In this video, I'd like to introduce you
to the idea of IPsec VPNs implemented using a technology
called DM, Dynamic Multipoint VPNs.
So let's imagine that we have a few more locations.
So we have R2 at site 2, we have, let's say, R3 at site 3
and let's put R4 at site 4.
If we want a secure connectivity and so as we
all have connectivity here to the internet
or some other untrusted network, if we want full connectivity
we could do site to site VPN tunnels WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we could do site to site VPN tunnels
between the headquarter site R1 and R3,
another site to site between R1 and R2,
another one between R1 and R4.
Now, whether we use crypto maps for that
or we use VTIs for that, either way it would work.
But it's kind of a hassle.
It's a lot of VPNs setup and what
if a site 3 device like Bob over here
needs to communicate down to site 4.
That traffic, if it has to go through the tunnel
to the headquarters then back over the tunnel back to R4,
that's a dual trip.
So if we wanted to have direct spoke to spoke connectivity, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we wanted to have direct spoke to spoke connectivity,
that'd be awesome.
And while the technologies that allows us to do that
is referred to as DM, Dynamic Multipoint VPNs and this
uses IPsec.
And the cool part is that it dynamically
builds the tunnels for us.
So we configure R1 as the head in device
and then we have all these spokes site 3, 2 and 4,
we have them registering check in.
And so these devices all check in and say,
here I am, and R1 says, I'm so glad to see you.
Thanks are shown up.
And it dynamically builds those tunnels. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it dynamically builds those tunnels.
We don't have to manually configure the specific for each
of the spokes.
Now, to pull this off on the interfaces,
we're still going to use tunnel interfaces,
but we are going to use what's referred to as a MGRE,
a multipoint GRE tunnel interface.
And on those multipoint GRE interfaces,
we're going to implement an IPsec profile.
And that way we can use one tunnel interface
for here R1 that logically allows the VPN to all
the remote sites.
And if R3 needs to reach network over here, let's
say this is 10.4.0.0, when R3 goes to reach that network it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
say this is 10.4.0.0, when R3 goes to reach that network it
can go ahead and get a message from the hub saying,
Oh, you know what, dear Mr R3, that network of 10.4
is reachable by R4.
And R1 can educate R3 on dynamically
educate them on what the reachable addresses.
And then R3 can dynamically build a spoke to spoke VPN
tunnel using IPsec over to R4.
And that's the magic of dynamic multipoint
VPN using a technology called NHRP, Next Hop Resolution
Protocol.
And I've got a separate video set just on DMVPN WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I've got a separate video set just on DMVPN
if you want more details on how that's configured,
how to set it up, and how to verify it.
Check out that sort of videos as well on DMVPN.
So in this video, I want to make sure you are aware
that that option exists regarding DMVPN
and that can be implemented with either IKE version
1 or IKE version 2.
If we're doing it with IKE version 2,
it's going to use that technique that Cisco refers to
as FlexVPN.
And while we're at it, in the next video
let me introduce you to the world of FlexVPN
as well to make sure you understand the basics of what WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as well to make sure you understand the basics of what
it means and what to expect.
I'll see you in the next video for that.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing.