WEBVTT

1
00:00.000 --> 00:02.620 align:middle line:84%


2
00:02.620 --> 00:05.407 align:middle line:90%
Dynamic multipoint VPNs
are indeed very amazing.

3
00:05.407 --> 00:07.990 align:middle line:90%
In this video, I'd like to take
a look at why they're amazing,

4
00:07.990 --> 00:10.240 align:middle line:90%
what they do for us,
and introduce you

5
00:10.240 --> 00:13.820 align:middle line:90%
to a few components in the
mix that make it all possible.

6
00:13.820 --> 00:15.047 align:middle line:84%
So let's use this network.

7
00:15.047 --> 00:16.630 align:middle line:90%
And let's imagine
that this represents

8
00:16.630 --> 00:17.620 align:middle line:84%
three different sites.

9
00:17.620 --> 00:19.900 align:middle line:90%
Maybe this is the
headquarter site up here.

10
00:19.900 --> 00:21.700 align:middle line:84%
And this is site 2.

11
00:21.700 --> 00:23.060 align:middle line:84%
And over here we have site 3.

12
00:23.060 --> 00:24.560 align:middle line:90%
And we need some
basic connectivity.

13
00:24.560 --> 00:26.602 align:middle line:90%
So let's also imagine each
of these three routers

14
00:26.602 --> 00:28.130 align:middle line:90%
has some connectivity
to a network.

15
00:28.130 --> 00:29.172 align:middle line:84%
It could be the internet.

16
00:29.172 --> 00:30.860 align:middle line:84%
It could be a private network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.172 --> 00:30.860 align:middle line:84%
It could be a private network.

17
00:30.860 --> 00:32.535 align:middle line:84%
It could be MPLS, what have you.

18
00:32.535 --> 00:33.910 align:middle line:90%
But they've all
got connectivity.

19
00:33.910 --> 00:36.050 align:middle line:90%
And they've got these
reachable addresses.

20
00:36.050 --> 00:38.650 align:middle line:84%
So R1 is 15.1.1.1.

21
00:38.650 --> 00:39.580 align:middle line:84%
R2 is this guy.

22
00:39.580 --> 00:40.960 align:middle line:84%
And R3 is this guy.

23
00:40.960 --> 00:42.460 align:middle line:90%
And from a color-coding
perspective,

24
00:42.460 --> 00:46.690 align:middle line:90%
I color-coded these IP addresses
in yellow, the publicly

25
00:46.690 --> 00:48.250 align:middle line:84%
reachable IP addresses.

26
00:48.250 --> 00:50.230 align:middle line:90%
In DMVPN speak
sometimes they refer

27
00:50.230 --> 00:53.440 align:middle line:90%
to those publicly reachable
addresses as the NBMA,

28
00:53.440 --> 00:56.955 align:middle line:90%
as a Non-Broadcast
Multi-Access Address.

29
00:56.955 --> 00:58.330 align:middle line:90%
So whenever you
see this keyword,

30
00:58.330 --> 01:00.250 align:middle line:90%
just think about the
reachable address
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
00:58.330 --> 01:00.250 align:middle line:90%
just think about the
reachable address

31
01:00.250 --> 01:03.160 align:middle line:90%
that each router can use
to reach the other devices.

32
01:03.160 --> 01:06.070 align:middle line:90%
Now, as the name implies, we
are going to build some tunnels.

33
01:06.070 --> 01:07.725 align:middle line:90%
And they are going
to be GRE-based.

34
01:07.725 --> 01:10.100 align:middle line:90%
And we're going to have some
tunnels that look like this.

35
01:10.100 --> 01:12.433 align:middle line:90%
And the tunnels also are going
to have a network address

36
01:12.433 --> 01:12.970 align:middle line:84%
space.

37
01:12.970 --> 01:15.595 align:middle line:90%
And so the network address space
we're going to use is this guy

38
01:15.595 --> 01:20.720 align:middle line:90%
right here, 172.16.123.R, where
R represents the router number.

39
01:20.720 --> 01:21.970 align:middle line:84%
So R1 would end in .1.

40
01:21.970 --> 01:23.790 align:middle line:84%
R2 would end in .2.

41
01:23.790 --> 01:25.410 align:middle line:84%
R3 would end in .3.

42
01:25.410 --> 01:28.810 align:middle line:90%
And the cool thing is that
instead of using a separate GRE

43
01:28.810 --> 01:32.612 align:middle line:90%
tunnel interface, one from
R1, another one from R1 to R3,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
01:28.810 --> 01:32.612 align:middle line:90%
tunnel interface, one from
R1, another one from R1 to R3,

44
01:32.612 --> 01:34.570 align:middle line:90%
we're going to use a
special type of GRE called

45
01:34.570 --> 01:38.020 align:middle line:90%
an mGRE, a multipoint
GRE interface,

46
01:38.020 --> 01:40.960 align:middle line:90%
so that R1 can have one
tunnel interface here,

47
01:40.960 --> 01:43.240 align:middle line:90%
and then it can have multiple
connections off of that.

48
01:43.240 --> 01:45.240 align:middle line:90%
We're going to use that
same treatment down here

49
01:45.240 --> 01:46.640 align:middle line:84%
at site 2 and site 3 as well.

50
01:46.640 --> 01:48.672 align:middle line:90%
So whenever I refer to
the tunnel IP addresses,

51
01:48.672 --> 01:50.380 align:middle line:90%
I'm talking about the
tunnel IP addresses

52
01:50.380 --> 01:51.762 align:middle line:84%
on the tunnel interfaces.

