DMVPN - Phase 2 and multicast traffic

When implementing DMVPN phase 2, and in particular when creating a topology that supports Multicast, it is important to understand how such a topology operates.

When deploying a DMVPN Phase 2 topology, it means that we are creating spoke-to-spoke tunnels, so traffic will go directly from spoke to spoke. However, to create a spoke-to-spoke tunnel, initially, traffic is sent to the hub. Using NHRP, the hub directs all subsequent traffic to be routed directly between spokes.

For multicast traffic, the behavior is not quite the same.

Multicast traffic will not be able to initiate the creation of point to point GRE tunnel between spokes. If this tunnel does not exist, multicast traffic will be routed via the hub. Only unicast traffic will trigger the creation of a spoke-to-spoke tunnel. This is simply due to the design and behavior of the NHRP protocol.

Specifically, the NHRP resolution process is triggered only by unicast traffic and not multicast traffic.

When multicast traffic is sent to the hub, it is forwarded to all registered spokes. Since the multicast traffic is not specifically addressed to a single spoke, it does not provide an opportunity for NHRP to learn about the other spokes’ public IP addresses or establish direct GRE tunnels.

This is a design choice for NHRP, which helps to optimize network traffic flow and reduce unnecessary overhead. If multicast traffic could trigger the establishment of spoke-to-spoke tunnels, it would result in numerous unnecessary tunnels being built, which could consume additional resources and complicate the network. Thus it is more efficient to rely only on unicast to trigger the NHRP resolution process.

Links:

https://forum.networklessons.com/t/dmvpn-over-ipsec/1316/63?u=lagapides

https://forum.networklessons.com/t/dmvpn-over-ipsec/1316/61?u=lagapides

https://networklessons.com/cisco/ccie-routing-switching/dmvpn-over-ipsec

https://networklessons.com/cisco/ccie-routing-switching/dmvpn-phase-2-basic-configuration