2.5 Dynamic Multipoint VPN [OSPF]
Please read the previous post titled 'Dynamic Multipoint VPN [EIGRP]' to understand the different phases of DMVPN!
We assume you have already configured the routers and basic connectivity is achieved and tested using ICMP between physical interfaces of R1, R3 and R4!
Phase 1:
Creating the TUNNEL interface!
Let us first start by creating a Tunnel Interface in the range 172.16.134.0/24 on all the 3 devices!
At R1(HUB):

- R1(config)# interface Tunnel0
- - ip address 172.16.134.1 255.255.255.0
  - no ip redirects
  - ip mtu 1400
  - ip nhrp authentication cisco123
  - ip nhrp map multicast dynamic
  - ip nhrp network-id 123
  - tunnel source FastEthernet0/0
  - tunnel mode gre multipoint

At R3 (SPOKE):

- R3(config)# interface Tunnel0
- - ip address 172.16.134.3 255.255.255.0
  - ip mtu 1400
  - ip nhrp authentication cisco123
  - ip nhrp map 172.16.134.1 10.1.12.1
  - ip nhrp network-id 123
  - ip nhrp nhs 172.16.134.1
  - tunnel source FastEthernet0/0
  - tunnel destination 10.1.12.1

At R4 (SPOKE):

- R4(config)# interface Tunnel0
- - ip address 172.16.134.4 255.255.255.0
  - ip mtu 1400
  - ip nhrp authentication cisco123
  - ip nhrp map 172.16.134.1 10.1.12.1
  - ip nhrp network-id 123
  - ip nhrp nhs 172.16.134.1
  - tunnel source FastEthernet0/0
  - tunnel destination 10.1.12.1

At this point the tunnel would have come up and we can ping each other using the tunnel IP of the range 172.16.134.0/24
Configuring OSPF!
We start by configuring the OSPF routing on each devices!
At R1(HUB):

- R1(config)# router ospf 1
- - router-id 172.16.134.1
  - network 1.1.1.1 0.0.0.0 area 0
  - network 172.16.134.1 0.0.0.0 area 0
- R1(config)# interface Tunnel0
- - ip ospf network point-to-multipoint // Remember for Phase 1 HUB should be OSPF Network of Point to Multipoint
  - ip ospf hello-interval 10 // For Point to Multipoint, the Hello Timer gets changed to 40s. But since our spokes have 10s, we have to change this!

At R3 (SPOKE):

- R3(config)#router ospf 1
- - router-id 172.16.134.3
  - network 3.3.3.3 0.0.0.0 area 0
  - network 172.16.134.3 0.0.0.0 area 0
- R3(config)#interface Tunnel0
- - ip ospf network point-to-point // Spokes should be of OSPF network type Point to Point

At R4 (SPOKE):

- R4(config)#router ospf 1
- - router-id 172.16.134.4
  - network 4.4.4.4 0.0.0.0 area 0
  - network 172.16.134.4 0.0.0.0 area 0
- R4(config)#interface Tunnel0
- - ip ospf network point-to-point // Spokes should be of OSPF network type Point to Point

Configure Crypto (IPSec/ISAKMP)!
Now we will start configuring the crypto configurations to make this a DMVPN!
At R1(HUB):

- R1(config)# crypto isakmp policy 10
- - authentication pre-share
- R1(config)# crypto isakmp key cisco4 address 0.0.0.0 0.0.0.0
- R1(config)# crypto ipsec transform-set TSET esp-3des esp-sha-hmac
- - mode transport
- R1(config)# crypto ipsec profile DMVPN
- - set transform-set TSET
- R1(config)# interface Tunnel0
- - tunnel protection ipsec profile DMVPN

At R3 (SPOKE):

- R3(config)# crypto isakmp policy 10
- - authentication pre-share
- R3(config)# crypto isakmp key cisco3 address 0.0.0.0 0.0.0.0 // We cannot use peer ip address, because the OSPF adjacency will FAIL!
- R3(config)# crypto ipsec transform-set TSET esp-3des esp-sha-hmac
- - mode transport
- R3(config)# crypto ipsec profile DMVPN
- - set transform-set TSET
- R3(config)# interface Tunnel0
- - tunnel protection ipsec profile DMVPN

At R4 (SPOKE):

- R4(config)# crypto isakmp policy 10
- - authentication pre-share
- R4(config)# crypto isakmp key cisco4 address 0.0.0.0 0.0.0.0 // We cannot use peer ip address, because the OSPF adjacency will FAIL!
- R4(config)# crypto ipsec transform-set TSET esp-3des esp-sha-hmac
- - mode transport
- R4(config)# crypto ipsec profile DMVPN
- - set transform-set TSET
- R4(config)# interface Tunnel0
- - tunnel protection ipsec profile DMVPN

