DMVPN Phase 3 dual cloud Spoke-to-Spoke communication

[Michael Grann]

Hello,

I'd like to confirm/verify if Phase 3 allows Spokes in different DMVPN domains to communicate directly or is traffic from Spoke-DMVPN-A routed across the Hubs to Spoke-DMVPN-B? Any authoritative documentation on CCO on this specific scenario is greatly appreciated.

Thanks.

-Mike

[Marcin Latosiewicz · Accepted solution]

Mike, 

I might be off, not working with VPNs for a year now, but here goes. 

It really depends on what is a domain for you. Remember that NHRP network ID is locally significant.

Ultimately same network ID allows NHRP resolution requests to jump between different tunnels. 

If network ID is different then the "domain" is different and NHRP should not flow between. 

For the rest it's all based on routing, it's just a question of making conscious design choices before deploying and a bit of testing. 

M.

[Michael Grann]

Hi Marcin,

Thank you for the clarification. I'm just making sure Phase 3 has nothing to do with the ID.

-Mike

[Marcin Latosiewicz]

Mike, 

I would be careful though about the end goal of a design is. 

The separation is there for a reason (on ID level), DMVPN phase 3 design is meant to be multipoint design with redundancy built around routing (at least in the most typical scenario). 

Do not try to over-complicate the design, unless you test it thoroughly first. 

M.