DMVPN Dual Hub Question

[genelidman]

Anyone have a running Dual Hub VPN network???

I have an existing DMVPN solution up and running with 1 Hub and 5 Spokes. My company has just acquired another company and now I must add 5 new spokes. For load-balancing and redundancy I want to turn one the the existing spokes into a second Hub and have half my spokes connect to it (I am running EIGRP). I understand that each configured spoke will establish a tunnel with it's hub, but I am wondering if and how the two hubs will create tunnels between each other.

My configuration is basically the same as found in the Cisco document linked below so I won't attach it.

http://www.cisco.com/warp/public/105/dmvpn.html

Any help on this matter would be appreciated!

Thanks,

Gene

[ehirsel]

I don't have experience in running DMVPN, however I had a look at the cisco doc, and it seems to me that whether or not you are using dual-hub/single-DMVPN or dual-hub/dual-DMVPN that each spoke connects to both hubs.

In your case does each spoke only connect to one hub, and only one hub?

The routing protocols between the hubs should take care of the return paths, if you have the case where the spokes connect to only one hub. You do not necessarily need to create a seperate tunnel between the hubs (i.e., they are co-located and have a subnet in common to exchange routing info over - but it applies if the hubs are not co-located as well.) However having a GRE tunnel connected via IPSec is a good security mechanism to avoid spoofed routing advertisements. In any case, there will be a need for the hubs to exchange routing info, due to hosts that are on the backside of the hubs using only one of them as the default gateway whereas the tunnel to the spoke is connected to the other one.

Let me know if this helps.

[rwcrowe]

I would scale the existing hub. Add another headend device.

[ehirsel]

If all the spokes will connect to both hubs, you will not need to configre a tunnel on the hubs since each one will be receiving route advertisements for all the spokes. You can adjust the metrics in EIGRPm, if you want the spokes to prefer one hub over the other.

On the other hand, if the spokes will only connect to one hub, then you will have to have the hubs exhcnage routing table updates - doing that over a GRE tunnel using IPSEC is a good security practice to insure that only authorized devices can send and process route updates. In this case it will be easier to use another eigrp AS or a seperate routing protocol such as OSPF to prevent route info loops and other issues that can arise when trying to propogage the route advertisements from the spokes.