EIGRP learning routes from slower WAN connection

[Amills]

I got 2 WAN connections coming into a ISR4331 router, one is cable at 10Mbps and the other is a fiber 500Mbps link. 

Without any metric modification EIGRP always learns its routes from tunnel 14, the cable WAN connection at 10Mbps. 

I've even set on the hub routers a delay of 50000 on the tunnel interfaces and setup offset lists and configured crazy high delay of 8000 but it keeps choosing to learn routes from the slower tunnel 14.

It isn't until I set a delay of 5000 on the tunnel 14 of the spoke site it will learn its routes from tunnel 11. Why do I have to set such a crazy high delay for a 10Mbps link?? Shouldn't it prefer the 500Mbps link?! 

The other thing is both HUBS are learning the routes for the spoke through tunnel 14 as well. Everything should go through tunnel 11 from the spoke site to the hubs as that is the faster connection.

Why would EIGRP choose the slowest connection? 

SPOKE SITE

#################################

version 16.9
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname SPOKE-SITE
!

!
key chain KEY
key 1
key-string 123456789
!

!
!
!
!

!
interface Tunnel11
description DMVPN: INET
bandwidth 512000
ip address .x.x.x. x.x.x.x
no ip redirects
ip mtu 1400
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-mode
ip nhrp authentication x
ip nhrp network-id 11
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip nhrp redirect
ip tcp adjust-mss 1360
load-interval 30
nhrp group RS-GROUP-500MBPS
no nhrp route-watch
if-state nhrp
tunnel source GigabitEthernet0/0/2
tunnel mode gre multipoint
tunnel key 11
tunnel vrf INET
tunnel protection ipsec profile DMVPN-IPSEC-PROFILE-INET
!
interface Tunnel14
description DMVPN-INET
bandwidth 10240
ip address .x.x.x. x.x.x.x
no ip redirects
ip mtu 1400
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-mode
ip nhrp authentication x
ip nhrp network-id 14
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip tcp adjust-mss 1360
load-interval 30
delay 2000
nhrp group RS-GROUP-10MBPS
no nhrp route-watch
if-state nhrp
tunnel source GigabitEthernet0/0/1
tunnel mode gre multipoint
tunnel key 14
tunnel vrf INET2
tunnel protection ipsec profile DMVPN-IPSEC-PROFILE-INET2

!

interface GigabitEthernet0/0/1
description WAN: CABLE INTERNET 10MBPS
bandwidth 10240
vrf forwarding INET2
ip address x.x.x.x x.x.x.x
negotiation auto
service-policy output IWAN-INTERFACE-10MB
!
interface GigabitEthernet0/0/2
description FIBER INTERNET 500MBPS
bandwidth 512000
vrf forwarding INET
ip address x.x.x.x x.x.x.x
negotiation auto
service-policy output IWAN-INTERFACE-500MB
!

router eigrp IWAN-EIGRP
!
address-family ipv4 unicast autonomous-system 100
!
af-interface default
passive-interface
exit-af-interface
!
af-interface Tunnel11
authentication mode md5
authentication key-chain KEY
hello-interval 30
hold-time 90
no passive-interface
stub-site wan-interface
exit-af-interface
!
af-interface Tunnel14
authentication mode md5
authentication key-chain KEY
hello-interval 30
hold-time 90
no passive-interface
stub-site wan-interface
exit-af-interface
!
topology base
exit-af-topology
network x.x.x.x 
network x.x.x.x 
network x.x.x.x.0 
network x.x.x.x 
eigrp router-id x.x.x.x
eigrp stub-site 100:5
exit-address-family
!

ip route vrf INET 0.0.0.0 0.0.0.0 x.x.x.x
ip route vrf INET2 0.0.0.0 0.0.0.0 x.x.x.x

!

HUB1 
############################

!
version 16.9
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
platform qos port-channel-aggregate 30
platform hardware throughput level 300000
!
hostname HUB1

!
!

key chain KEY
key 1
key-string 123456789

!
!
!

