We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is Why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 617 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)


374 New Members signed up the last 30 days!


100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags: , , ,

Forum Replies

  1. Rene,

    When would we choose to use Phase 1, 2, or 3, and why? I understand the differences between the three, but do we gain any benefit from implementing one or the other that is noticeable to end users?

    It seems to me that perhaps allowing spoke routers to talk to each other may decrease latency in the real world, as they would not have to hop through the hub router, but other than that I’m not sure.



  2. Hi Patrick,

    The different versions are like an evolution of DMVPN. We don’t really use phase 1 anymore unless you have a really good reason why you want to force all traffic through the hub (security perhaps?). Otherwise, it’s more effective to allow spoke-to-spoke traffic.

    Both phase 2 and 3 allow spoke-to-spoke traffic, the advantage of phase 3 is that we use the “shortcuts” so you don’t need specific entries anymore in the routing tables of the spoke routers. I can’t think of any advantages right now that phase 2 has over phase 3 so if you implement this, you probably want to use phase 3.


  3. Rafa,
    Not in the case where sites might have multiple circuits. For example, in my company, where we have locations all over the country, MPLS is our primary means of connecting sites, but if there is a problem with this circuit, or the provider, then a secondary standard Internet connection (many of our smaller sites simply use DSL or even 4G cellular), could take over with DMVPN configured over it.

  4. Hello Heng

    This is a very good question. Looking at the process in more detail, when using Phase 3.

    Initially, (and that is the key word) all spoke to spoke packets are switched across the hub. In order for a spoke to learn about the true NBMA IP address of another spoke, the NHRP redirect message is used.

    So when a hub receives an IP packet inbound on its interface and switches it out of the same interface, it sends a special NHRP redirect message to the source indicating that this is a suboptimal path. It should look for a better way using NHRP resolution. The original packet however is still routed to its destination.

    When the originating router receives the redirect message, it contains the destination IP address of the original IP packet as its payload. The router then sends the NHRP request for the redirected destination IP targeted originally, that is, the destination spoke. The resolution request travels via the regular IP routing path, through the hub until it reaches the target spoke.

    The destination spoke responds to the resolution request using the IP of the source router sending it directly AND NOT THROUGH THE HUB, thus completing the spoke to spoke communication.

    Now for your specific question, because the initial communication occurs via the hub, the hub still routes the packet successfully to the destination spoke. So the initial traffic sent does arrive at the destination spoke (via the hub) so it does not have to be resent. All subsequent communications that occur without the use of the hub will continue the flow of data.

    I hope this has been helpful!


  5. Hello Heng.

    Yes you are correct!


20 more replies! Ask a question or join the discussion by visiting our Community Forum