GETVPN and DMVPN equipment for 250 routers as GM

Question

Hi,
I would like to know which router I should use as a key server for 250 GMs, and what router as DMVPN hub.
I found this deployment guide
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6525/ps9370/ps7180/GETVPN_DIG_version_1_0_External.pdf
on site 24 it says that 2851 with AIM-VPM module has been tested with 200 GM with 15 sec registration time with one key server.
The problem is that there is a new generation of ISRs. I would like to use a 2900 router but don't know if the 2951 is necessary. 2951 has onboard IPSec acceleration but an adittional ISM-VPN-29 module can be installed.
In the data sheet (http://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps12202/data_sheet_c78-682436.html)
I did not have found any info if this module is responsible for GETVPN rekeying. I don't want to buy it if it's not really necessary because it's not cheap.
So my question is which 2900 router should I use as a Key server for 250 GMs and what 2900 router as DMVPN hub?
I hope that somebody can help me with this.

Answer 1

DMVPN provides two key advantages for extending MPLS VPNs to the branches, bulk encryption and, more importantly, a scalable overlay model. Since the assumption here is that the branches in this deployment are connected to the hub through a Layer 3 SP service, a tunneled model using GRE is needed to extend MPLS to the branches. Coupled with the fact that there is large number of existing DMVPN deployments, this solution becomes an attractive deployment option.