At this point, our DMVPN Phase 1 configuration is successful! Any communication between any device will get encrypted. All the communication in Phase 1 will happen through the HUB!
Some Verifications!
R1#sh ip ospf neigh
Neighbor ID Pri State Dead Time Address Interface
172.16.134.3 0 FULL/DROTHER 00:00:32 172.16.134.3 Tunnel0
172.16.134.4 0 FULL/DROTHER 00:00:30 172.16.134.4 Tunnel0
// DROTHER means it is neither a DR nor a BDR
R3#sh ip route
************Irrelevant Output Removed**************
1.0.0.0/32 is subnetted, 1 subnets
O 1.1.1.1 [110/11112] via 172.16.134.1, 00:09:21, Tunnel0
3.0.0.0/24 is subnetted, 1 subnets
C 3.3.3.0 is directly connected, Loopback0
4.0.0.0/32 is subnetted, 1 subnets
O 4.4.4.4 [110/22223] via 172.16.134.1, 00:09:02, Tunnel0
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.134.0/24 is directly connected, Tunnel0
O 172.16.134.1/32 [110/11111] via 172.16.134.1, 00:09:21, Tunnel0
10.0.0.0/24 is subnetted, 1 subnets
C 10.1.23.0 is directly connected, FastEthernet0/0
S* 0.0.0.0/0 [1/0] via 10.1.23.2
R4#sh ip route
************Irrelevant Output Removed**************
1.0.0.0/32 is subnetted, 1 subnets
O 1.1.1.1 [110/11112] via 172.16.134.1, 00:11:37, Tunnel0
3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/22223] via 172.16.134.1, 00:11:37, Tunnel0
4.0.0.0/24 is subnetted, 1 subnets
C 4.4.4.0 is directly connected, Loopback0
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.134.0/24 is directly connected, Tunnel0
O 172.16.134.1/32 [110/11111] via 172.16.134.1, 00:11:37, Tunnel0
10.0.0.0/24 is subnetted, 1 subnets
C 10.1.24.0 is directly connected, FastEthernet0/0
S* 0.0.0.0/0 [1/0] via 10.1.24.2
R1#sh ip nhrp
172.16.134.3/32 via 172.16.134.3, Tunnel0 created 00:13:20, expire 01:46:39
Type: dynamic, Flags: unique registered
NBMA address: 10.1.23.3
172.16.134.4/32 via 172.16.134.4, Tunnel0 created 00:12:59, expire 01:47:00
Type: dynamic, Flags: unique registered
NBMA address: 10.1.24.4
R3#sh ip nhrp
172.16.134.1/32 via 172.16.134.1, Tunnel0 created 00:28:46, never expire
Type: static, Flags:
NBMA address: 10.1.12.1
R4#sh ip nhrp
172.16.134.1/32 via 172.16.134.1, Tunnel0 created 01:31:26, never expire
Type: static, Flags:
NBMA address: 10.1.12.1
R1#sh crypto isa sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
10.1.12.1 10.1.24.4 QM_IDLE 1002 0 ACTIVE
10.1.12.1 10.1.23.3 QM_IDLE 1001 0 ACTIVE
R3#sh ip cef 4.4.4.4
4.4.4.4/32, version 37, epoch 0
0 packets, 0 bytes
via 172.16.134.1, Tunnel0, 0 dependencies
next hop 172.16.134.1, Tunnel0
valid adjacency
R4#sh ip cef 3.3.3.3
3.3.3.3/32, version 24, epoch 0
0 packets, 0 bytes
via 172.16.134.1, Tunnel0, 0 dependencies
next hop 172.16.134.1, Tunnel0
valid adjacency
Phase 2: (Changes from Phase 1 are highlighted and are made to Tunnel Interface only)
R1#sh run int tun 0
Building configuration...
Current configuration : 351 bytes
!
interface Tunnel0

> ip address 172.16.134.1 255.255.255.0
> no ip redirects
> ip mtu 1400
> ip nhrp authentication cisco123
> ip nhrp map multicast dynamic
> ip nhrp network-id 123
> ip nhrp holdtime 360
> ip ospf network broadcast // The OSPF network has been changed to BROADCAST
> ip ospf priority 255
> tunnel source FastEthernet0/0
> tunnel mode gre multipoint
> tunnel protection ipsec profile DMVPN

end
R3#sh run int tun 0
Building configuration...
Current configuration : 413 bytes
!
interface Tunnel0

> ip address 172.16.134.3 255.255.255.0
> no ip redirects
> ip mtu 1400
> ip nhrp authentication cisco123
> ip nhrp map 172.16.134.1 10.1.12.1
> ip nhrp map multicast 10.1.12.1
> ip nhrp network-id 123
> ip nhrp holdtime 360
> ip nhrp nhs 172.16.134.1
> ip ospf network broadcast // The OSPF network has been changed to BROADCAST
> ip ospf priority 0
> tunnel source FastEthernet0/0
> tunnel mode gre multipoint // Please note, before doing this you have to deconfigure the 'tunnel destination' command
> tunnel protection ipsec profile DMVPN

end
R4#sh run int tun 0
Building configuration...
Current configuration : 413 bytes
!
interface Tunnel0