53
01:51.762 --> 01:52.720 align:middle line:84%
Now, here's the kicker.

54
01:52.720 --> 01:55.390 align:middle line:90%
Let's say we have a user like
Bob, who's over here at site 2.

55
01:55.390 --> 01:56.980 align:middle line:84%
He's on the 10.2 network.

56
01:56.980 --> 01:59.590 align:middle line:90%
And he wants to send traffic
over to a resource over here

57
01:59.590 --> 02:01.910 align:middle line:84%
at site 3 on the 10.3 network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
01:59.590 --> 02:01.910 align:middle line:84%
at site 3 on the 10.3 network.

58
02:01.910 --> 02:03.160 align:middle line:84%
I'll put a server there.

59
02:03.160 --> 02:07.222 align:middle line:90%
That traffic might have to
go up to the hub, the R1, who

60
02:07.222 --> 02:08.389 align:middle line:84%
would then have to route it.

61
02:08.389 --> 02:11.050 align:middle line:90%
However, if we trained R2 that
the next hop to get to the 10.3

62
02:11.050 --> 02:14.710 align:middle line:84%
network was 172.16.123.3.

63
02:14.710 --> 02:18.360 align:middle line:90%
And if you're thinking,
"Hey, that seems familiar,"

64
02:18.360 --> 02:20.530 align:middle line:90%
that's the tunnel IP
network address space.

65
02:20.530 --> 02:22.360 align:middle line:90%
If R2 believed that
was the next hop,

66
02:22.360 --> 02:24.520 align:middle line:90%
that would trigger R2
to go ahead and forward

67
02:24.520 --> 02:26.480 align:middle line:84%
the traffic directly to R3.

68
02:26.480 --> 02:29.590 align:middle line:90%
Now, the problem
is how does R2 know

69
02:29.590 --> 02:32.920 align:middle line:90%
what R3's public address is,
the reachable address, the NBMA
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:29.590 --> 02:32.920 align:middle line:90%
what R3's public address is,
the reachable address, the NBMA

70
02:32.920 --> 02:33.420 align:middle line:84%
address.

71
02:33.420 --> 02:35.230 align:middle line:90%
The answer is we
are going to use yet

72
02:35.230 --> 02:36.920 align:middle line:84%
another protocol for that.

73
02:36.920 --> 02:41.710 align:middle line:90%
And that protocol is called
NHRP, the Next Hop Resolution

74
02:41.710 --> 02:43.090 align:middle line:84%
Protocol.

75
02:43.090 --> 02:47.320 align:middle line:90%
So by using GRE, multipoint
GRE tunnels, and next hop

76
02:47.320 --> 02:49.750 align:middle line:90%
resolution protocols,
we can have a situation

77
02:49.750 --> 02:52.240 align:middle line:90%
where R2, if it
needs to send traffic

78
02:52.240 --> 02:55.700 align:middle line:90%
from itself over to 10.3, it
can not only learn about that

79
02:55.700 --> 02:58.460 align:middle line:90%
and learn about the
next hop via NHRP.

80
02:58.460 --> 03:00.250 align:middle line:90%
But also, if there's
no tunnel in place,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:58.460 --> 03:00.250 align:middle line:90%
But also, if there's
no tunnel in place,

81
03:00.250 --> 03:03.640 align:middle line:90%
it can dynamically negotiate
a tunnel between R2 and R3,

82
03:03.640 --> 03:05.170 align:middle line:90%
build that tunnel,
and then start

83
03:05.170 --> 03:08.330 align:middle line:90%
routing the traffic directly
from itself over to R3

84
03:08.330 --> 03:10.320 align:middle line:84%
over an IPsec tunnel.

85
03:10.320 --> 03:12.967 align:middle line:90%
And that way the traffic no
longer has to go over the hub.

86
03:12.967 --> 03:14.050 align:middle line:84%
So here's the big picture.

87
03:14.050 --> 03:16.270 align:middle line:90%
If we have a hub or
two that we configure,

88
03:16.270 --> 03:19.370 align:middle line:90%
we have spokes dynamically
check in with those hubs,

89
03:19.370 --> 03:21.850 align:middle line:90%
and then dynamically build
tunnels with each other,

90
03:21.850 --> 03:23.140 align:middle line:84%
spoke to spoke to spoke.

91
03:23.140 --> 03:25.510 align:middle line:90%
If we need to, they can
send traffic directly,

92
03:25.510 --> 03:28.120 align:middle line:90%
all without having
to manually configure

93
03:28.120 --> 03:31.090 align:middle line:90%
those specific IPsec tunnels
between all the spokes.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:28.120 --> 03:31.090 align:middle line:90%
those specific IPsec tunnels
between all the spokes.

94
03:31.090 --> 03:32.030 align:middle line:84%
It's amazing.

95
03:32.030 --> 03:32.820 align:middle line:84%
So here is what we get to do.

96
03:32.820 --> 03:35.020 align:middle line:90%
We're going to think this
topology with these three sites

97
03:35.020 --> 03:37.310 align:middle line:90%
and we'll walk through the
configuration step by step.

98
03:37.310 --> 03:39.310 align:middle line:90%
And as we go, we'll verify
that each piece works

99
03:39.310 --> 03:43.933 align:middle line:90%
until we have a fully functional
IPsec-protected DMVPN network.

100
03:43.933 --> 03:45.350 align:middle line:90%
So I'll see you
in the next video.

101
03:45.350 --> 03:47.740 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

102
03:47.740 --> 03:50.940 align:middle line:90%
And I'd like to thank
you for viewing.