Section 2.0: VPN Technologies

MPLS forwarding (LSR/LER, LDP, label stack), MPLS Layer 3 VPN (VRF, RD, RT, MP-BGP VPNv4), Dynamic Multipoint VPN (DMVPN Phase 1/2/3), NHRP, mGRE, IPsec (IKEv1 vs IKEv2, ESP transport vs tunnel), and FlexVPN with IKEv2 smart defaults.

2.1  MPLS — LSR, LER, label switching, LDP

Multi-Protocol Label Switching (MPLS) forwards packets based on a small fixed-length label rather than a longest-prefix lookup of the IP destination. The label is pushed at the entry of the MPLS cloud, swapped hop-by-hop, and popped at the exit. This makes the network destination-agnostic and enables L3VPN, traffic engineering, and L2VPNs over a single fabric.

MPLS device roles

Role Aka Function
P (Provider) LSR — Label Switch Router Pure label-switching core; never touches the IP header. Performs label SWAP.
PE (Provider Edge) LER — Label Edge Router Boundary between IP and MPLS. PUSHes labels on ingress, POPs on egress.
CE (Customer Edge) — Customer router; runs plain IP and a routing protocol with the PE.

The MPLS label and label stack

Each MPLS shim header is 32 bits, inserted between the L2 frame and the L3 packet (called the “shim header”).

MPLS shim header (4 bytes / 32 bits)

Label (20 bits) forwarding identifier (0–1,048,575)

EXP (3) QoS / TC

S (1) bottom-of-stack

TTL (8) hop limit

Multiple shim headers can be stacked. The bottom-most has S=1.

Forwarding actions: PUSH / SWAP / POP

CE-A plain IP

PE1 (LER) PUSH 100

P (LSR) SWAP 100→200

PE2 (LER) POP

CE-B plain IP

Label Switched Path (LSP) Ingress LER pushes the label, P routers swap, egress LER pops — receiver gets plain IP.

IP packet [100][IP] [200][IP] [IP] IP packet

Label distribution — LDP and MP-BGP

  • LDP (Label Distribution Protocol) — runs between adjacent LSRs over UDP/646 (discovery) and TCP/646 (session); each router announces a local label for every IGP-learned prefix.
  • MP-BGP — carries VPN labels for Layer 3 VPN (VPNv4 / VPNv6 address families).
  • RSVP-TE — signals labels along an explicit traffic-engineered path.
PHP — Penultimate Hop Popping: the LSR before the egress PE pops the outer label, so the egress PE only does an IP lookup. This avoids a double lookup. Cisco signals PHP using the special label value 3 (implicit-null).

2.2  MPLS Layer 3 VPN — VRF, RD, RT, MP-BGP

L3VPN lets one provider backbone serve many enterprise customers with overlapping address space, total isolation, and full any-to-any connectivity. Five concepts to master:

The five building blocks

Term What it is Where it lives
VRF (Virtual Routing & Forwarding) Per-customer routing/forwarding table on the PE; isolates one customer from another. PE only
RD (Route Distinguisher) 8-byte value prepended to a 4-byte IPv4 prefix → 12-byte VPNv4 prefix. Makes prefixes globally unique inside MP-BGP. Per VRF on PE
RT (Route Target) BGP extended community attached to VPNv4 routes. Export tags routes; Import selects which VPNv4 routes to install into a VRF. Drives VPN topology. Per VRF on PE
MP-BGP VPNv4 BGP address family that carries VPNv4 prefixes + RT communities + VPN label between PEs. PE-PE iBGP
Two-label stack Outer = transport label (LDP, IGP next-hop); Inner = VPN label (set by egress PE). Outer popped by P/PHP, inner used by egress PE to pick VRF. Data plane

RD vs RT — the easy-to-mix-up pair

RD only makes prefixes unique in MP-BGP. RT controls VPN topology (which sites talk to which). Two different VRFs can share the same RD, but their RTs drive how routes are imported/exported.

Common RT-based VPN topologies

  • Full mesh — every site exports and imports the same RT (e.g. 100:1).
  • Hub-and-spoke — spokes export 100:101 & import 100:100; hub exports 100:100 & imports 100:101. Spokes never see each other.
  • Extranet — selectively import RTs from a partner’s VRF.

