DMVPN Spoke not connecting when using starlink

[Wizard4777]

I have set up as above. I am using starlink at one of my spokes. I am not able to get to pass VPN traffic even though show dmvpn shows that the vpn is up. 

[MHM Cisco World]

Share 

Show dmvpn detail 

In spoke you have issue with 

MHM

[Wizard4777]

On the hub, I can see that the tunnel is up but I am unable to ping the Spoke tunnel IP: 172.29.255.201

[Wizard4777]

I have a single hub and multiple spokes but with this spoke, i want to use to ISP and one is starlink. I created two tunnels on spoke and used shared tunnel protection. one tunnel for the other ISP and one tunnel for starlink, both to be connected to the single tunnel dmvpn hub.

[Georg Pauwen]

Hello,

post the running configs of your hub and spoke routers...

[Wizard4777]

only one router is affected when connection is pushed through starlink. when pushed through other ISP no issues. so config is definitely not the issue.

[Georg Pauwen]

Hello,

post the spoke config anyway, as we do not know what you have configured (Phase 1/2/3, which underlying routing, etc.), we may spot something. Starlink uses TCP spoofing optimization; if you use the default policy, you are also dealing with CGNAT. Are you using a 100.64.0.0/10 IP address (which means you are using the default policy) ?

[MHM Cisco World]

flags is DN meaning dyanimc NAT 

And the claimed IP appear' this good indication that hub detect behind NAT spoke'

Last steps is you need to use 

Ipsec transfers AH no ESP 

Also you need to use trabsport mode not tunnel mode.

MHM

[Wizard4777]

does that mean i change the hub also to AH? using transport mode

[MHM Cisco World]

In spoke add AH and transport 

In Hub add AH only as second ipsec trans' 

This make hub work with spoke use esp and spoke use AH with transport 

MHM

[Wizard4777]

can you provide me a sample config for this? i don't seem to get what you mean.

[MHM Cisco World]

Hub config 

Crypto ipsec trans spoke1 esp- 

Mode tunnel 

!

Crypto ipsec trans AH- 

Mode transport 

In Spoke1 (behind NAT)

Crypto ipsec trans AH- 

Mode transport 

In Spoke2 (not behind NAT)

Crypto ipsec trans ESP-

Mode tunnel 

MHM

[Wizard4777]

Thank you. I will keep this for future reference

[Wizard4777 · Accepted solution]

I have resolved this issue by just removing the tunnel interface and pasting the same config back recreating the tunnel interface.

[MHM Cisco World]

without AH and transport ??

MHM