11-08-2011 08:17 AM - edited 03-04-2019 02:12 PM
Hi,
I've setup DMVPN with NHRP and got everything working yesterday after a few hours of messing back and forth
with the configuration and it just started working for some reason, but today it's back to square one again with only
one tunnel working using DMVPN (had the same problem yesterday).
So yesterday when I went home from work Tunnel14, Tunnel15, Tunnel19 were up and running,
and also Tunnel20 which isn't using DMVPN.
Today only Tunnel14 and Tunnel20 (which still isn't using DMVPN) are working.
Hub configuration:
interface Tunnel14
ip address 10.14.14.1 255.255.255.0
no ip redirects
ip mtu 1500
ip nhrp authentication XXX
ip nhrp map multicast dynamic
ip nhrp network-id 14
ip nhrp holdtime 450
ip tcp adjust-mss 1436
tunnel source xxx.xxx.xxx.xxx
tunnel mode gre multipoint
tunnel key 14
tunnel vrf internet
tunnel protection ipsec profile VTI
!
!
interface Tunnel15
ip vrf forwarding VRF15
ip address 10.15.15.1 255.255.255.0
no ip redirects
ip mtu 1500
ip nhrp authentication XXX
ip nhrp map multicast dynamic
ip nhrp network-id 15
ip nhrp holdtime 450
ip tcp adjust-mss 1436
tunnel source xxx.xxx.xxx.yyy
tunnel mode gre multipoint
tunnel key 15
tunnel vrf internet
tunnel protection ipsec profile VTI
!
!
interface Tunnel19
ip vrf forwarding VRF19
ip address 10.19.19.1 255.255.255.0
no ip redirects
ip mtu 1500
ip nhrp authentication YYY
ip nhrp map multicast dynamic
ip nhrp network-id 19
ip nhrp holdtime 450
ip tcp adjust-mss 1436
tunnel source xxx.xxx.xxx.zzz
tunnel mode gre multipoint
tunnel key 19
tunnel vrf internet
tunnel protection ipsec profile VTI
Spoke:
interface Tunnel14
ip address 10.14.14.10 255.255.255.0
no ip redirects
ip mtu 1500
ip nhrp authentication XXX
ip nhrp map 10.14.14.1 xxx.xxx.xxx.xxx
ip nhrp network-id 14
ip nhrp holdtime 450
ip nhrp nhs 10.14.14.1
ip tcp adjust-mss 1436
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 14
tunnel vrf internet
tunnel protection ipsec profile VTI
!
!
interface Tunnel15
ip vrf forwarding VRF15
ip address 10.15.15.10 255.255.255.0
no ip redirects
ip mtu 1500
ip nhrp authentication XXX
ip nhrp map 10.15.15.1 xxx.xxx.xxx.yyy
ip nhrp network-id 15
ip nhrp holdtime 450
ip nhrp nhs 10.15.15.1
ip tcp adjust-mss 1436
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 15
tunnel vrf internet
tunnel protection ipsec profile VTI
!
!
interface Tunnel19
ip vrf forwarding VRF19
ip address 10.19.19.10 255.255.255.0
no ip redirects
ip mtu 1500
ip nhrp authentication YYY
ip nhrp map 10.19.19.1 255.255.255.0 xxx.xxx.xxx.zzz
ip nhrp network-id 19
ip nhrp holdtime 450
ip nhrp nhs 10.19.19.1
ip tcp adjust-mss 1436
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key 19
tunnel vrf internet
tunnel protection ipsec profile VTI
spoke#sh ip nhrp
10.14.14.1/32 via 10.14.14.1
Tunnel14 created 00:59:50, never expire
Type: static, Flags: used
NBMA address: xxx
10.15.15.1/32 via 10.15.15.1
Tunnel15 created 00:36:29, never expire
Type: static, Flags: used
NBMA address: yyy
10.19.19.0/24 via 10.19.19.1
Tunnel19 created 00:29:35, never expire
Type: static, Flags: used
NBMA address: zzz
hub#sh ip nhrp
10.14.14.10/32 via 10.14.14.10
Tunnel14 created 01:01:22, expire 00:05:38
Type: dynamic, Flags: unique registered
NBMA address: xyz
10.19.19.10/32
Tunnel19 created 00:00:59, expire 00:02:05
Type: incomplete, Flags: negative
Cache hits: 7
Both have same IOS version:
Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.0(1)M3, RELEASE SOFTWARE (fc2)
Hub is 2921 and spoke 2911
I've edited out some IP adresses, keys etc. The spoke have also been rebooted once today (it crashed while trying to fix this).
11-17-2011 08:35 PM
We had a maintenance window and got a chance to upgrade to routers to 15.2, so I checked some config and noticed that my ipsec profiles were missing after the upgrade, and trying to add it again resulted in the following:
# tunnel protection ipsec profile XYZ
Error: All interfaces sharing this IPSec profile must be configured using the 'shared' keyword'.
Eg: tunnel protection ipsec profile foo shared
After changing the tunnels to shared they came back online again, so hopefully they will stay up now.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide