Dynamic multipoint VPN (DMVPN)

Cisco has this proprietary protocol called Dynamic Multipoint VPN, or dynamic multipoint virtual private network — DMVPN. It's a really cool protocol that allows us to interconnect many of our different sites together in a very dynamic way.

The Scaling Problem with Standard VPNs

Let's look at a scaling problem with just a standard VPN. We have a headquarters here, and let's say we want to interconnect that with all of our satellite campuses. In total we have seven different satellite campuses here, so we want to extend a VPN to each one of those sites. Not too big of a deal — here we go from headquarters to site one, and then again to site two. We create a VPN between each one of these sites, so we're going to create seven different VPNs here to create this connectivity.

Now this causes a couple of problems. Number one, let's say we want satellite 7 to communicate with satellite 2. Right now it has to go through the headquarters to satellite 2, so this causes delay problems because it's got to go all through the headquarter office. As well as, if the headquarter office goes down, it creates connectivity issues between all of the different sites. It's not self-healing.

So this is problematic with just a standard VPN. And then what we do is we want to create a mesh network, so we start connecting site one to all of the sites as well, and then site two to all of the sites, and then site three to all of the sites. What happens is we end up with a lot of VPN connections — in fact 28 in total, 28 different VPNs. So it's a lot to manage.

Hub and Spoke with DMVPN

This is where a dynamic multipoint VPN, or DMVPN, can come in handy. Here we have the headquarter office. What we're going to do is turn that into a hub, and then each one of these will be a spoke to the hub. So we'll turn each one of these satellite campuses into a spoke, and we'll program the equipment on there to be part of this DMVPN. What will happen is each one of these sites will make a connection into the headquarter office and create a VPN connection here.

Now the beauty in all of this is not only that, but if site 6 wants to talk to site two, then it can start figuring out these settings from the hub on how to get to site number two, and then we'll communicate to site two directly. Therefore it doesn't have to send all of the traffic through headquarters — now it can go out and speak directly to the site two.

So it really creates this more dynamic setup of communication between all of these. It creates a full mesh between all of these. So instead of having 28 VPNs, now you could just have one DMVPN.