question about moving to tunnels to DMVPN

[carl_townshend]

Hi All

We currently use an mpls with a tunnel overlay network, using crypto maps with ospf routing etc.

We have the usual fun and games of having to add tunnels to all routers when we add a new site etc.

My question is has anyone managed to do a smooth migration to dmvpn overlay from normal tunnels.

What would be the best way of doing this? is it possible to do a site by site migration?

cheers

[grabonlee]

Carl,

It's possible to migrate from GRE/IPSEC to DMVPN/IPSEC. But it depends on several factors, such as type of routers you have and number of sites. If you're using same Hub routers for the DMVPN, then I would suggest creating a separate crypto profile, preferably using IKEv2 (depends on your router IOS) and peer the hub and spokes using another separate loopbacks from that used by the GRE Crypto and also separate tunnel interfaces. Once the DMVPN is confirmed up over the new tunnel, then you can shut down the tunnel used by the Crypto-map.

One thing you should consider though is that OSPF is not recommended for DMVPN because of Spoke-to-Spoke communication and scalability, though it can be used in point-to-multipoint to take of this.