We help IT Professionals succeed at work.

DMVPN 3, deny Spoke to Spoke Traffic, and allow a certain Spoke to be reached by the other Spokes.

740 Views
Last Modified: 2016-01-02
In DMVPN Phase 3, I need to deny Spokes to reach each other, except a certain Spoke I will name it here SPOKE-X.
I need all the Spokes to communicate with SPOKE-X, but all the Spokes must not communicate with each other.

With DMVPN Phase 1, the answer is turn of  split-horizon on tunnel interface and to use Distribute-List in the EIGRP (My interior routing protocols).

I will upgrade My DMVPN to Phase 3, to Save the Bandwidth on the HUB for the Traffic from Spokes to SPOKE-X

 I need your help please.
Comment
Watch Question

CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
You can not use LANs of the spokes in the Nonat rule on the hub, your site to site hub to spoke using dynamic publishing networks, while your ACL will dictate whether the spoke has access rights to the other remote spoke.
Limit the advertising of routes hub to spoke ....... Just the segments to which it can go.
Make sure you also do not exempt IPSec/VPN from nat rules.
This way your hub ACL rules along with your network advertisement will dictate which and whether a spoke can access another spoke via the hub.

Since you mentioned a spoke, you do not have a mesh setup where certain spokes have direct connection between them.

Author

Commented:
thanks arnold
i need to prevent Spokes to receive other Spokes routs

thanks
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Control the advertisement of those routes to the spokes, it sounds as though your HUB transmits the same set of routes to all spokes.

Does the Cisco cover your setup?
http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/29240-dcmvpn.html

I.e. whether the spoke to spoke communication is not via the HUB but rather the spoke initiates/establishes a VPN connection directly to the spoke to which there is traffic .......?
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.