cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2031
Views
5
Helpful
1
Replies

DMVPN/NHRP problem, tunnels come online sometimes

magnus.maatta
Level 1
Level 1

Hi,

I've setup DMVPN with NHRP and got everything working yesterday after a few hours of messing back and forth

with the configuration and it just started working for some reason, but today it's back to square one again with only

one tunnel working using DMVPN (had the same problem yesterday).

So yesterday when I went home from work Tunnel14, Tunnel15, Tunnel19 were up and running,

and also Tunnel20 which isn't using DMVPN.

Today only Tunnel14 and Tunnel20 (which still isn't using DMVPN) are working.

Hub configuration:

interface Tunnel14

ip address 10.14.14.1 255.255.255.0

no ip redirects

ip mtu 1500

ip nhrp authentication XXX

ip nhrp map multicast dynamic

ip nhrp network-id 14

ip nhrp holdtime 450

ip tcp adjust-mss 1436

tunnel source xxx.xxx.xxx.xxx

tunnel mode gre multipoint

tunnel key 14

tunnel vrf internet

tunnel protection ipsec profile VTI

!

!

interface Tunnel15

ip vrf forwarding VRF15

ip address 10.15.15.1 255.255.255.0

no ip redirects

ip mtu 1500

ip nhrp authentication XXX

ip nhrp map multicast dynamic

ip nhrp network-id 15

ip nhrp holdtime 450

ip tcp adjust-mss 1436

tunnel source xxx.xxx.xxx.yyy

tunnel mode gre multipoint

tunnel key 15

tunnel vrf internet

tunnel protection ipsec profile VTI

!       

!        

interface Tunnel19

ip vrf forwarding VRF19

ip address 10.19.19.1 255.255.255.0

no ip redirects

ip mtu 1500

ip nhrp authentication YYY

ip nhrp map multicast dynamic

ip nhrp network-id 19

ip nhrp holdtime 450

ip tcp adjust-mss 1436

tunnel source xxx.xxx.xxx.zzz

tunnel mode gre multipoint

tunnel key 19

tunnel vrf internet

tunnel protection ipsec profile VTI

Spoke:

interface Tunnel14

ip address 10.14.14.10 255.255.255.0

no ip redirects

ip mtu 1500

ip nhrp authentication XXX

ip nhrp map 10.14.14.1 xxx.xxx.xxx.xxx

ip nhrp network-id 14

ip nhrp holdtime 450

ip nhrp nhs 10.14.14.1

ip tcp adjust-mss 1436

tunnel source GigabitEthernet0/0

tunnel mode gre multipoint

tunnel key 14

tunnel vrf internet

tunnel protection ipsec profile VTI

!

!

interface Tunnel15

ip vrf forwarding VRF15

ip address 10.15.15.10 255.255.255.0

no ip redirects

ip mtu 1500

ip nhrp authentication XXX

ip nhrp map 10.15.15.1 xxx.xxx.xxx.yyy

ip nhrp network-id 15

ip nhrp holdtime 450

ip nhrp nhs 10.15.15.1

ip tcp adjust-mss 1436

tunnel source GigabitEthernet0/0

tunnel mode gre multipoint

tunnel key 15

tunnel vrf internet

tunnel protection ipsec profile VTI

!

!

interface Tunnel19

ip vrf forwarding VRF19

ip address 10.19.19.10 255.255.255.0

no ip redirects

ip mtu 1500

ip nhrp authentication YYY

ip nhrp map 10.19.19.1 255.255.255.0 xxx.xxx.xxx.zzz

ip nhrp network-id 19

ip nhrp holdtime 450

ip nhrp nhs 10.19.19.1

ip tcp adjust-mss 1436

tunnel source GigabitEthernet0/0

tunnel mode gre multipoint

tunnel key 19

tunnel vrf internet

tunnel protection ipsec profile VTI

spoke#sh ip nhrp

10.14.14.1/32 via 10.14.14.1

   Tunnel14 created 00:59:50, never expire

   Type: static, Flags: used

   NBMA address: xxx

10.15.15.1/32 via 10.15.15.1

   Tunnel15 created 00:36:29, never expire

   Type: static, Flags: used

   NBMA address: yyy

10.19.19.0/24 via 10.19.19.1

   Tunnel19 created 00:29:35, never expire

   Type: static, Flags: used

   NBMA address: zzz

hub#sh ip nhrp

10.14.14.10/32 via 10.14.14.10

   Tunnel14 created 01:01:22, expire 00:05:38

   Type: dynamic, Flags: unique registered

   NBMA address: xyz

10.19.19.10/32

   Tunnel19 created 00:00:59, expire 00:02:05

   Type: incomplete, Flags: negative

   Cache hits: 7

Both have same IOS version:

Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.0(1)M3, RELEASE SOFTWARE (fc2)

Hub is 2921 and spoke 2911

I've edited out some IP adresses, keys etc. The spoke have also been rebooted once today (it crashed while trying to fix this).

1 Reply 1

magnus.maatta
Level 1
Level 1

We had a maintenance window and got a chance to upgrade to routers to 15.2, so I checked some config and noticed that my ipsec profiles were missing after the upgrade, and trying to add it again resulted in the following:

# tunnel protection ipsec profile XYZ

Error: All interfaces sharing this IPSec profile must be configured using the 'shared' keyword'.

Eg: tunnel protection ipsec profile foo shared

After changing the tunnels to shared they came back online again, so hopefully they will stay up now.

Review Cisco Networking for a $25 gift card