View source for DMVPN (Phase 3) with OSPF configuration example


<p style="color:red">The information on this page is updated in accordance with the [https://wiki.teltonika-networks.com/view/FW_%26_SDK_Downloads'''00.07.07.1'''] firmware version .</p>

=Introduction=



If You have trouble seeing any of the settings, be sure to enable "'''Advanced mode'''"
[[File:Networking rutos manual webui basic advanced mode 75.gif|none|border|center|class=tlt-border]]
=Topology=

(Topology image)


<ul>
<li> DMVPN HUB - GRE interface address - 10.0.0.254 - LAN interface address 192.168.254.1</li>
<li> DMVPN SPOKE1 - GRE interface address - 10.0.0.1 - LAN interface address 192.168.1.1</li>
<li> DMVPN SPOKE2 - GRE interface address - 10.0.0.2 - LAN interface address 192.168.2.1</li>
</ul>
=Creating DMVPN network=

==HUB's configuration==

Navigate to '''Services → VPN → DMVPN'''

Create a new instance with a name of Your choice. In this example, we will name it '''"HUB"'''

[[File:DMVPN add Hub.png|none|border|left|class=tlt-border|1100x1100px]]

Configure the HUB as shown:

[[File:DMVPN Hub 1.png|none|border|left|class=tlt-border|1100x1100px]]

[[File:DMVPN Hub 2.png|none|border|left|class=tlt-border|1100x1100px]]

<ul>
<li>'''1. Enable''' - On</li>
<li>'''2. Working mode''' - Hub</li>
<li>'''3. Local GRE interface IP address''' - 10.0.0.254</li>
<li>'''4. Local GRE interface netmask''' - 255.255.255.255</li>
<li>'''5. Pre-shared key''' - Create a password which will be used in authentication</li>
<li>'''6. Redirect''' - On</li>
<li>'''7. NFLOG group''' - 123</li>
<li>'''8. NHRP multicast NFLOG group''' - 124 (different than NFLOG group number)</li>
</ul>

==SPOKE's configuration==

Navigate to '''Services → VPN → DMVPN'''

Create a new instance with a name of Your choice. In this example, we will name it '''"SPOKE1"'''

Configure the SPOKE1 as shown:

[[File:DMVPN Spoke1 1.png|none|border|left|class=tlt-border|1100x1100px]]

[[File:DMVPN Spoke1 2.png|none|border|left|class=tlt-border|1100x1100px]]

<ul>
<li>'''1. Enable''' - On</li>
<li>'''2. Working mode''' - Spoke</li>
<li>'''3. Hub address''' - Public IP address of the Hub</li>
<li>'''4. Local GRE interface IP address''' - 10.0.0.1</li>
<li>'''5. Remote GRE interface IP address''' - 10.0.0.254</li>
<li>'''6. Pre-shared key''' - Use the same password that was created in the Hub's configuration</li>
<li>'''7. Redirect''' - On</li>
<li>'''8. Multicast''' - On</li>
<li>'''9. NHRP multicast NFLOG group''' - 124 (same number that was in the Hub's configuration)</li>
</ul>

Configuration for the SPOKE2 will be analog to SPOKE1, with the exception of name being SPOKE2 and Local GRE interface IP address being 10.0.0.2

=Testing DMVPN's connectivity=

Pinging SPOKE1 from the HUB:

 root@RUTXR1:~# ping 10.0.0.1
 PING 10.0.0.1 (10.0.0.1): 56 data bytes
 64 bytes from 10.0.0.1: seq=0 ttl=64 time=52.890 ms
 64 bytes from 10.0.0.1: seq=1 ttl=64 time=416.808 ms
 64 bytes from 10.0.0.1: seq=2 ttl=64 time=246.881 ms
 64 bytes from 10.0.0.1: seq=3 ttl=64 time=222.941 ms

Pinging SPOKE2 from the HUB:

 root@RUTXR1:~# ping 10.0.0.2
 PING 10.0.0.2 (10.0.0.2): 56 data bytes
 64 bytes from 10.0.0.2: seq=0 ttl=64 time=119.929 ms
 64 bytes from 10.0.0.2: seq=1 ttl=64 time=79.639 ms
 64 bytes from 10.0.0.2: seq=2 ttl=64 time=294.173 ms
 64 bytes from 10.0.0.2: seq=3 ttl=64 time=318.533 ms


=OSPF configuration=
==Hub configuration==

On the Hub router, navigate to '''Network → Routing → Dynamic Routes → OSPF''' and configure OSPF as shown:

[[File:DMVPN Hub OSPF 1.png|none|border|left|class=tlt-border|1100x1100px]]

[[File:DMVPN Hub OSPF Interface.png|none|border|left|class=tlt-border|1100x1100px]]

[[File:DMVPN Spoke1 OSPF 2.png|none|border|left|class=tlt-border|1100x1100px]]

<ul>
<li>'''1. Enable Service''' - On</li>
<li>'''2. Router ID''' - 10.0.0.254</li>
<li>'''3. Passive interfaces''' - br-lan (all LAN interfaces)</li>
<li>'''4. Redistribution options''' - NHRP </li>
<li>'''5. OSPF Interfaces''' - Create an entry, choose '''Type''' as '''Point-to-Multipoint''' and choose DMVPN interface as OSPF Interface and enable it</li>
<li>'''6. OSPF Area''' - Create an entry, input '''0''' to the '''Zone''' parameter and enable it </li>
<li>'''7. OSPF Networks''' - Create 2 entries, one network will be named GRE for VPN addresses '''10.0.0.0/24''', another networking will be named LAN for LAN addresses '''192.168.254.0/24.'''

