So I'm going to start it again.
Right.
Starting from the hub, this is all I did on the Hub.
92 and 68 1.1.
Current source is serial zero zero.
Source multi point.
And then since it's multi point, it works with PNP to do the resolution of your destination plus none.
Then what do I need to do?
I'll go to R2.
R2.
I need to tell them to come and register to R1.
Right now if you check R1, the PNP is empty, so I need to.
There's nothing in there in the table.
I'll go to R2.
Now the differences are interface channel zero.
Correct.
I'll keep the hub and the spokes separate so all the spokes will just face the same thing.
This is two sources again for them, Serial zero zero.
So no need to change that part.
Multi point PNP network ID nothing.
I don't change that except for I tell them, listen, go and register yourself to the NHS of 192 168
1.1.
But for that, since he doesn't know where 1.1 he doesn't know the public address of 1.1.
I need to map it to map 192 168 .1.1 the public address is 16 dot.
That's what I'll tell my spokesman at.
Given time is equal to R3.
R3 would be three.
Everything else is the same.
Right.
This is your IP.
Go and register to the app for would be dot four.
This is your IP.
Go and register to the house.
R5 the same.
Future R1 now.
Until now it was empty.
Now you have two, three, four and five.
They have come up and registered themselves to be.
Right there.
Right.
Any questions?
Until now.
Cannot do.
Talk to our three clapping 1.3 right now.
If I check my sharp, I only have one entry.
Static entry.
But if I ping 1921681.3 my ping goes and if I go to my IP and a dynamic entry is added here as well
as
both sides some you also have another mapping for itself.
This is if you want to ping yourself, it's called no socket.
This is my own IP address.
Right?
So communication between all the spokes is possible now.
And I showed you how how it happens.
Right.
And the chapter registration registration request reply to registration.
Request request reply to the first few packets, go through the hub.
And then after that, everything is good to go.
Then what did I do?
This was only so that my end points, my edges talk to each other.
My main job is so that when one talks to ten, four talks to ten, five talks to ten three, my internal
networks talk to each other.
What do I need to do that?
What do I need to do to accomplish that?
You have to, because when you're out, then I'll tell you what my internal networks are.
So I'll run routing, I'll start everywhere.
I'll just copy the same thing.
I'll say router.
Exactly one network 192 and 68 .1.0.
Network ten 000.
Notorious Not.
So copy it everywhere.
They will not work.
Why is it not working?
Any questions because.
Now it's not working because multicast is not about it's not allowed.
It is allowed.
It's just that it doesn't know which destination to send it on.
Until now, with the decisions that you were making.
Say, for example, I'm talking about R2.
Until now it's decision was 192 168 .1.1 Going to 192.168.1.2.
Sorry, going from two to let's say three.
Right.
His decision, the decision that he had to make was to go to this destination, address this destination,
private address, what should be my public, which is 151 .36.3.
This was the decision that he used to make, and this was sold to him.
In what?
In the table to go to the private address of 1921681.3.
The destination, my public destination will be this public source you already know.
It only needs to solve this part.
Right?
The problem with multicast is it will still originate from 1.2, but it will be going to 224.
Based on this designation, there is no mapping, this designation to 20 400.
So I need to solve that part.
I need to tell him, okay, if the bracket is going to this, which I can just say.
But it is going to any multicast address.
I want you to send him where public address of R1, R3 as well.
R5 as well.
R4 as well.
So they'll send all their values to R1.
R1 sends it to whom
R1 needs to send it individually to all the devices.
Right.
So from R1, I'll say send it to all everyone who has come up to you and register dynamically.
Any one of these folks who has come up to you and registered dynamically, which is in his table, it
will go and send out Multicasts to each one of them.
Eventually making sure that the tunnel will come up, that you will come up.
We'll start from the spokes.
Difficulties with neighbour.
It does.
It will send unicast.
When you're doing the neighbor, it would but it would be complicated.
It would be complicated.
It does send on what do you call it.
It sends everything unicast.
But there are certain unicast multicast which also go through which will not go across the bridge.
So more generally, you always use this.
And plus another thing that you have to understand is Dmvpn.
Is Cisco proprietary?
It's Cisco's proprietary protocol.
Now, a lot of people might think we are doing it with you might have to do it with OSPF tomorrow.
If you are using Dmvpn, it is Cisco's proprietary protocol.
You will also have available to work with.
You can use OSPF, right.
I'll show you how to do that also.
But it has many design issues.
If you linked it with the VPN, it has many design issues which can be which are solvable.
But here you don't have to think that much in.
It's pretty simple.
We'll have a look at that too.
Right now what I want to do is I want to go to all my trunks, all my tunnels, Interface Tunnel zero.
I want to say IP and map multicast To whom?
16 dot not the private address.
Your mapping.
This is usually in the mapping.
This is the private address.
Then you have a public address to go to the multicast.
What is the outside header going?
Hey, copy, paste.
Paste.
Done.
So you see, R1 has received all the multicasts, but these people have not received anything.
So the tunnel is not coming up from this side.
Yeah, yeah, yeah.
No, not refresh.
So neighbors have all the neighbors here.
On what?
I don't have any doubts because I'm only receiving the hello packets.
The updates and everything are not coming.
Why?
Because I'm not able to respond to the hello packets.
The hub is not able to respond to the hello packets.
How is he going to respond?
IP map
multicast to.
I want to give it two dynamically learned destinations from the clients registration.
Whoever is registered to me, I want to send multicast to all of them.
I will do this.
I will wait for some time.
The hellos will still not go through because these registrations.
Which have come to me.
They have registered before I entered the command.
Right.
So there is a bug in it where if they have registered before you enter the command, it will not be
able to send multicast to them.
For this to work, you'll have to make them register again.
Now you can either turn down the tunnel or what you could also do is you could go to Tunnel zero, No
IP and Network ten.
IP and IP network ID.
Let's say this works.
I removed it from the scope when I registered him again.
When he registers himself, he comes and registers himself to the hub.
