DMVPN over IPsec

Hello Samir

Yes you are correct. Multicast traffic will not be able to initiate the creation of point to point GRE tunnel between spokes. If this tunnel does not exist, multicast traffic will be routed via the hub. Only unicast traffic will trigger the creation of a spoke-to-spoke tunnel. This is simply due to the design and behavior of the NHRP protocol.

Specifically, the NHRP resolution process is triggered only by unicast traffic and not multicast traffic.

When multicast traffic is sent to the hub, it is forwarded to all registered spokes. Since the multicast traffic is not specifically addressed to a single spoke, it does not provide an opportunity for NHRP to learn about the other spokes’ public IP addresses or establish direct GRE tunnels.

This is a design choice for NHRP, which helps to optimize network traffic flow and reduce unnecessary overhead. If multicast traffic were used to establish spoke-to-spoke tunnels, it could result in numerous unnecessary tunnels being built, which could consume additional resources and complicate the network. Thus it is more efficient to rely only on unicast to trigger the NHRP resolution process.

I hope this has been helpful!

Laz

1 Like