Hi to all!
We have this problem for about 1 or 2 month.
It's flapping almost everytime, but not on all spokes. We have on HUB in HQ connected over MPLS vlan to other spokes. Here is config of HUB router:
___________________________________________________
vrf definition IWAN-PUBLIC-ASM
description IWAN ASM
!
address-family ipv4
exit-address-family
!
key chain LAN-KEY
key 1
key-string *****
!
!
!
!
!
crypto ikev2 keyring DMVPN_CRY_ASM
peer ANY
address 0.0.0.0 0.0.0.0
pre-shared-key *****
!
!
!
crypto ikev2 profile DMVPN_IKEVPR_ASM
match fvrf IWAN-PUBLIC-ASM
match identity remote address 0.0.0.0
authentication remote pre-share
authentication local pre-share
keyring local DMVPN_CRY_ASM
!
!
crypto ipsec transform-set AES256/SHA/TRANSPORT esp-aes 256 esp-sha-hmac
mode transport
!
crypto ipsec profile DMVPN_CRYPR_ASM
set transform-set AES256/SHA/TRANSPORT
set ikev2-profile DMVPN_IKEVPR_ASM
!
interface Tunnel10
bandwidth 200000
ip address 192.168.0.1 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication *****
ip nhrp map multicast dynamic
ip nhrp network-id 101
ip nhrp holdtime 600
ip nhrp redirect
ip tcp adjust-mss 1360
delay 100
tunnel source GigabitEthernet0/0/3.1000
tunnel mode gre multipoint
tunnel key 101
tunnel path-mtu-discovery
tunnel vrf IWAN-PUBLIC-ASM
tunnel protection ipsec profile DMVPN_CRYPR_ASM
!
!
interface GigabitEthernet0/0/3.1000
description TO_BRANCHES
encapsulation dot1Q 3029
vrf forwarding IWAN-PUBLIC-ASM
ip address 192.168.255.1 255.255.255.0
!
router eigrp IWAN-EIGRP
!
address-family ipv4 unicast autonomous-system 300
!
af-interface default
passive-interface
exit-af-interface
!
af-interface Tunnel10
authentication mode md5
authentication key-chain LAN-KEY
hello-interval 20
hold-time 60
no passive-interface
no split-horizon
exit-af-interface
!
topology base
redistribute ospf 10 metric 10000 10 255 1 10000
exit-af-topology
network 192.168.0.1 0.0.0.0
nsf
exit-address-family
!
router ospf 10
router-id 172.16.0.10
redistribute eigrp 300 subnets
network 172.16.0.10 0.0.0.0 area 0
!
ip route vrf IWAN-PUBLIC-ASM 0.0.0.0 0.0.0.0 192.168.255.3
__________________________________________________
and that is config of Spoke router:
__________________________________________________
vrf definition IWAN-TRANSPORT-2
description IWAN-TRANSPORT-2
!
address-family ipv4
exit-address-family
!
!
key chain LAN-KEY
key 1
key-string *****
!
crypto ikev2 proposal IK2-Proposal
encryption aes-cbc-128
integrity sha1 md5
group 2 5
!
crypto ikev2 policy IK2-Policy
match fvrf IWAN-TRANSPORT-2
match address local 192.168.255.25
proposal IK2-Proposal
!
crypto ikev2 keyring DMVPN_CRY_ASM
peer ANY
address 0.0.0.0 0.0.0.0
pre-shared-key *****
!
!
!
crypto ikev2 profile DMVPN_IKEVPR_ASM
match fvrf IWAN-TRANSPORT-2
match identity remote address 0.0.0.0
authentication local pre-share
authentication remote pre-share
keyring local DMVPN_CRY_ASM
!
crypto ipsec transform-set AES256/SHA/TRANSPORT esp-aes 256 esp-sha-hmac
mode transport
!
crypto ipsec profile DMVPN_CRYPR_ASM
set transform-set AES256/SHA/TRANSPORT
set ikev2-profile DMVPN_IKEVPR_ASM
!
!
!
interface Tunnel1
bandwidth 100000
ip address 192.168.0.11 255.255.255.0
no ip redirects
ip mtu 1400
ip nhrp authentication *****
ip nhrp network-id 101
ip nhrp holdtime 600
ip nhrp nhs 19.168.0.1 nbma 192.168.255.1 multicast
ip nhrp registration no-unique
ip nhrp shortcut
ip tcp adjust-mss 1360
delay 10
if-state nhrp
tunnel source GigabitEthernet0/0/0.1000
tunnel mode gre multipoint
tunnel key 101
tunnel path-mtu-discovery
tunnel vrf IWAN-TRANSPORT-2
tunnel protection ipsec profile DMVPN_CRYPR_ASM
!
interface GigabitEthernet0/0/0.1000
encapsulation dot1Q 3029
vrf forwarding IWAN-TRANSPORT-2
ip address 192.168.255.11 255.255.255.0
no ip proxy-arp
no cdp enable
!
