DMVPN Phase 1 uses HUB-and-spoke tunnel deployment. The tunnels through which inter-branch connections are made are only built through the central DMVPN hub and the individual spokes, working much like a traditional VPN system.
DMPVN Phase 2 uses spoke-to-spoke tunnel deployment, meaning that data doesn’t have to travel to a central hub first, so long as there are specific routes in place for the spoke subnets.
DMPVN Phase 3 allows for spoke-to-spoke tunnel deployment, but without the specific pre-made routes in place, but rather uses NHRP traffic indication messages from the hub to secure those routes on the fly.
DMVPN allows data exchanges on a secure network without the use of a headquarter’s VPN server or router. While a VPN acts as a connector between remote sites and HQ, or between different branches, the DMVPN creates a mesh VPN protocol that can be applied selectively to connections being utilized in the business already. Each different site (or spoke) can connect to one another securely. This is done using VPN firewall concentrators and routers, with DMVPN configuration on the routers in place at remote sites to allow the DMVPN mesh to be applied to the connection that it’s making at the time.
What is DMVPN?
DMVPN Cisco is, effectively, a solution that allows different branch locations using the same resources to communicate directly and safely with one another via public WAN or internet connections, rather than having to use an internal network. The way that it does this doesn’t utilize a permanent VPN connection between the various sites, but rather through a centralized architecture that can apply VPN protection and granular access controls on an as-you-need-it basis. As such, when communications are open or access has to be granted to specific digital resources, it applies the security features of a VPN on a more selective basis. DVPN also integrates modes of communication, such as the VoIP system, into the protections of a VPN.