Showing results for 
Search instead for 
Did you mean: 
Join Customer Connection to register!



I have setup a DMVPN. I have 2 DMVPN clouds, 2 hubs each terminating each cloud. At the spoke sites I have 2 routers each terminating each DMVPN.

On one of my spoke routers I am getting the following constant log

*Oct 30 00:57:45.092: %NHRP-3-PAKERROR: Received Error Indication from, code: protocol generic error(7), (trigger src: (nbma: 213.xx.xx.241) dst:, offset: 0, data: 00 01 08 00 00 00 00 00 00 FF 00 79 2B CA 00 34

The hub is

The spoke where the log appears is is an ip that does not exist any longer. I have 2 hubs, it used to exist on my other hub but no longer. 

The debug shows the following messages

*Oct 30 00:48:53.389: NHRP: Sending NHRP Resolution Request for dest: to nexthop: using our src: vrf:global(0x0)
*Oct 30 00:48:53.389: NHRP: Attempting to send packet through interface Tunnel200 via DEST dst
*Oct 30 00:48:53.390: NHRP: Send Resolution Request via Tunnel200 vrf global(0x0), packet size: 121
*Oct 30 00:48:53.390: src:, dst:
*Oct 30 00:48:53.390: NHRP: Encapsulation succeeded. Sending NHRP Control Packet NBMA Address:
*Oct 30 00:48:53.390: NHRP: 149 bytes out Tunnel200
*Oct 30 00:48:53.403: NHRP: Receive Error Indication via Tunnel200 vrf global(0x0), packet size: 161
*Oct 30 00:48:53.403: %NHRP-3-PAKERROR: Received Error Indication from, code: protocol generic error(7), (trigger src: (nbma: dst:, offset: 0, data: 00 01 08 00 00 00 00 00 00 FF 00 79 2B CC 00 34

The tunnel on the spoke is configured as :

interface Tunnel200
description ** DMVPN Tunnel over MPLS **
bandwidth 50000
ip address
no ip redirects
ip mtu 1400
ip nhrp authentication NhrpAuth
ip nhrp map 213.xx.xx.98
ip nhrp map multicast 213.xx.xx.98
ip nhrp network-id 102
ip nhrp holdtime 600
ip nhrp nhs
ip nhrp registration no-unique
ip nhrp shortcut
ip tcp adjust-mss 1360
delay 60
nhrp group SPOKE_44MBPS
performance monitor context PrmAM_AVP4_c
keepalive 10 3
tunnel source GigabitEthernet0/0/0
tunnel mode gre multipoint
tunnel key 102
tunnel vrf DMVPN2
tunnel protection ipsec profile DMVPN-PROFILE2

sh ip nhrp br

Intf NextHop Address NBMA Address
Target Network T/Flag
-------- ------------------------------------------- ------ ----------------
Tu200 D/e

sh dmvpn

Interface: Tunnel200, IPv4 NHRP Details
Type:Spoke, NHRP Peers:2,

# Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb
----- --------------- --------------- ----- -------- -----
2     213.xx.xx.245 UP 00:03:08 D
                            UP 00:03:08 D
2     213.xx.xx.98 UP 00:01:50 D
                            UP 00:44:15 S

Does anyone have any ideas what is may be. I have checked and does not exist.

paul driver
VIP Mentor


Have you tried clearing the NHRP cache?

clear ip nhrp x.x.x.x



kind regards

Please rate and mark posts accordingly if you have found any of the information provided useful.
It will hopefully assist others with similar issues in the future

Hi Paul

Yes Ive tried clearing nhrp but no luck. After further investigation I found that if I pinged an IP address in that same subnet but one that does not exist, then I would get a Pak error with the IP I tried pinging.

This meant there was something trying to get to and as it was an IP that used to be configured on my primary hub , So I carried out sh show run | inc on the routers

I found a static route on the spoke with a next hop of the which obviously was the culprit. Removed the static and no more PAK Errors

Thanks for the help