There is this really cool thing about DMVPN that I came across a while back:  DMVPN Per-Tunnel QoS.  Apparently it isn’t just me (as a lab rat) that thinks this is cool.  Every time I show this to people I see eyes light up and little light bulbs turn on in their brains of where they can use this.

---

Time to Get GEEKY!

Let’s say that Branch_1 and Branch_2 are on the same DMVPN tunnel with DMVPN Hub “Foxtrot14“. We’d like to apply a QoS policy from Hub to Spoke for Branch_2 but not for Branch_1.  Since they are on the same mGRE tunnel how would we do that?

Basically what we do is

• On the DMVPN Hub
  1. configure in the global config section the varying QoS policies you’d like the hub to “offer” as QoS policies for the spokes
  2. apply all the policies you are going to “offer” the spokes on the DMVPN tunnel interface via ip nhrp map group command
• On the DMVPN spoke configure the DMVPN interface with the mapped group name you’d like to have applied to it.

On The DMVPN Hub

Let’s break this down.

“1) configure in the global config section the varying QoS policies you’d like the hub to “offer” as QoS policies for the spokes”

So basically what you can see above is that we are configuring our DMVPN hub to have 5 different QoS offerings to the spokes.

1. 1.5Mbps
2. 2Mbps
3. 5Mbps
4. 10Mbps
5. Unrestricted

“2) apply all the policies you are going to “offer” the spokes on the DMVPN tunnel interface via ip nhrp map group command”

On The DMVPN Spoke

“On the DMVPN spoke configure the DMVPN interface with the mapped group name you’d like to have applied to it”

So I simply go to Echo3 (Branch_2) and put the command “ip nhrp group spoke-2Mbps” on the spoke’s tunnel interface.  

Now what happens?  Echo3 simply puts the name “spoke-2Mbps” into the NHRP registration request. Yup! Really just that simple.  Neat eh?  If you need a little refresher on NHRP registration please go to Fun in the Lab: Sniffer Tracing a DMVPN Tunnel Startup. This will show you the basics of the NHRP registration request.

Let’s see how this looks on the wire and at the DMVPN hub.

You may want to grab the actual pcap file we are going to be looking at together

dmvpn_tunnel_startup_per_tunnel_QoS.pcap        <– it is on my public dropbox and I plan to keep it there for a few years.  🙂

Ready?

We are going to be looking at Frame 18 & Frame 21 in relation to the following network and IP addresses. Tossing this in here closer to the sniffer trace so you can match up IP addresses better.  🙂

So first — frame 18. Perfectly normal looking NHRP Registration Request from Echo3 (Branch_2) until we get to the NHRP Vendor Private Extension.

Wanna get your “geek on”?

https://www.branah.com/ascii-converter

What happens after Frame 18 gets to the DMVPN Hub Foxtrot14?  Well just cause Echo3 (Branch_2) wants “spoke-2Mbps” to be applied to it doesn’t mean it is configured as an option on the hub.  So you will see frame 21 as the registration reply to the request acknowledging ‘spoke-2Mbps” in the vendor specific section again.

Now what?

Let’s go to Foxtrot14 and see what it thinks is the situation.

Coolness!  On the same mGRE tunnel we have QoS applied to the hub to spoke traffic to branch_2 but not to branch_1.

---

*NOTE: This post was originally published in 2015 on this site. It has been updated as well as reformatted.