One of the benefits of a DMVPN network is that the encrypted tunnels are built on top of DIA circuits more often than not. In that sense, the remote sites typically defer in terms of circuit bandwidth. Per-Tunnel QoS is an effective way to apply QoS policies on the hub router(s) on a per-tunnel instance to all remote sites via NHRP registration. I’ll show you how.
We will be working with the following setup:
Here, we have a DMVPN network with a single hub and 2 spokes. Spoke 1 has a bandwidth of 100Mbps while Spoke 2 has a bandwidth of 50Mbps. We will be prioritizing voice and SSH traffic for the sake of this lab.
The way it works is that we will need to create different QoS policies and tie them to distinct NHRP group. Under those NHRP groups, we will reference the bandwidth of our remote sites and that’s how we’ll know what NHRP group to point which remote site to.
The DMVPN configuration is already in place and we have DMVPN sessions between the hub and the spokes.
HUB1-RTR#sh ip nhrp brief
Target Via NBMA Mode Intfc Claimed
172.16.100.2/32 172.16.100.2 3.3.3.254 dynamic Tu100 10.100.30.1
172.16.100.3/32 172.16.100.3 4.4.4.100 dynamic Tu100 10.100.40.1
HUB1-RTR#
HUB1-RTR#sh dmvpn detail
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
N - NATed, L - Local, X - No Socket
# Ent --> Number of NHRP entries with same NBMA peer
NHS Status: E --> Expecting Replies, R --> Responding, W --> Waiting
UpDn Time --> Up or Down Time for a Tunnel
==========================================================================
Interface Tunnel100 is up/up, Addr. is 172.16.100.1, VRF ""
Tunnel Src./Dest. addr: 10.100.10.1/MGRE, Tunnel VRF "DMVPN"
Protocol/Transport: "multi-GRE/IP", Protect "DMVPN_PROFILE"
Interface State Control: Disabled
nhrp event-publisher : Disabled
IPv4 NHS:
172.16.100.1 E priority = 0 cluster = 0
Type:Hub, Total NBMA Peers (v4/v6): 2
# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb Target Network
----- --------------- --------------- ----- -------- ----- -----------------
1 3.3.3.254 172.16.100.2 UP 01:22:32 DN 172.16.100.2/32
Claimed Addr. 10.100.30.1
1 4.4.4.100 172.16.100.3 UP 01:22:32 DN 172.16.100.3/32
Claimed Addr. 10.100.40.1
Crypto Session Details:
--------------------------------------------------------------------------------
Interface: Tunnel300 Tunnel100
Session: [0xC39AEC18]
Session ID: 0
IKEv1 SA: local 10.100.10.1/4500 remote 3.3.3.254/4500 Active
Capabilities:DN connid:1002 lifetime:22:37:17
Crypto Session Status: UP-ACTIVE
fvrf: DMVPN, Phase1_id: 10.100.30.1
IPSEC FLOW: permit 47 host 10.100.10.1 host 3.3.3.254
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 1100 drop 0 life (KB/Sec) 4268315/2068
Outbound: #pkts enc'ed 1100 drop 0 life (KB/Sec) 4268315/2068
Outbound SPI : 0xE54F159B, transform : esp-aes
Socket State: Open
Interface: Tunnel300 Tunnel100
Session: [0xC39AED10]
Session ID: 0
IKEv1 SA: local 10.100.10.1/4500 remote 4.4.4.100/4500 Active
Capabilities:DN connid:1001 lifetime:22:37:27
Crypto Session Status: UP-ACTIVE
fvrf: DMVPN, Phase1_id: 10.100.40.1
IPSEC FLOW: permit 47 host 10.100.10.1 host 4.4.4.100
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 1102 drop 0 life (KB/Sec) 4221570/2095
Outbound: #pkts enc'ed 1102 drop 0 life (KB/Sec) 4221570/2095
Outbound SPI : 0xDBABF0BD, transform : esp-aes
Socket State: Open
Pending DMVPN Sessions:
Interface: Tunnel300 Tunnel100
Crypto Session Status: DOWN
fvrf: DMVPN, IPSEC FLOW: permit 47 host 10.100.10.1 host 2.2.2.100
Active SAs: 0, origin: crypto map
Inbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
Outbound: #pkts enc'ed 0 drop 1068 life (KB/Sec) 0/0
Outbound SPI : 0x 0, transform :
Socket State: Closed
HUB1-RTR#
Hello I'm Pape. My friends call me Pop. I'm CCIE #48357. I enjoy my field and love to share it with others. I love to write so I'm sharing my blog with you.
Leave a Reply