Registers himself to the hub.
It's a new entry.
He can send you multicasts.
So you become a neighbor so you don't really need to shut down the tunnel.
Might be an IP network ID ten.
As he's also up for.
Right after is up and our site will come up hopefully quickly.
So you'll see that show IP route Urban will have received all the routes.
Ten, one, ten, two, ten, three, ten, four, ten, five.
That's all.
The steps are pretty easy from our four.
Brother.
So you also have to make sure when you're doing it, you have to make sure that none of the mappings
are incomplete.
Right now, our four is incomplete.
That's why we keep on flapping.
So if there is an incomplete mapping, you remove it and add it back up again.
Make sure that the entries on the hub are never incomplete.
Usually it gets a registration request.
The reply doesn't reach or something like that, so it remains incomplete.
Let's check now.
Now is complete.
Now should be fine again.
Should wipe it out.
Shows you everything I have all the routes.
The only one problem right now would be what?
The routes have not been going down to the spokes.
So if you check the spokes.
The spokes are empty.
Nothing.
Only one doubt.
Only one network, which is behind R1.
R1 is giving out.
What?
R1 is giving out is giving it out to R4, is giving it out to our to our five and R3.
Say they are receiving it.
But whatever he's learning, he's not forwarding it out to the other side.
How do I fix it?
Split horizon.
Just like your frame relay.
Yeah.
iBGP split horizon one.
Then we'll reset and all of your neighbors will receive all the IP.
Right.
I have all the routes.
This is Dmvpn phase one again.
This is not complete Dmvpn.
You'll have to protect it.
How will you protect it?
Very easy.
You just go here.
I will not apply this because I want to show you what's inside the package.
But I'll just show you how to do it.
Crypto I Scam Policy ten.
Encryption three days.
Authentication pressure at 75.
Little ice camp.
He is still addresses 0000 means any anyone who is trying to create a tunnel with me.
I want to send the key Cisco to them because this is going to be spoke to spoke.
I'm having a lot of spokes and they're going to create tunnels with me.
Now, in real life environment, would you do this?
Is it safe?
Obviously not in real life, in production environment, you would not use this.
What you would use in is certificates.
So all of these spokes will register themselves to a CA a certificate authority.
Right.
When they're exchanging their tunnels, they will exchange ices.
And my ice has been issued by this authority.
My ice has been issued by this authority.
No need for passwords.
We will do we have a VPN on our server.
We'll see how that is done.
But just to let you know that you would not do anything like this if you have it in your mind that it
is not secure.
Pre-shared key you would not use, in this case the VPN, especially if you have 300 sites then crypto.
Voxyn.
IPCC Transform Set T.
Set PSP.
3DS.
PSP.
Germanic.
Crypto IPsec profile I proof
set.
Transform set t set then interface tunnel zero.
Do you remember this Tunnel Protection IPsec profile?
I.
Okay.
That's all.
The thing is, you have to just copy this and paste this everywhere else because nothing, nothing.
If you have a look at this, nothing changes your tunnel.
Zero is the same.
Your transform set is the same, your key is the same, your address is the same nothing.
You just copy paste this and it's done.
Your dmvpn is up and running.
But I will not do that because then I'll have to remove it again.
Okay, we'll do this at the end once we are done with everything else.
Right now, we still have a lot of other issues in hand.
What are those issues?
If R2 wants to go to R3, R2 and R3 are directly connected to the internet, they are directly connected.
There is no need for me to go to R1 first.
But the problem here is our one's neighbor is home R2.
Then R2 is neighbor is.
So when R2 learns about the roots of ten .3.3, it learns it from R1.
That means the next hop for R2 to go to R3.
When I say R2 to go to R3, I'm talking about 10.2 to go to 10.3.
The next hop is always going to be, which is one 9268 .1..
If the next hop is 1.1, I will always and always send my packets to one dot.
Then 1.1 will make sure where I'm trying to go.
10.3 It will know in his routing table he has 10.3.
See, let's let's check this.
I'm going to go to R2.
Right.
I'm going to send, for example, a pink to from ten, three to from 10 to 2.
2 to 10.
Three, three.
Right now.
This is going to have a public address.
First of all, a header.
On top of that, the public address going from 26 .22.
This three.
What entries you have here starting from.
Depending upon the next hop right to go to.
Ten .3.3.3.
If you check in your routing table on R2 to go to ten .3.3.
My next hop is 192 168.
So basically I want to go to 192 168 1.1 I'll do a recursive lookup.
192 168 1.0 is tunnel zero and it will show me the address of 192 and 68 1.1 which is what 16 dot one.
So this is my next stop is that I will go to.
16 dot the packet reaches whom i1 i1 opens this part, checks the source and destination source is 10.2.
Destination is what ten dot three?
Where does he check it?
Routing table how to go to ten dot three to go to ten dot three.
My next stop is 1921681.3.
You need to check the mapping for 91.31.3.
The mapping is 36 dot, so the encapsulation that he's going to add is coming from 16 dot one going
to.
The packet goes to 36.3 based on simple routing.
Is there a way I can make this better?
This is Dmvpn.
But phase one.
Back.
See, this is the MVP in phase one.
Everybody spoke, every spoke.
Private network should be able to talk to everybody else.
Now, let's concentrate a little here.
I'm going to all these books.
You think I'll have How many mappings do you think will be on R2?
Right now I've pinned all these books.
How many NHP mappings will be there on R2?
Only one y.
Next hop resolution.
Right.
This next hop is always 1.1.
For R2 to go to all of these networks behind the next hop is always 1.1.
It doesn't need to resolve anything.
It's always sending it to 1.1.
The reply is always first coming to 1.1, then 1.1 is forwarding it out so they don't need to do anything
special.
No resolution, request nothing.
Everything is fine with Dmvpn Phase one.
Phase two will be where I want my spokes to communicate to each other directly.
How do you think that's possible?
Check this out.
I'll go to the tunnel.
I'll say no IP Next.
Hop, Sell.
