DMVPN - prevent spoke to spoke through HUB

[jmattbullen]

I have a phase 1 dmvpn setup with around 600 remote sites.  We run BGP over the hub and advertise a default route.  Is there any way other than an ACL on the hub to prevent spoke to spoke communication through the hub?  That ACL is getting quite large and my gut tells me there should be an easier way.

Thanks

[Mark Malone]

If you were using eigrp as the igp you could enable split-horizon prevent the spokes from knowing anything about each other
 

[jmattbullen]

the spokes already don't know about each other.  but they get a default route so they send packets to the hub and the hub knows about the other network.

[paul driver]

Hello

Basically you are wanting to do the opposite of what dmvpn is designed to to!

I am assuming your hub is dynamically multicasting and doesn't  have 600 static  nhrp.  mapping?

I was thinking a possibly use a bgp peer group and ip as path filter lists and apply It outbound prohibiting the spoke ASN's and advertising only local prefiixs and external routes..

res

paul