> ip address 172.16.134.4 255.255.255.0
> no ip redirects
> ip mtu 1400
> ip nhrp authentication cisco123
> ip nhrp map 172.16.134.1 10.1.12.1
> ip nhrp map multicast 10.1.12.1
> ip nhrp network-id 123
> ip nhrp holdtime 360
> ip nhrp nhs 172.16.134.1
> ip ospf network broadcast // The OSPF network has been changed to BROADCAST
> ip ospf priority 0
> tunnel source FastEthernet0/0
> tunnel mode gre multipoint // Please note, before doing this you have to de-configure the 'tunnel destination' command
> tunnel protection ipsec profile DMVPN

end
Some Verifications!
R3#sh ip route
************Irrelevant Output Removed**************
4.0.0.0/32 is subnetted, 1 subnets
O 4.4.4.4 [110/11112] via 172.16.134.4, 00:13:19, Tunnel0 // OSPF learnt route has been updated to directly contact the SPOKE
R4#sh ip route
************Irrelevant Output Removed**************
3.0.0.0/32 is subnetted, 1 subnets
O 3.3.3.3 [110/11112] via 172.16.134.3, 00:15:23, Tunnel0 // OSPF learnt route has been updated to directly contact the SPOKE
R4#sh ip cef 3.3.3.3
3.3.3.3/32, version 30, epoch 0
0 packets, 0 bytes
via 172.16.134.3, Tunnel0, 0 dependencies
next hop 172.16.134.3, Tunnel0
invalid adjacency // Because it doesnt have the information of physical interface to reach 3.3.3.3. After pinging once, it will be updated!
R3#sh ip cef 4.4.4.4
4.4.4.4/32, version 31, epoch 0
0 packets, 0 bytes
via 172.16.134.4, Tunnel0, 0 dependencies
next hop 172.16.134.4, Tunnel0
invalid adjacency // Because it doesnt have the information of physical interface to reach 4.4.4.4. After pinging once, it will be updated!
Phase 3: (Changes from Phase 1 are highlighted and are made to Tunnel Interface only)
R1#sh run int tun 0
Building configuration...
Current configuration : 351 bytes
!
interface Tunnel0

> ip address 172.16.134.1 255.255.255.0
> no ip redirects
> ip mtu 1400
> ip nhrp authentication cisco123
> ip nhrp map multicast dynamic
> ip nhrp network-id 123
> ip nhrp redirect // The extra command for Phase 3
> ip nhrp holdtime 360
> ip ospf network point-to-multipoint
> tunnel source FastEthernet0/0
> tunnel mode gre multipoint
> tunnel protection ipsec profile DMVPN

end
R3#sh run int tun 0
Building configuration...
Current configuration : 413 bytes
!
interface Tunnel0

> ip address 172.16.134.3 255.255.255.0
> no ip redirects
> ip mtu 1400
> ip nhrp authentication cisco123
> ip nhrp map 172.16.134.1 10.1.12.1
> ip nhrp map multicast 10.1.12.1
> ip nhrp network-id 123
> ip nhrp holdtime 360
> ip nhrp nhs 172.16.134.1
> ip nhrp shortcut // The extra command for Phase 3
> ip ospf network point-to-multipoint // The OSPF network has been changed to Point-to-Multipoint
> ip ospf priority 0
> tunnel source FastEthernet0/0
> tunnel mode gre multipoint // Please note, before doing this you have to deconfigure the 'tunnel destination' command
> tunnel protection ipsec profile DMVPN

end
R4#sh run int tun 0
Building configuration...
Current configuration : 413 bytes
!
interface Tunnel0

> ip address 172.16.134.4 255.255.255.0
> no ip redirects
> ip mtu 1400
> ip nhrp authentication cisco123
> ip nhrp map 172.16.134.1 10.1.12.1
> ip nhrp map multicast 10.1.12.1
> ip nhrp network-id 123
> ip nhrp holdtime 360
> ip nhrp nhs 172.16.134.1
> ip nhrp shortcut // The extra command for Phase 3
> ip ospf network point-to-multipoint // The OSPF network has been changed to Point-to-Multipoint
> ip ospf priority 0
> tunnel source FastEthernet0/0
> tunnel mode gre multipoint // Please note, before doing this you have to de-configure the 'tunnel destination' command
> tunnel protection ipsec profile DMVPN

end
Some Verifications!
R4#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.1.24.2 to network 0.0.0.0
4.0.0.0/24 is subnetted, 1 subnets
C 4.4.4.0 is directly connected, Loopback0
172.16.0.0/24 is subnetted, 1 subnets
C 172.16.134.0 is directly connected, Tunnel0
10.0.0.0/24 is subnetted, 1 subnets
C 10.1.24.0 is directly connected, FastEthernet0/0
S* 0.0.0.0/0 [1/0] via 10.1.24.2