What does it mean?
Have you done it?
You might have done before.
Some might have missed it.
What is no IP nexthop is doing?
What I'm saying is R1 is in the middle.
R2, let's say, is here, R3 is here.
Ten .2.2.2.
Ten dot What I'm basically saying is when you learn about.
From one label and you're forwarding that route to another neighbor.
Usually, what does it do?
It adds himself as the next hop so that when R2 wants to go to 10.3, it will go through.
That's what's the normal procedure, right?
It will go through R1.
I'm telling him, do not do that.
Do not change the next hop.
What does that do?
The next hop will remain.
1.3.
When R2 receives 10.3, the next hop will remain 192 168 1.3 The actual address of R3.
R2 will not.
R1 will not add itself as the hop.
Similarly, when it gives out R2 to R3 when he's not adding the hop, what is the next hop going to
be?
Let's have a look at it first.
But not not because of the recursive lookup.
Check this out.
Now check the routing table on R2 to go to 10.5.
My next stop is 192 168 1.5.
Why is it 1.5?
See.
Alf was here.
I gave its network to whom r1 r1 forwarded its network to whom?
R2 but in the meantime did not change the next half.
Do you understand why he adds the next hop in the first place?
Next hop is the normal routing protocol.
If it was normal I'm not talking about this because all of them are on the same network.
If it was a normal protocol, let's talk about these three routers.
I said, this is ten, 11, 11.0 slash 24.
This is 1022 22.0 slash 24.
The network here is 2.2.2.2.
The network here is 1.1.1.1.
Right.
Side one.
Side two.
This is anomaly network different networks right now when 1.1 because these two become neighbors are
two will know about 1.1 in his routing table.
But what is the next hop going to be?
Ten, 11.
Ten.
11, 11.1 for R2 to reach 1.1.
Next stop is ten, 11, 11 one.
It will forward it out to R2 when he forwards it out to R3, sorry, R3 will receive it.
It will install it, but next stop will be what, 1020 2.22 dot because he learned it from R2.
Three learned it from R2.
So it will keep R2 addressed as the next stop.
So when he has to send the packet, R3 will send it to R2.
R2 will check its routing table.
R2 will send it to R1 and R1 will move it further.
This is normal routing.
This is how it happens.
But here the concept is a little different.
Why?
The concept is different because all of them are on the same network.
Yes.
No.
Not itself the other guys.
Yes.
Yes, exactly.
So earlier.
Yeah.
In R1 r1 r1 Stunnel interface.
No IP next hop cell.
So I said if you have a route coming in and you're giving that route out again, do not use yourself
as the next hop.
Do not put yourself in the entry of the next hop so that our three and four can by themselves go to
each other because they will have their stops resolved already.
Does everybody get this?
Do you want me to repeat?
Clear.
Next.
Hop, sir.
Right.
So the good thing about this is everything is resolved in the routing tables.
This can give you good 200 spokes, 200 to 250 spokes.
So if you check right now, the only one thing is right now I don't have the mappings.
Right.
I only have it for 1.1.
So now if I send my packet to ten .3.3.3, I would first need to resolve my MHR for 1.2.
Right, because now I'm not sending it only to the hub.
I'm sending it directly to these devices.
So I need to resolve for 1.3.
Do you understand this part Spoke to Spoke.
Right.
Earlier it was all going through the hub so did not need to resolve everything I knew.
The next stop is the hub.
I had a static mapping to the hub, so I would send it directly to the hub.
Now my next stop is the spoke 192 168 1.3.
I don't know the address, the public address of the scope 1.3 I need to go registration request reply.
Get the reply, get the public address, then send it directly to the spoke.
Right.
That's what you see right there.
So resolutions will be here.
If I send it to 10.3, you'll see from 10.3 side show IP and you should see that these have been resolved.
Right.
For two hours.
They'll be there again.
After that, it'll refresh.
Spoke to spoke communication person.
Moved from phase one to phase two.
None.
It's so simple.
It's as simple as that.
Next top shelf is phase two.
There again, I said this support 200 250 spokes very easily.
Very good in scalability.
But what happens?
Imagine this now.
What happens if you have 1000 spokes?
Imagine 1000 different routers connected to each other.
All this information
about what is the next hop is installed where in your routing table, if you have 1000 spokes, how
many entries will be there in the routing table?
Than 1000 will not be summaries.
That is the that is the problem here.
If you're using phase two, it will not be summaries because it needs to know exactly where to go.
If it was ten .0.0.0, what would be the next half?
Yes, it will be a memory problem.
Scalability issue is here.
Why?
See, if this was 10.0 what you were saying about the summary.
If you have 10.0, what would be your next hop?
Because the next hops here are resolved.
Where?
In the table?
In your routing table.
You know what the next hop is?
That's how you pay for it.
If you have 1000 spokes, imagine each of the 1000 spokes will have 1000 routes in their routing table.
Which again causes problems with scalability.
That's why they moved from phase two to phase three.
Phase three accomplishes the same thing.
Still gives you spoke to spoke communication, which you have available to you right now.
But scalability gives you much more scalability than phase two.
How have you ever worked with ICMP redirects or ever heard about it?
ICMP redirects if you have a switch.
And you have a router here.
R1.
This is R2, R3.
Now this might not be an Ethernet switch, can be frame relay or something like that, right?
Basically I'm talking about the same network.
The CDC's 1.0.1.
This is dot two and dot.
For some reason, for some reason, maybe based on mappings or you have to do it like that.
Design perspective.
R3 wants to go to R2, but the next stop is R1.
If you have something like that, right?
If you have something like that, maybe configured, configured like that, that the next hop is going
through R1 because maybe it's a half mesh and something there is an issue, but you want since they
are directly connected to each other, right?
192 168 1.2 and 1.3 are directly connected to each other.
They don't need to go through R1 because of their mappings.
They are, but they don't need to.
How do you fix this?
You go to R1, you use a command called ICMP redirect, which sends a redirect message to both of these
folks, telling them, listen, if you want to telling R3, if you want to go to 192 168 1.2, no need
to come to me.