VPNv4 packet flow — two-label stack

CE-A VRF Cust1

PE1 push VPN+TR

P swap TR

PE2 pop, use VPN

CE-B VRF Cust1

Two-Label Stack: outer = Transport (TR), inner = VPN

[IP] [TR][VPN][IP] [TR’][VPN][IP] [VPN][IP] [IP]

Inner VPN label is signaled via MP-BGP and tells PE2 which VRF to drop the packet into.

! VRF + RD + RT + interface assignment + PE-CE protocol
PE1(config)# vrf definition Cust1
PE1(config-vrf)# rd 65000:1
PE1(config-vrf)# address-family ipv4
PE1(config-vrf-af)# route-target export 65000:1
PE1(config-vrf-af)# route-target import 65000:1
PE1(config-vrf-af)# exit-address-family

PE1(config)# interface Gi0/1
PE1(config-if)# vrf forwarding Cust1
PE1(config-if)# ip address 10.1.1.1 255.255.255.0

! MP-BGP between PEs (loopback-to-loopback iBGP)
PE1(config)# router bgp 65000
PE1(config-router)# neighbor 2.2.2.2 remote-as 65000
PE1(config-router)# neighbor 2.2.2.2 update-source Loopback0
PE1(config-router)# address-family vpnv4
PE1(config-router-af)# neighbor 2.2.2.2 activate
PE1(config-router-af)# neighbor 2.2.2.2 send-community extended

PE1(config)# router bgp 65000
PE1(config-router)# address-family ipv4 vrf Cust1
PE1(config-router-af)# redistribute connected
PE1(config-router-af)# neighbor 10.1.1.2 remote-as 65001 ! eBGP to CE
PE1(config-router-af)# neighbor 10.1.1.2 activate

PE1# show vrf
PE1# show ip route vrf Cust1
PE1# show bgp vpnv4 unicast all

2.3  DMVPN architecture (Phase 1, 2, 3)

Dynamic Multipoint VPN (DMVPN) is Cisco’s scalable enterprise overlay over the Internet. It combines four technologies: mGRE, NHRP, a dynamic routing protocol (EIGRP, OSPF, BGP), and IPsec. The hub knows everyone; spokes register with the hub and (in Phase 2/3) build direct spoke-to-spoke tunnels on demand.

The three DMVPN phases — what changed and why

Aspect Phase 1 Phase 2 Phase 3
Hub tunnel mGRE mGRE mGRE
Spoke tunnel p2p GRE (static, points at hub) mGRE mGRE
Spoke-to-spoke ✗ via hub only ✓ direct, on-demand ✓ direct, on-demand
Routing summarization at hub OK (default route to spokes) Breaks shortcuts — spokes need full next-hop preserved OK — NHRP redirect/shortcut decouple routing from forwarding
Next-hop on spoke routes Hub (rewritten) Original spoke (preserved — no ip next-hop-self) Hub initially; rewritten by NHRP shortcut
Hub CPU/state Lowest Highest (full routing detail to all spokes) Low (summary OK)
Recommended today Hub-and-spoke designs Legacy Default for new deployments
Phase 1 Phase 2 / Phase 3

HUB S1 S2 S3

HUB S1 S2 S3

Spokes only reach each other through hub. Direct spoke-to-spoke tunnels (purple) built on demand.

— solid green = hub-spoke tunnel over the Internet – – dashed purple = on-demand spoke-to-spoke (Phase 2/3)

Phase 1 hub config

HUB(config)# interface Tunnel0
HUB(config-if)# ip address 10.10.10.1 255.255.255.0
HUB(config-if)# tunnel source GigabitEthernet0/0
HUB(config-if)# tunnel mode gre multipoint
HUB(config-if)# tunnel key 12345
HUB(config-if)# ip nhrp network-id 1
HUB(config-if)# ip nhrp authentication CISCO123
HUB(config-if)# ip nhrp map multicast dynamic

Phase 1 spoke config (point-to-point GRE)

