DMVPN

DMVPN phases

Originally shared May 7, 2019. Updated for context and reflection.

Dynamic Multipoint VPN (DMVPN)  is a secure network that exchanges data between sites without requiring traffic to pass through an organization's headquarters' virtual private network (VPN) server or router.

Phase 1 — Hub & Spoke Only

In Phase 1, all spokes register with a central hub using NHRP. Traffic between sites must traverse the hub & spokes do not establish direct tunnels to each other. Routing is simple, but scalability and efficiency are limited for spoke-to-spoke traffic. TechTarget

Phase 2 — Dynamic Spoke-to-Spoke

Phase 2 introduces multipoint GRE at the spokes, allowing them to form direct tunnels with other spokes. Traffic no longer needs to transit the hub for every flow, improving efficiency. However, route information must be fully known at each spoke, and summarization isn’t practical in this case. networkjourney.com

Phase 3 — Scalable Shortcuts

Phase 3 keeps dynamic spoke-to-spoke tunnels and adds NHRP Redirect/Shortcut behavior. This lets spokes learn about each other’s next-hop addresses through the hub’s control plane, then establish direct tunnels more efficiently. Phase 3 also supports routing summarization, which helps reduce routing table size and improves scale. Cisco 

Looking Back

Back when I wrote this, DMVPN was simply the right solution for the problem in front of me. What became clear later is that DMVPN was also my introduction to the fundamentals behind modern SD-WAN, separation of control and data planes, dynamic path selection, and optimizing traffic without static complexity.

Understanding DMVPN made SD-WAN concepts feel familiar rather than abstract. While the tooling and terminology have changed, the underlying ideas haven’t. That’s been a recurring lesson throughout my career: technologies evolve, but fundamentals repeat.