08-22-2023
04:53 AM
- last edited on
08-24-2023
03:11 AM
by
Translator
I am reading thru this manual on how to configure
NHRP
on FlexVPN:
I am in particular talking about the spoke part where there they use the same
NHRP
configuration on the tunnel and virtual template interface. Example:
interface Tunnel0 ip address negotiated ip nhrp network-id 1 ip nhrp shortcut virtual-template 1 ip nhrp redirect tunnel source Ethernet0/0 tunnel destination 10.0.0.100 tunnel protection ipsec profile default ! interface Virtual-Template1 type tunnel ip unnumbered Tunnel0 ip nhrp network-id 1 ip nhrp shortcut virtual-template 1 ip nhrp redirect tunnel protection ipsec profile default !
So as there is traffic from spokeA to spokeB, the hub creates a redirect message causing the two spokes to create direct VPN tunnel in between eachother. At this point, traffic that is sourced from spokeA and destined for spokeB (and vice versa) will go thru this tunnel that is a virtual-access interface. So why do we have to have
NHRP
even runnning on this virtual access interface? We are not doing routing (because of the next-hop-override of
NHRP
) so there is no possibility that any traffic destined for another spoke would arrive via this virtual-access interface where
NHRP
would have to jump in an
redirect
it in any way. So my undertanding is, that we can leave out all 3
NHRP
commands from the virtual-template interface. But surely, if that is the case, then cisco wouldnt put such a configuration into a template. So what am i missing here?
Solved! Go to Solution.
08-22-2023
05:19 AM
- last edited on
08-24-2023
02:57 AM
by
Translator
Hello @mario.jost,
As concerned
NHRP
configuration on the virtual-template interface, you're correct that you may not need the
NHRP
commands on the virtual-template interface since it's used for tunnel establishment and encapsulation, not routing decisions. However, Cisco might include these commands for consistency and ease of configuration, especially in a template where it's assumed to be part of a larger deployment.
If you're confident that the
NHRP
commands on the virtual-template interface aren't necessary for your specific use case and network design, you can certainly omit them without adversely affecting the DMVPN functionality. Just ensure that the
NHRP
configuration on the tunnel interface and the spoke interfaces is correctly set up to handle the
NHRP
traffic and shortcut creation.
08-22-2023
05:19 AM
- last edited on
08-24-2023
02:57 AM
by
Translator
Hello @mario.jost,
As concerned
NHRP
configuration on the virtual-template interface, you're correct that you may not need the
NHRP
commands on the virtual-template interface since it's used for tunnel establishment and encapsulation, not routing decisions. However, Cisco might include these commands for consistency and ease of configuration, especially in a template where it's assumed to be part of a larger deployment.
If you're confident that the
NHRP
commands on the virtual-template interface aren't necessary for your specific use case and network design, you can certainly omit them without adversely affecting the DMVPN functionality. Just ensure that the
NHRP
configuration on the tunnel interface and the spoke interfaces is correctly set up to handle the
NHRP
traffic and shortcut creation.
08-23-2023
12:52 PM
- last edited on
08-24-2023
03:03 AM
by
Translator
Hey M02@rt37
Thank you very much for the reply and the explanation. Follow up question that belongs in the same category. Am i right to assume that only the Hub needs to have
ip nhrp redirect
active on its interfaces and the spokes dont need this. Because as it is described in this step of the same document:
under the illustration, it explains as step 3:
The traffic from Host1 to Host2 traverses the hub through virtual access interface1 and virtual access interface2. The hub determines that ingress and the egress interfaces (virtual access interface1 and virtual access interface2) belong to same
NHRP
network (network D configured on both the interfaces). The hub sends out an
NHRP redirect
message to spoke1 on virtual access interface1.
So i understand it like. If the traffic has to do a "turn" on a router between two interfaces belonging to the same
NHRP
group, this
redirect
command is necessary. But if i understand our design, there is no traffic going to one of our spoke routers and getting "redirected" to another spoke router. So therefore the
redirect
is not necessary on the spokes tunnel interface. Am i right?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide