Configuring mGRE
Context
To implement DSVPN, create a tunnel interface and set the interface type to Multipoint GRE (mGRE). You only need to configure the source address or source interface but not the destination address on the mGRE interface. An mGRE tunnel interface has multiple remote ends and allows multiple GRE tunnels to be established on the interface. This simplifies GRE configuration on devices.
Perform the following operations on the Hub and Spokes.
Procedure
- Run system-view
The system view is displayed.
- Run interface tunnel interface-number
A tunnel interface is created and the tunnel interface view is displayed.
- Run ip address ip-address { mask | mask-length }
The IP address of the tunnel interface is configured.
- Run tunnel-protocol gre p2mp
The tunnel encapsulation mode is set to mGRE.
Changing the encapsulation mode of a tunnel interface deletes other parameters of the tunnel interface, including the source address or source interface configured for the tunnel interface, and NHRP parameters.
- Run source { [ vpn-instance vpn-instance-name ] source-ip-address | interface-type interface-number }
The source address or source interface is configured for the tunnel interface.
Changing the source command configuration will cause the IPSec configuration on the tunnel interface to be deleted.
- (Optional) Run gre key { plain key-number | [ cipher ] plain-cipher-text }
The key number of a tunnel interface is set.
By default, no key number is set for a tunnel interface.
If plain is selected, the password is saved in the configuration file in plain text. This brings security risks. It is recommended that you select cipher to save the password in cipher text.
- Optional: Run nhrp session link-state check
The session detection on decapsulated mGRE tunnel packets is enabled.
By default, session detection is not performed on decapsulated mGRE tunnel packets.
If the dynamic mGRE tunnel between two Spokes is disconnected, the Spoke attempts to send packets to the Hub for communication with the peer Spoke. The Hub performs session detection on received packets. If the session detection fails, the Hub drops the receive packets. After session detection on decapsulated mGRE tunnel packets is disabled, the Hub forwards received packets instead of session detection, which avoid dropping of packets sent from the Spoke to the Hub.