tunnel establishment works here? An ipsec
> tunnel
> establishes between R2 and R1 for the first packet following with R1 to R3
> ipsec tunnel and after R2 and R3 knows about each others NBMA addresses
> ,they establish ipsec tunnel directly and R2-->R1 ,R1-->R3 ipsec tunnels
> will die after a while ? or being up for update exchanges between hub and
> spokes?
>
>
>
> What is the impact of dmvpn here on voice traffic? from tunnel
> establishment point of view? Is the audible voice distortion caused by
> switching from spoke-hub-spoke ipsec tunnels to spoke-spoke ipsec tunnels?
>
>
>
>
>
>
> Cheers,
>
>
> Jeremy
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html

Blogs and organic groups at http://www.ccie.net
Received on Fri Apr 09 2010 - 15:40:22 ART