DMVPN Spoke with 2 internet link

Question

Hi All,
I am stuck in a situation where we have 2 hubs one in HQ and one in DR site. Both hubs are configured to have different dmvpn cloud. We have some branches with two internet links one adsl and another 3G.
I want to setup dmvpn in such a way so that if adsl goes down then dmvpn tuneel should come up via 3G.
What I know is i would require different tunnels on spoke for achieving this. Currently on each spoke I have two tunnels one terminates on HQ and another terminates on DR and both are live. I am managing routes via eigrp.
My question is that do I need to create another dmvpn cloud for this to work as I can not use same subnet IP on new tunnels which will be having 3G as source ? or shall I create new subnet for tunnels which will work over 3G ??
if i create new tunnel for 3G network then what will be the configuration on HQ & DR as we have only on internet link on DR & HO.
can anybody help me on this ?
just need idea how to achive it. my full dmvpn is working over internet no private mpls....

Answer 1

Hi Jain,
You can let HQ and DR in same DMVPN Cloud. In HQ, do Static NHRP MAP to DR and vise versa.
Spoke routers, create two static NHRP Map and NHS.
Tunnel0
description Spoke
ip nhrp map multicast HQ-WAN-IP
ip nhrp map HQ-Tunnel-IP HQ-WAN-IP
ip nhrp map multicast DR-WAN-IP
ip nhrp map DR-Tunnel-IP DR-WAN-IP
ip nhrp network-id 123
ip nhrp holdtime 60
ip nhrp nhs HQ-Tunnel-IP
ip nhrp nhs DR-Tunnel-IP
This will allow you use one DMVPN cloud for two Hub.
Secondly, for spoke failover to 3G, you would need to create another DMVPN Tunnel at HUB and SPOKE router
At HUB, use different Tunnel IP, but tunnel source will be same. In order this to work, i will suggest you to use DMVPN over IPSec. Use Diffrent tunnel key and ip nhrp network-id for both tunnel interface. Use "shared" command when apply ipsec policy in Tunnel interface.
Sample config at Hub( I only show the difference in Tunnel config)
tunne0
description ***Primary Tunnel***
ip address x.x.x.x
ip nhrp network-id 1
tunnel key 1
tunnel protection ipsec profile TN-DMVPN shared
tunne1
description ***Primary Tunnel***
ip address y.y.y.y
ip nhrp network-id 2
tunnel key 2
tunnel protection ipsec profile TN-DMVPN shared
At Spoke, you configure same as primary tunnel, but make sure to change network-id and tunnel key. Here, you may no need to use "shared" command when apply ipsec policy
Hope this helps.
Regards,
Nagis