Dynamic Multipoint VPN (DMVPN)

VPNs (or Virtual Private Networks) are largely understood as a concept by many who are using networked connections that may involve sending and receiving sensitive data. Dynamic Multiple VPN, such as Cisco DMVPN, works to encrypt transmitted data much like a regular VPN. However, they do it in a way that can secure communications between branch offices in particular. It does this using a centralized architecture to provide easier implementation and management for deployments across the entire IT scope of the organization.

What is DMVPN?

DMVPN Cisco is, effectively, a solution that allows different branch locations using the same resources to communicate directly and safely with one another via public WAN or internet connections, rather than having to use an internal network. The way that it does this doesn’t utilize a permanent VPN connection between the various sites, but rather through a centralized architecture that can apply VPN protection and granular access controls on an as-you-need-it basis. As such, when communications are open or access has to be granted to specific digital resources, it applies the security features of a VPN on a more selective basis. DVPN also integrates modes of communication, such as the VoIP system, into the protections of a VPN.

DMVPN Benefits 

There is a range of benefits of using DMVPN over a permanent VPN, or in the case of DMVPN vs MPLS networks. The following are some of the most commonly cited benefits:

• Offers superior internet speed and reliability performance, in general.
• Reduces the cost of secure communications and connections between branches by integrating VPN with communication practices.
• Allows for easier branch-to-branch communications and connections through a centralized system.
• Reduces the likelihood of downtime by securing routing with IPsec technology.

Understanding DMVPN 

DMVPN allows data exchanges on a secure network without the use of a headquarter’s VPN server or router. While a VPN acts as a connector between remote sites and HQ, or between different branches, the DMVPN creates a mesh VPN protocol that can be applied selectively to connections being utilized in the business already. Each different site (or spoke) can connect to one another securely. This is done using VPN firewall concentrators and routers, with DMVPN configuration on the routers in place at remote sites to allow the DMVPN mesh to be applied to the connection that it’s making at the time.

DMVPN Components 

• Multiple GRE tunnel interfaces: a single GRE interface that can secure several IPsec tunnels, reducing the overall scope of the DMVPN configuration
• IPsec tunnel endpoint discovery: meaning that static crypto maps between individual IPsec tunnel endpoints do not have to be configured
• Routing Protocols: which can allow the DMVPN to find routes between different endpoints much more effectively
• NHRP: which can deploy spokes with assigned IP addresses that can then be connected to from the central DMVPN hub.

DMVPN Phases

There are three distinct types, or phrases, of DMVPN design, all of which can be found on the Cisco DMVPN design guide. To summarize them briefly, however, they are as follows:

• DMVPN Phase 1 uses HUB-and-spoke tunnel deployment. The tunnels through which inter-branch connections are made are only built through the central DMVPN hub and the individual spokes, working much like a traditional VPN system.
• DMPVN Phase 2 uses spoke-to-spoke tunnel deployment, meaning that data doesn’t have to travel to a central hub first, so long as there are specific routes in place for the spoke subnets.
• DMPVN Phase 3 allows for spoke-to-spoke tunnel deployment, but without the specific pre-made routes in place, but rather uses NHRP traffic indication messages from the hub to secure those routes on the fly.

Hub and Spoke Network Architecture 

As mentioned, the Hub and Spoke Network Architecture is a way to efficiently manage the endpoints that are being secured. There are three different phases, each of them suitable for different configurations. However, in general, the hub is used to configure the protocols by which the connections are secured, and these protocols are then applied to the spokes (or endpoints) of the network. This system can be centralized to ensure that allow spoke-to-spoke tunnels first go through the hub, or can be decentralized to cut the hub out entirely.

Dynamic Multiple VPN (or DMVPN) is a complex topic, but it’s a security configuration that could allow businesses that use a wide range of remote endpoints (or flexible endpoints that move location often) to make sure they can keep the security of their network in place, which making sure it’s flexible and not prohibitive in costs.