SPOKE1(config)# interface Tunnel0
SPOKE1(config-if)# ip address 10.10.10.11 255.255.255.0
SPOKE1(config-if)# tunnel source GigabitEthernet0/0
SPOKE1(config-if)# tunnel destination 198.51.100.1 ! hub public IP
SPOKE1(config-if)# tunnel key 12345
SPOKE1(config-if)# ip nhrp network-id 1
SPOKE1(config-if)# ip nhrp authentication CISCO123
SPOKE1(config-if)# ip nhrp nhs 10.10.10.1 ! tunnel IP of hub
SPOKE1(config-if)# ip nhrp map 10.10.10.1 198.51.100.1

Phase 3 enhancements

! On HUB and ALL spokes (Tunnel0)
R(config-if)# tunnel mode gre multipoint ! mGRE everywhere
R(config-if)# ip nhrp shortcut ! spoke installs NHRP-rewritten next-hop
R(config-if)# ip nhrp redirect ! hub tells spoke to switch to direct
Phase-2 vs Phase-3 routing trade-off: Phase 2 needs the original spoke as next-hop, so the hub must NOT use ip next-hop-self — and you cannot summarize at the hub (summarization rewrites next-hop). Phase 3 fixes this: the hub can summarize and use next-hop-self because NHRP redirects the spoke to a shortcut after the first packet.

2.4  NHRP — the NBMA address resolver

NHRP (Next Hop Resolution Protocol, RFC 2332) is the “ARP for tunnels.” In an NBMA overlay (mGRE), NHRP maps each spoke’s tunnel-IP (overlay) to its public NBMA address (underlay). Hub = NHS (Next Hop Server); spokes = NHCs (clients).

NHRP message types

Message Sent by Purpose
Registration Request / Reply Spoke → Hub Spoke registers its tunnel-IP-to-NBMA mapping with the NHS
Resolution Request / Reply Spoke → Hub → remote spoke Find the NBMA address of a destination tunnel-IP for spoke-to-spoke
Redirect Hub → Spoke (Phase 3) “Don’t send through me — ask the destination directly”
Purge Either Invalidate stale cache entries

Verification commands

HUB# show ip nhrp
HUB# show ip nhrp brief
HUB# show dmvpn
HUB# show dmvpn detail
HUB# show ip nhrp traffic
Common gotcha: if NHRP authentication strings, network-IDs, or tunnel keys mismatch between hub and spokes, registration silently fails. Always check show ip nhrp on both ends and debug nhrp packet when troubleshooting.

2.5  IPsec — IKE, ESP, transport vs tunnel mode

IPsec gives any tunnel three guarantees: confidentiality (encryption), integrity (HMAC), and authenticity (peer ID). Two protocols, two modes, two IKE versions.

Protocols and modes

AH (51) ESP (50)
Confidentiality ✗ ✓
Integrity / Authenticity ✓ ✓
Works through NAT ✗ (signs the IP header) ✓ (with NAT-T UDP/4500)
Used today Almost never Yes — default
Mode What it protects When used
Transport Original IP payload only; original IP header preserved Host-to-host; GRE-over-IPsec (because GRE already added an outer header)
Tunnel The entire original IP packet, with a new IP header Site-to-site classic IPsec; remote-access

IKE phases (IKEv1)

  1. Phase 1 — bidirectional ISAKMP SA. Two flavors: Main Mode (6 messages, identity-protected) or Aggressive Mode (3 messages, faster, identity in clear). Negotiates encryption algorithm, hash, DH group, lifetime, and authentication (PSK or RSA-sig).
  2. Phase 2 — Quick Mode. Builds the actual IPsec SA pair (one inbound, one outbound) under Phase 1 protection.

IKEv1 vs IKEv2 (RFC 7296)

Feature IKEv1 IKEv2
Phase 1 messages 6 (Main) or 3 (Aggressive) 4 (IKE_SA_INIT + IKE_AUTH)
EAP support ✗ ✓ (great for RA-VPN)
Built-in NAT-T & DPD Bolted-on extensions Native
Asymmetric authentication ✗ ✓
Reliability / retransmits Best-effort Built-in sequence numbers and ACKs
IKEv2 is the modern standard — faster, more robust, smaller config, and required for FlexVPN. ENARSI assumes IKEv2 for new designs.

2.6  FlexVPN — IKEv2 + Smart Defaults + Dynamic VTI

FlexVPN is Cisco’s unified VPN framework on IKEv2. It replaces the alphabet soup (EzVPN, GETVPN, DMVPN config style, crypto-maps) with a single set of building blocks: IKEv2 proposal → IKEv2 policy → IKEv2 keyring → IKEv2 profile → IPsec profile → tunnel interface (sVTI on spoke, dVTI on hub).