!
router eigrp IWAN-EIGRP
!
address-family ipv4 unicast autonomous-system 300
!
af-interface default
passive-interface
exit-af-interface
!
af-interface Tunnel1
authentication mode md5
authentication key-chain LAN-KEY
hello-interval 20
hold-time 60
no passive-interface
no split-horizon
exit-af-interface
!
topology base
exit-af-topology
network 192.168.0.11 0.0.0.0
exit-address-family
!
ip route vrf IWAN-TRANSPORT-2 0.0.0.0 0.0.0.0 192.168.255.1
_____________________________________________________
We have such kind of problem, I'll share logs with you too:
on HUB:
Sep 9 11:59:30.683: EIGRP: Build goodbye tlv for 192.168.0.12
Sep 9 12:01:28.759: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.7 (Tunnel10) is down: holding time expired
Sep 9 12:01:28.762: EIGRP: Build goodbye tlv for 192.168.0.7
Sep 9 12:02:25.448: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.11 (Tunnel10) is down: peer restarted
Sep 9 12:02:45.465: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.11 (Tunnel10) is up: new adjacency
Sep 9 12:03:07.661: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.6 (Tunnel10) is down: holding time expired
Sep 9 12:03:07.665: EIGRP: Build goodbye tlv for 192.168.0.6
Sep 9 12:03:45.559: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.11 (Tunnel10) is down: holding time expired
Sep 9 12:03:45.563: EIGRP: Build goodbye tlv for 192.168.0.11
Sep 9 12:03:52.299: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.11 (Tunnel10) is up: new adjacency
Sep 9 12:04:02.124: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.7 (Tunnel10) is up: new adjacency
Sep 9 12:04:39.693: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.12 (Tunnel10) is up: new adjacency
Sep 9 12:04:52.303: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.11 (Tunnel10) is down: holding time expired
Sep 9 12:04:52.305: EIGRP: Build goodbye tlv for 192.168.0.11
Sep 9 12:05:45.414: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.11 (Tunnel10) is up: new adjacency
Sep 9 12:06:07.439: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.11 (Tunnel10) is down: peer restarted
Sep 9 12:06:45.175: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.11 (Tunnel10) is up: new adjacency
Sep 9 12:08:42.221: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.6 (Tunnel10) is up: new adjacency
Sep 9 12:08:42.228: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.12 (Tunnel10) is down: peer restarted
Sep 9 12:10:16.217: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.12 (Tunnel10) is up: new adjacency
Sep 9 12:13:13.533: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.14 (Tunnel10) is down: holding time expired
Sep 9 12:13:13.536: EIGRP: Build goodbye tlv for 192.168.0.14
Sep 9 12:14:33.560: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.12 (Tunnel10) is down: holding time expired
Sep 9 12:14:33.563: EIGRP: Build goodbye tlv for 192.168.0.12
Sep 9 12:14:33.568: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.7 (Tunnel10) is down: peer restarted
Sep 9 12:14:43.100: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.11 (Tunnel10) is down: holding time expired
Sep 9 12:14:43.107: EIGRP: Build goodbye tlv for 192.168.0.11
Sep 9 12:14:52.276: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.7 (Tunnel10) is up: new adjacency
Sep 9 12:15:06.627: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.14 (Tunnel10) is up: new adjacency
Sep 9 12:15:26.654: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.11 (Tunnel10) is up: new adjacency
Sep 9 12:15:48.672: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.11 (Tunnel10) is down: peer restarted
Sep 9 12:16:08.234: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.11 (Tunnel10) is up: new adjacency
Sep 9 12:16:25.445: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.12 (Tunnel10) is up: new adjacency
Sep 9 12:16:28.686: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.6 (Tunnel10) is down: holding time expired
Sep 9 12:16:28.690: EIGRP: Build goodbye tlv for 192.168.0.6
on SPOKE:
.Sep 9 12:32:14.147: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
.Sep 9 12:32:21.893: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.1 (Tunnel1) is up: new adjacency
.Sep 9 12:32:24.147: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
.Sep 9 12:32:24.148: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.1 (Tunnel1) is down: interface down
.Sep 9 12:32:34.172: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
.Sep 9 12:32:41.909: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.1 (Tunnel1) is up: new adjacency
.Sep 9 12:32:44.173: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
.Sep 9 12:32:44.175: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.1 (Tunnel1) is down: interface down
.Sep 9 12:56:54.183: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
.Sep 9 12:56:54.516: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.1 (Tunnel1) is up: new adjacency
.Sep 9 12:57:04.183: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
.Sep 9 12:57:04.184: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.1 (Tunnel1) is down: interface down
.Sep 9 12:57:14.209: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
.Sep 9 12:57:14.534: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.1 (Tunnel1) is up: new adjacency
.Sep 9 13:00:44.211: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
.Sep 9 13:00:44.214: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.1 (Tunnel1) is down: interface down
.Sep 9 13:10:14.218: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
.Sep 9 13:10:14.290: %DUAL-5-NBRCHANGE: EIGRP-IPv4 300: Neighbor 192.168.0.1 (Tunnel1) is up: new adjacency
Maybe anybody has seen this problem? We have researched almost everywhere, even in this forum, but haven't found good solution.
