CCNP Security SVPN 300-730: DMVPN, IPsec & FlexVPN (2/3)

Secure gre tunnels with ipsec to protect multicast and ipv6 traffic atop gre, using phase 1 configuration, transform sets, and ipsec profiles on the tunnel interface.

Explore how GRE tunnels integrate with IPsec, and how converting to transport mode reduces header overhead by avoiding additional IP headers while preserving encryption for traffic.

Learn to configure static virtual tunnel interfaces (VTI) for native IPsec tunnels, removing the extra header with transport mode or using IPsec tunnel mode for a header-free, simple tunnel.

Explore the limitations of static VTI, including manual, point-to-point tunnels, lack of scalability for many endpoints, and traffic restrictions to IP-based protocols on Cisco IOS devices.

Compare policy-based vpn and routed vpn; policy-based relies on acl-driven traffic selection and crypto maps, while routed vpn uses tunnel interfaces with automatic encryption.

DMVPN introduces scalable multipoint VPN connections by linking many sites through a single hub, with dynamic mGRE tunnels and NHRP discovery enabling a flexible hub-and-spoke to full-mesh network.

Dmvpn uses multipoint gre and nhrp to build dynamic hub-and-spoke tunnels with multipoint connections and dynamic neighbor discovery, routing for lan-to-lan communication, and optional ipsec for secure, scalable sites.

Explore DMVPN mGRE tunnels, contrasting point-to-point tunnels with multipoint configurations, and learn how tunnel source, endpoint, and static or dynamic public IPs shape dynamic site discovery via IP protocols.

Explore how DMVPN uses the NHRP protocols to map private and public IPs between hub and spokes, registering, resolving, and establishing tunnel paths through registration, resolution requests, and replies.

Configure a basic vpn lab with four routers, simulate internet via a firewall, set up lan subnets and public ip interfaces, and implement a default route for connectivity.

Configure dmvpn multipoint tunnel by creating a tunnel interface, defining tunnel source, and enabling hub and spoke sites with dynamic ip addresses, then verify tunnels as traffic initiates.

Configure EIGRP over DMVPN tunnels to enable LAN communication. Enable multicast on the tunnel interface with mapping options, and verify neighbor adjacencies and routing table reachability.

examine the evolution of dmvpn phases 1 to 3, from hub-and-spoke with multipoint tunnels to phase 2 spoke-to-spoke connectivity and phase 3 hybrid traffic patterns.

Explore DMVPN phase 1 tunnel configuration, with a multipoint hub and point-to-point spokes, using static hub IPs and dynamic spoke IPs, plus next-observer and public IP commands for verification.

Explore how to configure a dmvpn phase 1 with eigrp routing, establish hub-and-spoke tunnels, set land networks, enable multicast dynamic mapping, and disable split-horizon to permit spoke-to-spoke traffic.

the lecture explains dmvpn phase 1 with ospf routing, focusing on hub-and-spoke and multipoint tunnels, multicast hello exchange, and aligning tunnel types for stable neighbor formation.

Dmvpn phase 2 reveals multipoint dynamic tunnels for spoke-to-spoke communication. Learn to configure tunnel ip addresses, tunnel source, and next-hop requirements to establish and verify these tunnels.

Configure DMVPN phase 2 with OSPF to build a full mesh of dynamic multipoint tunnels, switch to a broadcast network, and set spokes to zero priority to prevent the hub.

Explore dmvpn phase 2 with multipoint tunnels in a hub-and-spoke topology, enabling spoke-to-spoke tunnels and direct routing by disabling split-horizon with no ip next-hop-self.

DMVPN phase 3 combines phase 1 and phase 2 benefits, enabling spoke-to-spoke tunnels with hub-based traffic and routing table summarization, while introducing redirect and shortcut messages for direct path selection.

Explore DMVPN phase 3 tunnel configuration, showing that the basic setup mirrors phase 2, with multiple tunnels and remote interfaces, and verifying router configurations across spokes.

Learn DMVPN phase 3 with EIGRP routing, adding a redirect/alternate-route command to force direct spoke-to-spoke communication and optimize the hub-and-spoke routing table.

Explore DMVPN phase three for OSPF routing by setting the tunnel type to point-to-multipoint and updating the network type across hub and spokes, then verify routing tables.

Examine the limitations of IPsec VPN for site-to-site deployments, including multipoint scalability on a single interface used for internet and LAN traffic, and restrictions on routing protocols and multicast.

Explore IPsec over DMVPN to create scalable multipoint tunnels across hundreds of sites, and secure complete tunnel traffic with IPsec encryption, addressing phase 3 benefits over earlier phases.

Configure ipsec over dmvpn by setting phase one policy and association parameters, creating a transform set and an IP set profile, applying it to multipoint tunnels, and verifying encapsulation.