DMVPN with dual tunnel and dual interfaces on hub router

[doug_3002]

I have a hub router that with 3 interfaces.

int 1 is used for DMVPN and so is int 3.  They are also used for IPSec RA VPN. webvpn, and port forwarding to inside servers.

int 2 is used for internet traffic.

I used VRF's to seperate int 1 and int 3 in the passed but i had issues.  So that I didnt have use inter VRF routing to solve it, i removed the VRF's and used static routes to reach the spokes for interface 1 and interface 3.  This is ok, because all the spokes use static IP's.

The spoke also have two tunnels and is sharing the ipsec profile as so:

int tun 1

tunnel protection ipsec profile PROFILE shared

!

int tun 2

tunnel protection ipsec profile PROFILE shared

The Circuit for WAN int 3 was not in yet so that interface is down.  I had issues with phase 1 and got the following debug error:

isakmp:(6803):key not found in keyrings of profile , aborting exchange

My understanding is that it was using the key, for keyring 2 and not for keyring 1...even though they are the same key.

When i removed the configs for keyring 2, phase 1 came online.

My question is, will i have issues when once the second WAN interface come online?  should i change the preshared key in keyring 2? 

[Vasilii Mikhailovskii]

Hello.

Please share your configuration on the hub router and all the debug output you gathered.

I would say, that the solution with 2 VRFs was much better, than static routes. I think if you revert the configuration back to VRF, it should work fine.

[doug_3002]

I was having issues with routing and didnt want to configure inter VRF routing to communicate between the two sites.  I dont think it will work without inter VRF routing with BGP, and i didnt want to configure that. 

[Vasilii Mikhailovskii]

Hello.

If you are using both Internet links as DMVPN transport only, then there is no need for routing between them.

Could you share your [previous] configuration with VRFs?

PS: if you want an answer for the question, I think [current] running configuration is needed here.