DMVPN over IPsec

Hello Samir

In this particular scenario, we are using DMVPN Phase 2. This means that we are creating spoke-to-spoke tunnels, so traffic will go directly from spoke to spoke. However, to create a spoke-to-spoke tunnel, initially, traffic is sent to the hub. Using NHRP, the hub directs all subsequent traffic to be routed directly between spokes.

For multicast traffic, the behavior is similar:

The ip nhrp map multicast command on the hub helps to initially establish multicast traffic flow from the hub to the spokes. When you configure this command, multicast traffic is initially sent to the hub, which then forwards the traffic to the spokes.

Once spoke-to-spoke tunnels are established using NHRP to dynamically discover the public IP address of the other spokes, subsequent multicast traffic can flow directly between the spokes, bypassing the hub. This is possible because of the use of NHRP in a similar manner as with unicast traffic to dynamically discover the public IP addresses of the other spokes and create direct GRE tunnels between them.

When a spoke wants to send multicast traffic to another spoke, it first checks its NHRP cache to see if it has a direct GRE tunnel to the destination spoke. If it does, it will send the traffic directly through that tunnel. If it doesn’t have a direct tunnel, it will send the traffic to the hub, which will then forward it to the destination spoke.

So, once spoke-to-spoke tunnels are created, multicast traffic will not always go via the hub. Instead, it will be sent directly between the spokes, providing a more efficient traffic flow.

I hope this has been helpful!

Laz