In the previous lesson, you saw how NHRP enables a spoke to resolve another spoke's public IP address.
Now, it's time to discover how DMVPN evolved across three distinct versions, known as DMVPN Phases.Where Does the Traffic Go?
The fundamental difference between these versions comes down to a single question: how do packets travel between two remote branches?
Take a look at your topology, where Chicago (R3) needs to send traffic to Miami (R4):
Figure 1 – How does traffic travel between two spokes?
In all three phases, every spoke maintains an active overlay tunnel to the central Hub (R1).
What changes is the path your data packets take:Phase 1: Traffic is always forced through the Hub (Hairpinning).
Phase 2: Spokes dynamically build a direct tunnel on demand.
Phase 3: The first packet travels through the Hub, triggering a direct shortcut tunnel for the rest.
Answer the question below
Click on Complete to continue
Phase 1 relies on a single mGRE interface on the Hub, while spokes use standard point-to-point GRE tunnels.
A point-to-point tunnel has only one destination: the Hub.
R3 can send GRE packets to R1, and nobody else.The Packet Path
Send a packet from Chicago to Miami:
Figure 2 – Phase 1, first stop: the hub
R3 forwards the packet to New York (R1).
R1 decapsulates it, checks its routing table, and sees Miami behind R4.
Figure 3 – Phase 1, second stop: Miami
R1 encapsulates the packet a second time and sends it out of
Tunnel0to R4.The packet is encapsulated twice and crosses the Internet twice.
This is hairpinning, the exact limitation Phase 2 and 3 resolve.Answer the question below
In Phase 1, which router forwards the traffic from Chicago to Miami?
Phase 2 enables mGRE on every spoke.
Tunnels no longer have a fixed destination, allowing R3 to reach R4 directly.Direct Tunneling on Demand
Send a packet from Chicago to Miami:
Figure 4 – Phase 2, R3 asks for the public IP of Miami
R3 first asks R1 for R4's public IP using NHRP.
R1 forwards the request to R4, and R4 replies directly to R3.
Figure 5 – Phase 2, Miami answers directly
R3 maps 192.168.100.4 to 203.0.113.4, builds a dynamic GRE tunnel, and sends the packet directly.
Figure 6 – Phase 2, direct tunnel
The packet crosses the Internet once.
The Hub relays the NHRP lookup but never carries the data traffic.The Downside of Phase 2
For direct spoke-to-spoke resolution, R3 must know that the Miami LAN lives behind R4, not the Hub.
This forces every spoke to keep a specific route to every remote LAN, with the remote spoke as next hop.
In a 300-site network, that means 299 routes per spoke.This is a bottleneck that Phase 3 solves.
Answer the question below
With Phase 2, how many times does the packet cross the Internet?
Phase 3 keeps mGRE on every router.
It delivers direct spoke-to-spoke tunnels without requiring full routing tables on spokes, the Hub points out shortcuts dynamically.The First Packet Takes the Default Route
Spokes only need a default route to the Hub.
Send a packet from Chicago to Miami:
Figure 7 – Phase 3, the first packet reaches the hub
R3 forwards the packet to R1 based on its default route.
R1 looks up its table and forwards it to Miami.
Figure 8 – Phase 3, the hub forwards it to Miami
The first packet is delivered through the Hub without drops.
The Hub Triggers a Shortcut
R1 notices the packet entered and left through
Tunnel0.
Since both spokes share the same overlay, R1 sends an NHRP Redirect back to R3:
Figure 9 – Phase 3, the hub redirects
This redirect informs R3 that a direct path to Miami exists.
Answer the question below
Which NHRP message does the hub send to R3 after the first packet?
Subsequent Packets Go Direct
R3 asks the Hub how to reach the Miami LAN directly:
Figure 10 – Phase 3, R3 asks for the public IP of Miami
R1 forwards the request to R4, which answers for its LAN with its public IP:
Figure 11 – Phase 3, Miami answers directly
R3 builds a direct shortcut tunnel to
203.0.113.4:
Figure 12 – Phase 3, direct tunnel
All following packets travel directly between spokes, crossing the Internet once.
The routing protocol advertises only a single default route to each spoke.
NHRP installs shortcut routes dynamically, strictly for active destination sites.
These entries expire when traffic stops, providing Phase 2 forwarding performance without populating hundreds of routes per spoke.Answer the question below
How many times does the packet cross the Internet once the shortcut is up?
Answer the question below
In Phase 3, how many Internet crossings does the first Chicago-to-Miami packet make?
Here is how the three designs compare side by side:
Design Element
Phase 1
Phase 2
Phase 3
Spoke tunnel
Point-to-point GRE
mGRE
mGRE
Spoke-to-spoke traffic
Through the hub
Direct
Direct, after a redirect
Routes on each spoke
One default route
Every remote LAN
One default route
Table 1 – DMVPN Phase 1, 2 and 3
Launch the interactive scenario below to see all three phases in action:
Answer the question below
In Phase 3, how many routes does a spoke need to reach every branch?
Answer the question below
With only a default route and every traceroute hitting the hub first, which DMVPN phase runs?
In the next lessons, you will configure Phase 1, Phase 2, then Phase 3, on this topology.