Choose previously created OSPF Area entry and enable OSPF Networks</li>
</ul>

==Spokes configuration==

On the Spoke1 router, navigate to '''Network → Routing → Dynamic Routes → OSPF''' and configure OSPF as shown:

[[File:DMVPN Spoke1 OSPF 1.png|none|border|left|class=tlt-border|1100x1100px]]

[[File:DMVPN Hub OSPF Interface.png|none|border|left|class=tlt-border|1100x1100px]]

[[File:DMVPN Spoke1 OSPF 2.png|none|border|left|class=tlt-border|1100x1100px]]

<ul>
<li>'''1. Enable Service''' - On</li>
<li>'''2. Router ID''' - 10.0.0.1</li>
<li>'''3. Passive interfaces''' - br-lan (all LAN interfaces)</li>
<li>'''4. Redistribution options''' - None </li>
<li>'''5. OSPF Interfaces''' - Create an entry, choose '''Type''' as '''Point-to-Multipoint''' and choose DMVPN interface as OSPF Interface and enable it</li>
<li>'''6. OSPF Area''' - Create an entry, input '''0''' to the '''Zone''' parameter and enable it </li>
<li>'''7. OSPF Networks''' - Create 2 entries, one network will be named GRE for VPN addresses '''10.0.0.0/24''', another networking will be named LAN for LAN addresses '''192.168.1.0/24.'''

Choose previously created OSPF Area entry and enable OSPF Networks</li>
</ul>

Configuration for the SPOKE2 will be analog to SPOKE1, with the exception of Router ID being 10.0.0.2 and OSPF Networks LAN entry's address being 192.168.2.0/24

=Firewall Zones=

This step should be done on DMVPN '''Hub and all spokes''' for OSPF to allow OSPF routes to their LAN networks.

Navigate to '''Network -> Firewall -> General settings -> Zones''', set GRE zone to forward traffic to LAN and disable masquerading.

[[File:DMVPN Firewall LAN zone.png|none|border|left|class=tlt-border|1100x1100px]]

=Testing the setup=

If You have followed the steps correctly, configuration should be finished. These should be the results that You will be getting:

Routes on Spoke1:
 root@RUTX11:~# ip route
 default dev qmimux0 proto static scope link src '''WAN IP''' metric 1
 10.0.0.2 nhid 30 via 10.0.0.254 dev gre4-SPOKE1 proto ospf metric 20 onlink
 10.0.0.254 dev gre4-SPOKE1 proto static scope link
 '''WAN IP''' dev qmimux0 proto static scope link metric 1
 192.168.1.0/24 dev br-lan proto kernel scope link src 192.168.1.1
 192.168.2.0/24 nhid 30 via 10.0.0.254 dev gre4-SPOKE1 proto ospf metric 20 onlink
 192.168.254.0/24 nhid 30 via 10.0.0.254 dev gre4-SPOKE1 proto ospf metric 20 onlink

Routes on Spoke2:
 root@RUTX11:~# ip route
 default dev qmimux0 proto static scope link src 84.15.227.188 metric 1
 10.0.0.1 nhid 41 via 10.0.0.254 dev gre4-SPOKE2 proto ospf metric 20 onlink
 10.0.0.254 dev gre4-SPOKE2 proto static scope link
 84.15.227.188 dev qmimux0 proto static scope link metric 1
 192.168.1.0/24 nhid 41 via 10.0.0.254 dev gre4-SPOKE2 proto ospf metric 20 onlink
 192.168.2.0/24 dev br-lan proto kernel scope link src 192.168.2.1
 192.168.254.0/24 nhid 41 via 10.0.0.254 dev gre4-SPOKE2 proto ospf metric 20 onlink

OSPF neighbors on HUB (done on '''FRR VTYSH''' package):

[[File:DMVPN OSPF neighbors.png|none|border|left|class=tlt-border|1100x1100px]]

Spoke1 pinging Spoke2, traffic not going through HUB:

Spoke1:
 root@RUTX11:~# ping 192.168.2.1
 PING 192.168.2.1 (192.168.2.1): 56 data bytes
 64 bytes from 192.168.2.1: seq=0 ttl=63 time=122.731 ms
 64 bytes from 192.168.2.1: seq=1 ttl=63 time=123.373 ms
 64 bytes from 192.168.2.1: seq=2 ttl=64 time=100.596 ms
 64 bytes from 192.168.2.1: seq=3 ttl=64 time=100.323 ms
 64 bytes from 192.168.2.1: seq=4 ttl=64 time=100.048 ms

HUB's traffic:
 root@RUTXR1:~# tcpdump -i gre4-HUB
 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
 listening on gre4-HUB, link-type LINUX_SLL (Linux cooked v1), snapshot length 262144 bytes
 11:56:27.429401 IP 10.0.0.254 > ospf-all.mcast.net: OSPFv2, Hello, length 52
 11:56:27.429578 IP 10.0.0.254 > ospf-all.mcast.net: OSPFv2, Hello, length 52
 11:56:28.334054 IP 10.0.0.254 > 10.0.0.2: OSPFv2, LS-Update, length 100
 11:56:29.094679 IP 10.0.0.2 > ospf-all.mcast.net: OSPFv2, Hello, length 52
 11:56:29.095649 IP 10.0.0.2 > ospf-all.mcast.net: OSPFv2, LS-Ack, length 44
 11:56:35.381588 IP 10.0.0.1 > ospf-all.mcast.net: OSPFv2, Hello, length 52

<br>

=See also=

<ul>
<li></li>
<li></li>
<li></li>
<li></li>
<li></li>
<li></li>
<li></li>
<li></li>
</ul>


=External links=