IKEv2 Smart Defaults

Cisco IOS ships with built-in default objects so you only have to configure the bits that differ from the defaults:

  • default IKEv2 proposal — AES-CBC-256, AES-CBC-192, SHA-512/384/256, DH 5/2/14 etc.
  • default IKEv2 policy — matches any address, uses the default proposal.
  • default IPsec profile — references the default IPsec transform set.
  • default IPsec transform set — AES-128 + SHA-1 in transport mode.

That leaves only keyring (for PSK) and IKEv2 profile as the real per-deployment work.

Hub with Dynamic VTI (dVTI)

HUB(config)# crypto ikev2 keyring KR
HUB(config-ikev2-keyring)# peer ANY
HUB(config-ikev2-keyring-peer)# address 0.0.0.0 0.0.0.0
HUB(config-ikev2-keyring-peer)# pre-shared-key Cisco123!

HUB(config)# crypto ikev2 profile IKE2_PROF
HUB(config-ikev2-profile)# match identity remote address 0.0.0.0
HUB(config-ikev2-profile)# authentication remote pre-share
HUB(config-ikev2-profile)# authentication local pre-share
HUB(config-ikev2-profile)# keyring local KR
HUB(config-ikev2-profile)# virtual-template 1

HUB(config)# crypto ipsec profile IPSEC_PROF
HUB(config-ipsec-profile)# set ikev2-profile IKE2_PROF

HUB(config)# interface Loopback0
HUB(config-if)# ip address 10.0.0.1 255.255.255.255

HUB(config)# interface Virtual-Template1 type tunnel
HUB(config-if)# ip unnumbered Loopback0
HUB(config-if)# tunnel source GigabitEthernet0/0
HUB(config-if)# tunnel mode ipsec ipv4
HUB(config-if)# tunnel protection ipsec profile IPSEC_PROF

Spoke with Static VTI (sVTI)

SPOKE1(config)# crypto ikev2 keyring KR
SPOKE1(config-ikev2-keyring)# peer HUB
SPOKE1(config-ikev2-keyring-peer)# address 198.51.100.1
SPOKE1(config-ikev2-keyring-peer)# pre-shared-key Cisco123!

SPOKE1(config)# crypto ikev2 profile IKE2_PROF
SPOKE1(config-ikev2-profile)# match identity remote address 198.51.100.1 255.255.255.255
SPOKE1(config-ikev2-profile)# authentication remote pre-share
SPOKE1(config-ikev2-profile)# authentication local pre-share
SPOKE1(config-ikev2-profile)# keyring local KR

SPOKE1(config)# crypto ipsec profile IPSEC_PROF
SPOKE1(config-ipsec-profile)# set ikev2-profile IKE2_PROF

SPOKE1(config)# interface Tunnel0
SPOKE1(config-if)# ip address 10.10.10.11 255.255.255.0
SPOKE1(config-if)# tunnel source GigabitEthernet0/0
SPOKE1(config-if)# tunnel destination 198.51.100.1
SPOKE1(config-if)# tunnel mode ipsec ipv4
SPOKE1(config-if)# tunnel protection ipsec profile IPSEC_PROF

FlexVPN vs DMVPN: FlexVPN is sometimes called “DMVPN Phase 4.” The hub uses one Virtual-Template; every spoke session spawns a Virtual-Access interface cloned from it. No mGRE, no NHRP, no crypto-map clutter — just IKEv2 + dVTI.

Hands-on labs (7)

Lab 1 — MPLS LDP between two PEs and a P router
! Enable CEF (required), OSPF in core, then MPLS + LDP on every core link
P1(config)# ip cef
P1(config)# mpls label protocol ldp
P1(config)# mpls ldp router-id Loopback0 force

P1(config)# interface Loopback0
P1(config-if)# ip address 10.0.0.99 255.255.255.255

P1(config)# interface GigabitEthernet0/0
P1(config-if)# ip address 10.0.12.99 255.255.255.0
P1(config-if)# ip ospf 1 area 0
P1(config-if)# mpls ip ! enables LDP on the link

P1# show mpls ldp neighbor
P1# show mpls forwarding-table
P1# show mpls ldp bindings

Lab 2 — MPLS L3VPN: VRF Cust1 across two PEs (eBGP PE-CE)
! —– PE1 —–
PE1(config)# vrf definition Cust1
PE1(config-vrf)# rd 65000:1
PE1(config-vrf)# route-target export 65000:1
PE1(config-vrf)# route-target import 65000:1
PE1(config-vrf)# address-family ipv4

PE1(config)# interface Gi0/1
PE1(config-if)# vrf forwarding Cust1
PE1(config-if)# ip address 10.1.1.1 255.255.255.0

PE1(config)# router bgp 65000
PE1(config-router)# neighbor 2.2.2.2 remote-as 65000
PE1(config-router)# neighbor 2.2.2.2 update-source Loopback0
PE1(config-router)# address-family vpnv4
PE1(config-router-af)# neighbor 2.2.2.2 activate
PE1(config-router-af)# neighbor 2.2.2.2 send-community extended
PE1(config-router)# address-family ipv4 vrf Cust1
PE1(config-router-af)# neighbor 10.1.1.2 remote-as 65001
PE1(config-router-af)# neighbor 10.1.1.2 activate

! Verify after PE2 mirror config
PE1# show vrf
PE1# show ip route vrf Cust1
PE1# show bgp vpnv4 unicast all
PE1# show bgp vpnv4 unicast all labels

Lab 3 — DMVPN Phase 1 hub-and-spoke with EIGRP
! —– HUB (10.10.10.1, public 198.51.100.1) —–
HUB(config)# interface Tunnel0
HUB(config-if)# ip address 10.10.10.1 255.255.255.0
HUB(config-if)# tunnel source Gi0/0
HUB(config-if)# tunnel mode gre multipoint
HUB(config-if)# tunnel key 100
HUB(config-if)# ip nhrp network-id 100
HUB(config-if)# ip nhrp authentication ENARSI
HUB(config-if)# ip nhrp map multicast dynamic
HUB(config-if)# no ip split-horizon eigrp 1 ! allow hub to advertise spoke routes back

HUB(config)# router eigrp 1
HUB(config-router)# network 10.10.10.0 0.0.0.255
HUB(config-router)# network 192.168.100.0

! —– SPOKE1 (10.10.10.11) —–
SPOKE1(config)# interface Tunnel0
SPOKE1(config-if)# ip address 10.10.10.11 255.255.255.0
SPOKE1(config-if)# tunnel source Gi0/0
SPOKE1(config-if)# tunnel destination 198.51.100.1
SPOKE1(config-if)# tunnel key 100
SPOKE1(config-if)# ip nhrp network-id 100
SPOKE1(config-if)# ip nhrp authentication ENARSI
SPOKE1(config-if)# ip nhrp nhs 10.10.10.1
SPOKE1(config-if)# ip nhrp map 10.10.10.1 198.51.100.1
SPOKE1(config-if)# ip nhrp map multicast 198.51.100.1

SPOKE1(config)# router eigrp 1
SPOKE1(config-router)# network 10.10.10.0 0.0.0.255
SPOKE1(config-router)# network 192.168.11.0

Lab 4 — Convert DMVPN to Phase 3 with NHRP shortcut + redirect
! Change spoke tunnel from p2p GRE to mGRE, then enable shortcut/redirect on EVERY router.

! —– HUB Tunnel0 (already mGRE) —–
HUB(config-if)# ip nhrp redirect

! —– SPOKEx Tunnel0 —–
SPOKE1(config)# interface Tunnel0
SPOKE1(config-if)# no tunnel destination
SPOKE1(config-if)# tunnel mode gre multipoint
SPOKE1(config-if)# ip nhrp shortcut
SPOKE1(config-if)# ip nhrp redirect

SPOKE1# show dmvpn detail
SPOKE1# show ip nhrp shortcut
SPOKE1# traceroute 192.168.22.1 source Loopback0 ! after first packet, shortcut tunnel forms

Lab 5 — Add IPsec protection to DMVPN with IKEv2
R(config)# crypto ikev2 keyring DMVPN_KR
R(config-ikev2-keyring)# peer ANY
R(config-ikev2-keyring-peer)# address 0.0.0.0 0.0.0.0
R(config-ikev2-keyring-peer)# pre-shared-key DMVPN-Cisco-123

