Two providers of the Internet on the scheme DMVPN - dilution on different VRF on Spoke-ah

I want to describe the scheme with DMVPN, built in our organization, which allows using an unlimited number of communication channels at a remote point through the Public Internet along with the IPVPN channel from one of several providers.

What is: a built DMVPN scheme with (mainly) two communication channels. The main one is IPVPN (with guaranteed speed) from one of the providers, the backup one is Public Internet (any, maybe even a 3G \ LTE router) from another provider.

The scheme of what was:
')


Task: connect another backup channel through a third-party Internet provider.

Let's start with the configuration of the central hubs. There is a tunnel interface:

interface Tunnel0 description ==== HUB for DMVPN (INET) ==== ip address XXX.XXX.11.XXX 255.255.255.0 no ip redirects ip mtu 1400 ip pim nbma-mode ip nhrp authentication XYZXYZ ip nhrp map multicast dynamic //    ip nhrp network-id <b>11111</b> ip nhrp holdtime 600 ip nhrp shortcut ip nhrp redirect ip summary-address eigrp 77 10.0.0.0 255.0.0.0 ip summary-address eigrp 77 172.16.0.0 255.240.0.0 ip summary-address eigrp 77 192.168.0.0 255.255.0.0 ip tcp adjust-mss 1320 load-interval 30 <b>delay 10000</b> tunnel source <Internet Interface> tunnel mode gre multipoint tunnel key 999999 tunnel vrf INET //  shared  tunnel protection ipsec profile DMVPN_INET <b>shared</b> 

Create another tunnel interface with a different addressing so as not to overlap:

 interface Tunnel3 description ==== HUB for DMVPN (INET2) ==== ip address ..12. 255.255.255.0 no ip redirects ip mtu 1400 ip pim nbma-mode ip nhrp authentication XYZXYZ ip nhrp map multicast dynamic //    ip nhrp network-id <b>22222</b> ip nhrp holdtime 600 ip nhrp shortcut ip nhrp redirect ip summary-address eigrp 77 10.0.0.0 255.0.0.0 ip summary-address eigrp 77 172.16.0.0 255.240.0.0 ip summary-address eigrp 77 192.168.0.0 255.255.0.0 ip tcp adjust-mss 1320 load-interval 30 <b> delay 1000</b> tunnel source Port-channel1.501 tunnel mode gre multipoint tunnel key 888888 tunnel vrf INET //  shared  tunnel protection ipsec profile DMVPN_INET <b>shared</b> 

At a remote point, two different Public Internet channels are divorced along two different VRFs and are assigned a Static Route in each VRF:

 ip vrf INET1 rd 10:10 ! ip vrf INET2 rd 100:100 crypto ipsec profile DMVPN set transform-set AES256-SHA set pfs group2 ! crypto ipsec profile DMVPN2 set transform-set AES256-SHA set pfs group2 interface Tunnel0 ip address XXX.XXX.11.XXX 255.255.255.0 no ip redirects ip mtu 1400 ip hello-interval eigrp 77 4 ip flow ingress ip flow egress ip nhrp network-id 11111 ip nhrp holdtime 300 ip nhrp shortcut ip nhrp redirect ip tcp adjust-mss 1360 load-interval 30 <b>delay 10 </b> if-state nhrp tunnel source <Internet Interface1> tunnel mode gre multipoint tunnel key 999999 tunnel vrf INET1 tunnel protection ipsec profile DMVPN ! interface Tunnel1 ip address XXX.XXX.12.XXX 255.255.255.0 no ip redirects ip mtu 1400 ip hello-interval eigrp 77 4 ip nhrp authentication XYZXYZ ip nhrp network-id 22222 ip nhrp holdtime 300 ip nhrp shortcut ip nhrp redirect ip tcp adjust-mss 1320 load-interval 30 <b> delay 5000</b> if-state nhrp tunnel source <Internet Interface2> tunnel mode gre multipoint tunnel key 888888 tunnel vrf INET2 tunnel protection ipsec profile DMVPN2 router eigrp 77 network XXX.XXX.11.XXX network XXX.XXX.12.XXX exit ip route vrf INET1 0.0.0.0 0.0.0.0 <Internet Interface1> <GW Address1> name INET1 ip route vrf INET2 0.0.0.0 0.0.0.0 <Internet Interface2> <GW Address2> name INET2 

The choice of a channel for data transmission is governed by the Bandwidth and Delay parameters in interface Tunnel X.

What became:


Thus, we can connect an unlimited number of channels to reserve a point.

This is extremely convenient for organizing the redundancy of communication loss on any of the number of channels and is very convenient / fast for connecting a new channel, for example, via a 3G / LTE mobile router.