You can go directly telling R2, listen, if you want to go to 192 168 1.3 no need to come to R1, send
the packet directly.
It's directly connected to you.
ICMP redirect.
They listen to it and they talk directly to each other.
Right.
See, how does the first question is, how does he realize?
How does one realize?
We enable ICMP redirect on on R1.
How does he realizes when he gets a packet on one interface, he doubts it and the and going out the
outgoing interface is also the same.
If the incoming interface is say, for example, this guy, the outgoing interface should not be this
guy should be somewhere else.
But if it is the same guy, he knows that both of these are connected together.
If I'm getting a packet from here and I'm sending it back out from here doesn't make my Why am I there?
I should not be there.
So I send both of them.
I tell them my need is not there.
You can go directly.
So they go directly.
The same concept we will employ deploy in the.
What I'll do for this is first of all I'll disable what the next hop self.
So I'll bring it back again.
So I'll go back to phase one.
Now here it's a little different here it's a little different, a little different than ICMP redirect.
But this concept in Dmvpn is known as NTP Redirect.
And direct.
And then.
Sucker.
And redirect and
redirect is the same.
If you enable it on the tunnel interface and it figures out that both the devices are talking to directly
or talking directly to each other and my need is not there.
What R1 will do is send an Http redirect to them telling R1 or telling sorry, telling R2 that R3 is
directly connected to you.
Go direct.
Also telling R3 R2 is directly connected to you.
Go direct.
It's the same thing.
It's same thing like.
There is a difference.
We'll see what the difference is.
We'll see how it makes the load very easy on the scopes.
I'll show you that.
But do you understand this?
And.
And this?
Yes, That's what we're doing.
We?
Will not be.
I'll show you how.
We will not.
Do you understand this?
The first and first thing is you have to make sure that all traffic is going through the hub in the
first place.
Our traffic has to go through the hub so that we want to trigger the redirect message only when the
traffic comes through the hub and goes out to the other side, the hub will know that these are connected
directly to each other.
It will send out redirects on both sides first before we go to the shortcut.
Let's see this redirect message.
What I'll do is I'll go to R1 Interface Channel zero.
I'll say IP and HRP.
See that?
Now beware a lot of ios's do not support this, so make sure you have the perfect version of iOS.
The one which I have is very bad for advanced enterprise and right.
So it's done.
R1 is set.
Now try it out.
Check this out.
My routes are complete, but my next hop is.
What?
My next job is since going to all the ten networks, my next stop is 10.1.
1.1.
Why don't I go to R1?
And say.
Other summary.
If I do this and I check my spokes.
You go to 10.0.
My next stop is.
Does it make sense?
It does make sense.
Why?
Because R1 has all the roots.
If I do wants to send a packet to 10.4, for example, it will send it to where it will send it to R1.
If I want to go to 10.5, I'll send.
That's my job, right?
I want to do that.
Then the trigger will happen for the trigger.
I do need to send all my traffic to after the trigger happens, I'll use that command of IP and shortcut.
What that means is override your routing table.
Let's see how that works.
Right before that, I have not used the shortcut.
I'll have my wireshark running.
I'll enable it on.
The last packet that you have is 2737.
I will send a ping from R2 to R3 again.
Any traffic indication.
This is the redirect message sent to whom or to send to our.
What happens if we use the same command?
After summarize.
After summarizing, if you use the no next hop cell, it will not show you anything.
Summarize it outright.
It will just show you one route pointing to the hub.
So you'll always send your traffic to the hub anyways.
All of these folks will send their traffic again back to the hub.
Even if you use an extra.
Why?
Because I'm summarizing everything and my 10.10 is also getting summarized.
10.1 What is the next hop me?
So when I send it out, I'm sending it out as we because I'm summarizing, Right.
But do you have a more specific.
Who has a more specific?
You know what I mean?
Advertising.
Because it is more specific than that one, then not it becomes less specific.
Yes.
So when you advertise it, it becomes more specific.
Yeah.
Directly to.
I mean, when I when I advertise my routes, when R1 is advertising its routes, its advertising it
as what, 10.0?
Right.
Its advertising it as not 10.2.
10.3.
10.4.
Sabotaging it as 10.0.
It's giving everybody 10.0.
So for them they'll always have 10.0 and the next stop will be R1.
Okay, we'll try that after we do this.
Try to do that.
So do you see this?
What is this?
Traffic indication will be sent both directions.
Basically, our one is trying to tell both of them, Listen, you don't need to come to me.
You're coming to me is okay.
You don't need to come to me.
You need to go where?
Directly to each other.
What I'll do on all these folks is I will clear the old mappings.
Clear IP command is clear IP and.
Declaring all the dynamic, energetic markets.
Make sure you don't do this on the hub.
Never, ever use this command on the hub.
So it will be incomplete.
For what?
Incomplete for our three interface Channel zero.
The some time.
Then also here.
Because I want to remove all mappings.
I want to only keep the static one there.
They're all registered properly.
And it also is satisfied, right?
So right now, if I send a ping to ten .3.3.3 with the source of ten .2.2.2, you see that nothing gets
resolved.
Why?
Right.
Because everything is going from there.
Everything is going from the hub.
Ten dot zero network is from where?
This is phase one.
Phase one only with autosomal.
It's just that the hub is trying to send you an indication, telling you please go direct.
Please go direct.
But you're not listening to him.
To listen to this message would mean to override your routing table.
Listen to this message.
For that, you'll have to use a special command known as NP shortcut.
IPA.
Direct saying that if you if you know that both of them are directly connected, if a packet is coming
from this interface going out again from the same interface, tell them to go direct.
That's redirect.
This is the indication, right?
I'm not sure if you can see everything in here.
The actual source and destination is 10.2 to 10.3 should be here somewhere.
The actual IP.
There is a mandatory party are right here.
16.1 is the source.
Address me my source address.
Right.
And I want to go to ten .2.2.2.
I'm sending this syndication to 26.2.
I'm sending it to 26.2.
I'm telling him, Listen, Source Protocol Address 192 168 1.1 wants to communicate to you.
He wants to communicate to you.
192 168 1.1 wants to communicate to you.
I'm sending it.
To whom?
R2 to R1.
What am I sending the opposite to?
R3?
Sir?
R3, I'll be telling.
All right.
Doesn't give you much information.
Three.
I'm telling that destination is 10.3.
Sources 16.1.
And there is information there.
But it's right there is too huge.
So it's somewhere around the same place.
But let me explain to you what this message is.
What I'm basically telling him is, listen, I'm telling her to first.
Listen, someone is looking for you.
The guy, 182.168 .1.41.3.
Let's say he's talking to all three.
Wants to communicate to you.
It is all for him, right?
I'll use the shortcut command only here.
I will not use it on R3 side.
And let's see how it works.
I will not use it on R3.
I will only use it on R2.
Let's see how R2 deals with it.
I will go to R2 and I will tell him, listen to the shortcut, listen to the redirect message.
How?
I'm telling him, listen to the direct message that is coming to you.
My wife is on on both hands.
This is our three.
Is the other capturing from R six to R four.
So let me send my ping from R two because I'm monitoring R four.
I'll send it to ten 444.
So the source of ten.
Visualize what's happening.
I'm sending my packet to ten four, four, four.
But first it goes to the hub.
Then from the hub, it will go to ten four, four, four.
The hub will make find out that they're directly connected to each other.
It will send out a redirect message.
Only R2 will listen to the message.
And that's what we want to see, what R2 is going to do.
You already gave the IP address on R2 only, so it should go out.
It is not in the beginning unless he gets the redirect.
R2.
Now.
It should.
It may.
What?
I will not listen to.
I too will have the dynamic entry.
I will always go through the hub.
The reply will always come through the hub.
My request from R2 will always go directly.
Asymmetric.
The reply will come this way, but request is going there.
It will be like a cycle.
Yeah.
Batteries go.
You gave the command now for R2 R1, I'm saying redirect R1.
Yes.
So R2 will only listen to the redirect.
Yes.
Once he gets the redirect.
The redirect is a is a message.
The traffic indication message already got it right.
That was old.
Once he gets it now.
Yes.
Because he doesn't have the mapping right now.
Disabled.
He didn't listen to it.
He didn't.
He got the message.
He got the packet of redirect.
He didn't listen to it because he didn't have the shortcut command.
The command is there, so it'll be sent again.
I should go directly to Darfur.
The reply will come from the going through.
I want to check first on the hub.
The hub sends out what?
This is the new one.
Traffic indication to both of them to R2 and R4 sends out a traffic indication to R2 and R4.
He gets a resolution request.
This happens every time.
The first time.
Now, if he has the mappings already, now he doesn't need it, right?
He will have the mappings now.
Once he gets the indication, he sends out a resolution request.
Check this out.
Resolution Request Resolving 192 168 1.4 Asking for where is 1.4?
What am I going to do?
I'm going to forward that request to R4.
The same cycle.
I'm going to get the request forwarded to R4.
R4 will reply directly to R2 with his address.
So you see the ping will go through.
If you trace it out.
Android.
4.4.4 with the source of ten .2.2.2.
You see direct you're going directly to 1.4 traceroute will show you one way.
Right.
But if you do the opposite.
Traceroute ten .2.2.2.
So the source of ten .4.4.4 You're always going through the hop.
Because our foe never sent the resolution request.
Also, I want you to see something.
Check this out.
Me?
Do you see a difference in the mappings?
It's dynamic, But you're not only resolving the next hop.
You're actually resolving the full network.
And your overriding your routing table.
Your resolving the complete network of ten .4.4.0.
So when I go to the Hub, I'm not only asking him for where is 182 168 1.4.
I'm asking him for the whole thing, telling him, Listen, the hub tells me, listen, you want to
go to 10.4.
You go to 10.4.
Your next hop is 192, 168, 1.4 In the resolution request I'm asking for where is 10.4?
Whose next stop is 192?
168 1.4.
The complete network.
Verse ten .4.4.3.
So when the request reply comes in from R4, he will reply to me Listen, this is 10.4.
Let's have a look at that reply.
Should be here.
This is the other one, right?
This is the other one.
Let me do NP.
Let's check the entries in here.
He gets that indication, doesn't do anything.
This request is which request?
This request is the one which he received from R2.
R2 on the router.
We don't have to.
You have the coffee, you have the.
That's what we need.
This is the actual address.
This is the next stop.
We never really cared about these two earlier.
Why?
Because they were always the same.
That's why I didn't tell you anything about it.
Now they are different.
So just doesn't only resolve the next hop, it can resolve full networks.
The network part will be here next.
Hop will be here just like your routing table and the physical address.
The real address will be here.
This is the difference between the two.
Okay.
But if I have multiple tunnels.
But I have multiple points.
Point one.
Point to point tunnel.
Okay.
Although.
And in that case you will not use redirect if you have point to point.
Unless you're doing this only because.
See, I'll explain.
Redirect is only working because it's point to multipoint.
Why?
Because everyone is connected from this one interface.
R2 is connected.
R3 is connected.
If it was point to multipoint, point to point, this would be different networks.
If they're different networks, the redirect will not be triggered because you're going from one network
to another network.
Here you're trying to go from the same network to another same network.
Yes.
Let's first go through our one and also go through the same interface.
So going in interface should be the same outside interface should also be in this case, it won't happen
like that.
In this case it will not happen.
But whenever you're using Dmvpn you'll always use multipoint.
That's why Mgwr.
Right.
Do you understand this?
The resolution request and reply.
So resolution request is coming all the way here.
This is the resolution.
Request is asking for 10.4.
Right.
What is the address of 10.4?
Who is asking?
192 168.
1.2 is asking for.
Where is ten .4.4.4?
The reply comes through.
What is the reply?
The reply Am I on the right guy?
I am on the right guy.
This is the request.
How is this different from the.
You have a server and a line, but it does the same thing.
When you have a server and the client looks the same.
Yes, but in that case, in that case, R2 knows the next hop.
So it goes to him asking for where is 192 168, 1.2 in his routing table.
He knows where is 1.4.
It knows where it's supposed to go.
If R2 at that point wants to go to 1.4, it knows where it's supposed to go.
It knows it's supposed to go to 192 168 1.4.
Right now, it doesn't know everything is going through the hop.
Okay.
In phase one, everything goes through the hub.
So our two in his routing table does not know what.
What is the next hub for 10.4?
What is the next hub for 10.5?
What is the next hub for 10.3?
Does it know that in phase three, if you check the routing table, that's what we did, right?
The routing table.
You have no information.
Everything is going through the in phase two.
You know what the next hop is?
You just don't have the mapping for it.
So you go to the hub, you ask him for the mapping, he gives you the mapping here.
That's what we want to do.
We don't want to have any load on the spokes.
We don't want to put any any load on the spokes.
The spokes are free.
They don't have any information in the routing table.
Yes.
When they ping, if the traffic goes through the hub, that will redirect them.
Tell them, no, you're not supposed to go through the hub, go direct.
So give them the mappings.
They will send a request.
Request reply, request, request, reply.
Spoke to spoke.
Communication is.
No pressure on the spokes at all?
Yes.
Yeah, they will.
They will consult the table.
Always.
Since you're using the shortcut command, they'll always configure.
They'll always use the table to move forward right again.
Now I'll go to our for right now our for is still going through the hub so I'll go to our four zero
IP and Http.
Send it again.
First time.
But I spoke to spoke.
Right.
So your traffic going from between them is direct.
Which one?
No, I don't think it has anything to do with AAP.
AAP would be from Marco to go to R6.
That has nothing to do with the whole thing.
That would be for the next half.
Finally, R5 to configure is is easy to understand is what makes the difference.
To configure, just go to the tunnels and shortcut.
That's it.
It's done.
Spoke to spoke.
Communication is done for all of them.
Registrar 10.3 The first packet will go through the hub.
Second packet will go direct if you want to go anywhere now.
First packet Hub.
Second packet.
Second paragraph.
No issues with that.
I think.
Who one nockels and having.
Then not four.
Not for.
It's the same process.
The process is the same.
Yes.
The process is the same.
No.
Check this out.
If I go to, you'll have to see this 1.5.
Go to 1.5.
Why?
And it's resolved right here.
All of these entries are resolved from me.
Then the three then .4.51.11.31.41.5.
The next stops are resolved.
The networks are resolved.
Everything.
See, the best thing that you have to understand the moment the hub realizes that they are supposed
to communicate together, write directly to each other, sends out a retaliation.
It just sits there and sends out a redirect.
They will listen to the redirect, talk to each other.
They don't usually directly talk to each other.
They send out a resolution request.
Resolution Reply.
Resolution.
Request.
Reply.
Request.
But we didn't use the.
One, maybe.
Yeah, we did interface channel zero IP and it.
You know what?
Yes.
How was it different from yesterday?
We didn't use phase two yesterday.
Everything was going through the hub, but if I wanted to, I manually went here and I said ping for
92 and 68 .1.5 yesterday.
You know, for this you don't need the redirect.
Why?
For the network?
Because I don't have it in my routing table.
I don't know how to go there.
Yet.
I don't know how to go there, but it's going through the hub, so that means everything will go through
the hub.
That one is that the other one is directly connected to him.
So when I send that, if I ping 192168.1.5 if I do it like this, it will not go to the hub because
the hub is what, 1.1 for the resolution request.
If it wants to go somewhere where it doesn't know where to go, how What does it do?
Send out a request for 10.0.
It is not like he doesn't know where to go.
He knows where to go.
Where is he going?
To the hub for 182.
168, 1.2.
He doesn't know where to go.
Since he doesn't know where to go.
It sends the first two packets or three packets to the hub, but along with that sends a resolution
request.
Didn't understand why.
Not.
See.
Let me explain.
If you did not have any direct messages, let's talk about the case where you don't have redirect implemented
on R1.
If you don't have that and R2 wants to ping ten .3.3.3, what is going to happen to this pink?
The next stop is R1 R1 checks, the routing table, the next hop is R3, forwards it to R3 return back.
It also follows the same path.
Correct.
That's because the next hop of this was what?
That's why it goes to the hub.
The only reason it's going to the hub is because the next hub is 192, 168, one not.
The difference is now if I ping 192 .168.1. is the next stop the hub.
For this network.
What is the next half?
Is it supposed to go to the hub?
No, it's not supposed to go to the hub.
It goes to the hub only for the reason because he doesn't have the resolution for it.
So this packet also goes to the hub, but not because it wants to.
Because it needs to.
So I will send.
I will not.
Okay, Let's remove this whole thing.
This packet will only go to the hub because.
And go out again here only because along with this, a resolution request will also be sent.
The only reason it goes to the hub is so that the packet is not dropped.
That's why otherwise it would be in the buffer and get dropped.
So unless he gets the resolution reply back, it sends it through the hub.
Because why?
I'm not going to 1.1.
I'm going to 1.3.
Do you understand the difference between the two?
Now when redirect is on, when redirect is on from R2, if I ping ten .3.3.3, the next stop is still
R1.
Packet goes to R1.
I won't forward it to our three right.
Figures out that both of them are the same interface sends out what?
Sends out a redirect to both of them.
Both.
Both of them are and are.
And then they send out the resolution request.
The redirect is only to tell R2 to trigger resolution for ten networks for 192, 168 networks.
He doesn't need to send out the redirect.
They can be in here.
An email address of what?
Of myself.
R1 R1 says I'm the guy who's sending you the redirects, right?
Doesn't send the address, tells them you want to go to this public address.
Right.
Listen, understand this.
If R2 needs to go to any one of 182.168 .1. except for one.