R(config)# crypto ikev2 profile DMVPN_PROF
R(config-ikev2-profile)# match identity remote address 0.0.0.0
R(config-ikev2-profile)# authentication remote pre-share
R(config-ikev2-profile)# authentication local pre-share
R(config-ikev2-profile)# keyring local DMVPN_KR

R(config)# crypto ipsec profile DMVPN_IPSEC
R(config-ipsec-profile)# set ikev2-profile DMVPN_PROF

R(config)# interface Tunnel0
R(config-if)# tunnel protection ipsec profile DMVPN_IPSEC shared

R# show crypto ikev2 sa
R# show crypto ipsec sa

Lab 6 — FlexVPN hub (dVTI) + spoke (sVTI)
! See 2.6 above for the full Hub and Spoke config blocks. Verification:
HUB# show crypto ikev2 sa
HUB# show interfaces Virtual-Access2
HUB# show ip route
SPOKE1# show crypto ikev2 sa detailed
SPOKE1# show crypto ipsec sa
SPOKE1# ping 10.0.0.1 source Loopback0 ! reach hub loopback through tunnel

Lab 7 — Site-to-site IPsec with crypto-map (legacy IKEv1) for comparison
R1(config)# crypto isakmp policy 10
R1(config-isakmp)# encryption aes 256
R1(config-isakmp)# hash sha
R1(config-isakmp)# authentication pre-share
R1(config-isakmp)# group 14
R1(config-isakmp)# lifetime 28800

R1(config)# crypto isakmp key Cisco123! address 198.51.100.2

R1(config)# crypto ipsec transform-set TS esp-aes 256 esp-sha-hmac
R1(cfg-crypto-trans)# mode tunnel

R1(config)# ip access-list extended VPN_ACL
R1(config-ext-nacl)# permit ip 10.1.0.0 0.0.255.255 10.2.0.0 0.0.255.255

R1(config)# crypto map CMAP 10 ipsec-isakmp
R1(config-crypto-map)# set peer 198.51.100.2
R1(config-crypto-map)# set transform-set TS
R1(config-crypto-map)# match address VPN_ACL

R1(config)# interface GigabitEthernet0/0
R1(config-if)# crypto map CMAP

R1# show crypto isakmp sa
R1# show crypto ipsec sa

Check Your Understanding

Twenty-five questions on this section. Each answer is explained as you go.

1. 

In an MPLS L3VPN, what is the role of the P router?

2. 

The MPLS shim header is how many bits?

3. 

Penultimate Hop Popping (PHP) signals to the upstream router using which special label?

4. 

Which best describes the role of a Route Distinguisher (RD)?

5. 

Which best describes the role of a Route Target (RT)?

6. 

In an MPLS L3VPN data plane, what is in the two-label stack?

7. 

LDP runs over which transport ports?

8. 

In DMVPN Phase 1, what kind of tunnel does the SPOKE use?

9. 

Which DMVPN phase first introduced direct spoke-to-spoke tunnels?

10. 

Why does Phase 2 break when the hub summarizes spoke routes?

11. 

Which two commands enable the Phase 3 shortcut behavior on each router?

12. 

NHRP is described in which RFC?

13. 

In NHRP terminology, the hub is the…

14. 

Which IPsec protocol provides confidentiality?

15. 

Which IPsec mode adds a new outer IP header to the original packet?

16. 

Why is AH effectively unusable when NAT is involved?

17. 

NAT-Traversal (NAT-T) encapsulates ESP in…

18. 

How many messages does IKEv2 use to bring up an SA?

19. 

The major design improvement of IKEv2 over IKEv1 includes…

20. 

FlexVPN’s hub commonly uses which interface construct?

21. 

IKEv2 Smart Defaults provide default values for everything EXCEPT…

22. 

Which routing protocol is most commonly run over a DMVPN tunnel because it scales well with many spokes and supports stub routing?

23. 

To allow EIGRP to advertise a spoke route back out the same hub multipoint tunnel, you need…

24. 

Which command is required on a tunnel for IPsec protection in IKEv2/FlexVPN style?

25. 

Two PEs share a customer’s VPN. For full-mesh L3VPN, the simplest RT design is…

1 out of 1