Anywhere else.
He will know that he is supposed to resolve it.
Try to understand this.
If R2 wants to go anywhere else other than 192 168 1.1, it will send out a resolution request.
Why?
Because this mapping is static for him.
The other ones are not.
So it sends out resolution requests.
So if you ping from here to 192 168 1.3456.
You don't have to trigger it.
It automatically sends out the resolution request.
The problem is when you go to 10.4.
When you ping ten dot four.
If the next hop was 192, 168, 1.4, it would send out the resolution request.
But your next hop is not that.
Your next hop is what, 1.1.
So you need another way, another mechanism to trigger that resolution request.
What is that mechanism?
R1 will send the redirect only so that you send what?
Nrhp resolution request.
That's it.
R1 doesn't say anything.
R1 just tells him.
Listen to go to 1.4.4.4.
Your next hop is 192.168.1.4.
That's what he tells.
That's all he tells us.
Then he resolves for what, one dot.
Similarly, when he goes to this guy tells him listen to go to ten .2.2.0.
Your next stop is 1.2 resolve for 1.2.
The resolution will always be for 192 168 Network interfaces the endpoints.
Yes, to go to these tunnel interfaces, what is my next?
What is my nvme address?
What is the physical address to go to these addresses?
Right.
But any redirect is a little more advanced because it also lets you know the whole thing, the subnets,
the subnets behind that next.
That's because of the pain.
You sent the destination and the pain tells you to go to this destination.
Your next stop is 1.2 to go to that destination.
Your next stop is 1.31.4.
Gives them that.
Then he needs the name address for that.
So he sends out resolution request gets the reply.
Claire.
A table.
1.31.31.2.01.3 is not here.
The other ones are not.
Everything is going through the tunnel.
Which one do you want to see?
What do you want to see in the set?
It's in the chest.
The next stop is just 1.3, 1.4 and 1.5 right here.
Right.
According to this, it goes to the table according to the next operator.
Then it goes where?
Right here.
He gets what?
Jackson.
But they won't be resolved.
Yes.
Exactly.
That's the that's the biggest difference.
They will not because it's in the routing table.
Right.
But in table, the next stop is there.
So the next stop is there.
It doesn't need to go.
You up.
See and happy right here.
This is the table.
But that also means.
Yeah, not lots.
Not really a lot.
Because see, the good thing about the one which you're using right now is spokes will only have the
mappings only if they're talking to each other.
So thousand spokes will not be talking to each other.
Thousands, Thousands of seconds.
Every second.
They will not be talking to each other.
Only if I'm talking to that spoke.
I will have the mapping for that spoke.
Do you understand that part?
Only if I'm talking.
The good thing is two hours.
I'm not talking.
Entry is removed.
So there will not be a lot of pressure on the spokes.
That is the best thing about phase three.
And that's why it can support more than 1000 spokes.
The neighbor relationship will not go down because all of them are neighbors with whom only one guy,
the hub.
And it's a static entry.
That will be the dynamic.
The dynamic goes down, which is okay because the moment you send a ping and resolution request redirect.
All three packets spoke to, spoke to, set up again.
See.
I.
Okay.
Maybe not.
Foxes.
No, they're not.
So much good stuff, right?
You mean hubs?
These hubs.
Something I want is my house.
You want to have another hub?
I too, will be another hub.
Yeah, yeah, yeah, yeah, yeah.
We call it Daisy Chain.
Yeah.
How is that?
Serves as a resolution.
In that case, you're talking about multiple hubs, right?
So you have one cloud here, another cloud here, another cloud here.
And after wants to talk to our ten.
And where do you think our ten is?
Our ten is not in the store.
It's in some other cloud.
So what you would do is say R1 is here, right?
R2 is here.
R1 will be the hub of some other guy also.
So you'll have R1 working in 182 and 68.
R1 R1 will be your point of contact for both of them, but both of them.
But right now.
Both of them.
So this is one cloud right on here you have another cloud, but the point of contact between them is
R1.
You could also have R1 and R2 for redundancy.
So you have one cloud here, one cloud here, R1 and R2 acting as one cloud between the two.
But again, you'll have to make sure that these two are separate networks.
This is 182 and 68 1.0, a separate network.
This is 192 168 2.0, a separate network for R2.
R2 will differentiate, R1 will differentiate them there.
You would read at that place.
You would not say if the clouds want to talk to each other, no redirect is needed because you'll be
coming in from this interface, going to another interface, not directly connected, so you don't need
redirect and redirect.
So the network is not directly connected to redirect is used for the networks which are in your in your
same to the spokes which are in your same network because you want to see.
I want to talk to him, but my packet is going from there, so I need a redirect.
I need the hub to tell me go direct.
But now I want to go to the other cloud which is behind the hub.
Do you know?
See, when he says cloud to cloud, what he's talking about is I have one cloud here, I have R1 here,
I have another cloud here.
These are two different networks.
2.0.
So if a router here wants to talk to a router here, why does it need to redirect?
His packet will always have to go through R1 and the reply also has to come through R1.
How do you directly talk?
They're not connected directly to each other.
The only point of communication between them is R1.
You think?
No, no, no, no, no.
That's not right.
Here.
You won't use the same interface here.
You'll be two different interfaces.
The earlier one, you can compare it because one router doing everything just like router switch plans
come and he's doing everything.
But this is much better than that because your data traffic is not coming through.
This guy.
No data.
It's control plane traffic only which is coming to the hub and request resolution that is coming through
the hub data plane traffic is going directly spoke to spoke right in router on a stick everything is
the data is all coming through so a lot of pressure on the router here.
Even the hubs are free.
The hubs don't do much, they only resolve some requests resolution and they're fine just sitting back.
Okay, let.
How do you protect it?
Phase three.
How to protect it?
Nothing.
Just copy and paste.
Right.
That's all.
You're done.
So neighbors have all the neighbors set.
Neighbors.
None.
Swipe it out right now.
No doubt.
Just a default route, just ten zero.
Right.
So if I ping ten .4.4.4 with the source of ten .55.5, I can go trace route ten .4.4.4 to the source
of ten, not direct.
So crypto IPsec section gaps.
Right stepping fighting HRP point five 10.4.
Let me think.
Ten .3.3.3
IPsec Downs as per the as per where he's going.
So Crypto IPsec has a section
now.
Earlier you had three, now you have four because now I'm also sending two.
So crypto campus.
Right for everyone will create a nicer campus for every spoke.
There will be icy campuses.
3254255221252255245, two, three.
Said from our one.
One with each.
This will be there because I have neighbors with everybody else.
Now, if that guy is talking to someone else, right, if, say, for example, R3 is talking to R5,
it would need a separate tunnel for that.
If R3 is talking to R2, it will need a separate tunnel for that.
So all the tunnels will be dynamic.
The good thing is they are all dynamic.
The moment you send traffic, the tunnel will come up.
The moment mappings expire, the tunnel will also go down.
Okay.
So when you draw it.
Can you go?
And can you say that the marketing term is inside the IP segment?
See, these are your tunnels with these are your tunnels with whom?
With the hub.
Here are the tunnels with the hub, with the static mappings between the two.
They'll never go down.
Packets are going through them.
Then if R4 wants to talk to R5, you will need to have another tunnel.
Right.
Because they spoke to spoke direct communication.
Inside.
These are all IPsec tunnels before IPsec, Obviously UDP is negotiated.
UDP 500.
So they because they're talking to each other, right?
They're talking to each other.
UDP is negotiated.
Everything is negotiated.
The negotiation will be from 192.168.1. 5 to 1 92.168.1.3.
On the outside will be what?
56.52 36 point.
Tunnel info say this will be the actual packet.
So esp right here to protect whatever is inside so you will never see the spark.
So if we had here, you can see that I've been acting inside the system.
And yes, we had a yes because Gary is right here.
This is actually Gary.
And on top of that is what this header is a lot.
The header on the packet is also a lot.
How can you reduce it?
Transport.
Do you think it will work here?
Definitely will.
We have seen much the same.
See, the packet is still the same.
You're going from ten .3.3.3 going to.
It is protected.
Using what?
Not protected.
Encapsulated.
Using grease.
Going from 36.3 going to.
Protected using what?
Also again, since esp copies the header 46.4.
These two are the same.
Use transport mode will remove complete section.
Entirely remove it.
Her
daughter will be the actual one public to public.
Inside will also be public to public address.
No, no.
I'll be 10.3 to 10.4.
Then he will look for the next stop.
From the next stop.
He'll find the public address, that public address he'll put here.
External interfaces have the one thing we don't have that we don't need that.
See the tunnel interface only you need to resolve this part.
Which destination do you want to go?
That's the only reason why you need the tunnel, right?
See if you want to ping
192.168.1.4.
You'll go to your table.
From the table, you'll find the public address, that public address you'll put here.
Correct.
You go to the table, get the public address.
It is?
Yeah.
Let's.
Let's just not look at this part.
Let's say there is no encapsulation.
Encapsulation is just nothing.
Just copies the header on the outside.
Same duplicate header.
Right.
So if I go on to go to ten 1.4, I get the address right here.
Now if you want to go to.
What happens?
The next hop, right?
The next stop is what, 192 160 81. actual it's for.
But for now it thinks it's one goes to one gets the resolution.
In the resolution it says it's for it doesn't go need to go to that for it just needs to know what is
the public address of that phone.
That public address is installed right here.
You don't have to worry about where you're going.
You're not actually going there.
You can have 1000 networks behind.
You could be going to any one of those networks.
What you care about is the next hop to go here.
What is the next hop
in?
A to M and N are related.
They work together to form the.
And here is not possible if you don't have your next hop.
Right.
One destination is never known.
Who solves that for you?
And they said in the next chapter to configure, it's super easy.
Why you just go up there and shortcut, redirect, shortcut.
It's done.
Starts working to understand.
It takes concept.
And that's exactly why they brought this whole thing.
They've removed frame relay with Dmvpn because of these concepts, so many different routing concepts
in there.
These are we didn't do anything with IPsec just copied IPsec pasted it here.
Yes.
If you use transport mode, it will work.
PVCs.
Yes.
Which this one?
Not really.
If you understand how it's working now, it will not be if you're using.
Yes.
Yeah.
You will have to use full mesh.
So if you don't use full mesh obviously spoke to spoke, communication will not be possible.
Everything will go through the hub.
Okay, clear everyone.
Also for frame relay, there is also another new kind of not new.
It's a different type of VPN called get VPN with frame relay.
What you have is your connectivity is always there here because this is the internet.
I needed to make sure that 10.4 and 10.4 communicate to each other.
If you have frame relay here, this communication will always be set beforehand.
The service provider will do that for you.
Here you have to set it up.
Yes, because that's what they do, right?
They connect to your private networks together.
So you don't have to worry about that part here.
You have to make sure that these communicate For that.
You have to run a routing protocol for routing protocols.
You have to let multicast go through a lot of different things.
Okay.
You know, I was just again, Channel zero.
Whatever is going through the tunnel interface, zero.
Every time we have traffic from the tunnel.
So anything going to the network of 192 168 1.0 is through the tunnel.
If the next stop is 192 168 1.0 it goes through the tunnel.
In crypto in crypto matches.
How do you compare that in crypto maps?
You use an ACL and apply to the interface the map.
So when it hits the interesting traffic, the tunnel is formed.
In here you don't do that.
You use a much simpler term.
You give it another interface.
Tell me anything which is sourced from this interface.
We'll go through the tunnel.
So there is interesting.
For what?
Here if if you have this network advertised.
If this network is advertised in EGP, hello packets will always go through the tunnel.
Yes.
I will never go down.
Five minutes, five seconds will keep on sending interesting traffic.
The tunnel will not go down.
Clear.
That.
This is a single hub.
Now, we'll do what after the break.