!
interface Port-channel30
description Link to
vrf forwarding INET
ip address x.x.x.x
no negotiation auto
!
interface Tunnel11
description DMVPN: INTERNET
bandwidth 1000000
ip address x.x.x.x
no ip redirects
ip mtu 1400
no ip split-horizon eigrp 100
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-dense-mode
ip nhrp authentication
ip nhrp network-id 11
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip nhrp redirect
ip tcp adjust-mss 1360
load-interval 30
nhrp map group RS-GROUP-75MBPS service-policy output RS-GROUP-75MBPS-POLICY
nhrp map group RS-GROUP-50MBPS service-policy output RS-GROUP-50MBPS-POLICY
nhrp map group RS-GROUP-20MBPS service-policy output RS-GROUP-20MBPS-POLICY
nhrp map group RS-GROUP-10MBPS service-policy output RS-GROUP-10MBPS-POLICY
nhrp map group RS-GROUP-7MBPS service-policy output RS-GROUP-7MBPS-POLICY
nhrp map group RS-GROUP-5MBPS service-policy output RS-GROUP-5MBPS-POLICY
nhrp map group RS-GROUP-16MBPS service-policy output RS-GROUP-16MBPS-POLICY
nhrp map group RS-GROUP-3MBPS service-policy output RS-GROUP-3MBPS-POLICY
nhrp map group RS-GROUP-150MBPS service-policy output RS-GROUP-150MBPS-POLICY
nhrp map group RS-GROUP-100MBPS service-policy output RS-GROUP-100MBPS-POLICY
nhrp map group RS-GROUP-6MBPS service-policy output RS-GROUP-6MBPS-POLICY
nhrp map group RS-GROUP-25MBPS service-policy output RS-GROUP-25MBPS-POLICY
nhrp map group RS-GROUP-1.5MBPS service-policy output RS-GROUP-1.5MBPS-POLICY
nhrp map group RS-GROUP-60MBPS service-policy output RS-GROUP-60MBPS-POLICY
nhrp map group RS-GROUP-9MBPS service-policy output RS-GROUP-9MBPS-POLICY
nhrp map group RS-GROUP-35MBPS service-policy output RS-GROUP-35MBPS-POLICY
nhrp map group RS-GROUP-40MBPS service-policy output RS-GROUP-40MBPS-POLICY
nhrp map group RS-GROUP-45MBPS service-policy output RS-GROUP-45MBPS-POLICY
nhrp map group RS-GROUP-200MBPS service-policy output RS-GROUP-200MBPS-POLICY
nhrp map group RS-GROUP-500MBPS service-policy output RS-GROUP-500MBPS-POLICY
tunnel source Port-channel30
tunnel mode gre multipoint
tunnel key 11
tunnel vrf INET
tunnel protection ipsec profile DMVPN-IPSEC-PROFILE-TUN11
!
interface Tunnel14
description DMVPN: INTERNET
bandwidth 1000000
ip address x.x.x.x
no ip redirects
ip mtu 1400
no ip split-horizon eigrp 100
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-dense-mode
ip nhrp authentication
ip nhrp network-id 14
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast <-- HUB2
ip nhrp redirect
ip tcp adjust-mss 1360
load-interval 30
delay 50000
nhrp map group RS-GROUP-75MBPS service-policy output RS-GROUP-75MBPS-POLICY
nhrp map group RS-GROUP-50MBPS service-policy output RS-GROUP-50MBPS-POLICY
nhrp map group RS-GROUP-20MBPS service-policy output RS-GROUP-20MBPS-POLICY
nhrp map group RS-GROUP-10MBPS service-policy output RS-GROUP-10MBPS-POLICY
nhrp map group RS-GROUP-7MBPS service-policy output RS-GROUP-7MBPS-POLICY
nhrp map group RS-GROUP-5MBPS service-policy output RS-GROUP-5MBPS-POLICY
nhrp map group RS-GROUP-16MBPS service-policy output RS-GROUP-16MBPS-POLICY
nhrp map group RS-GROUP-3MBPS service-policy output RS-GROUP-3MBPS-POLICY
nhrp map group RS-GROUP-150MBPS service-policy output RS-GROUP-150MBPS-POLICY
nhrp map group RS-GROUP-100MBPS service-policy output RS-GROUP-100MBPS-POLICY
nhrp map group RS-GROUP-6MBPS service-policy output RS-GROUP-6MBPS-POLICY
nhrp map group RS-GROUP-25MBPS service-policy output RS-GROUP-25MBPS-POLICY
nhrp map group RS-GROUP-1.5MBPS service-policy output RS-GROUP-1.5MBPS-POLICY
nhrp map group RS-GROUP-60MBPS service-policy output RS-GROUP-60MBPS-POLICY
nhrp map group RS-GROUP-9MBPS service-policy output RS-GROUP-9MBPS-POLICY
nhrp map group RS-GROUP-35MBPS service-policy output RS-GROUP-35MBPS-POLICY
nhrp map group RS-GROUP-40MBPS service-policy output RS-GROUP-40MBPS-POLICY
nhrp map group RS-GROUP-45MBPS service-policy output RS-GROUP-45MBPS-POLICY
nhrp map group RS-GROUP-500MBPS service-policy output RS-GROUP-500MBPS-POLICY
tunnel source Port-channel30
tunnel mode gre multipoint
tunnel key 14
tunnel vrf INET
tunnel protection ipsec profile DMVPN-IPSEC-PROFILE-TUN14

!
interface GigabitEthernet0/0/1
description Link to
vrf forwarding INET
no ip address
negotiation auto
channel-group 30 mode active
service-policy output IWAN-INTERFACE-1000MB
!

interface GigabitEthernet0/1/0
description Link to
vrf forwarding INET
no ip address
negotiation auto
channel-group 30 mode active
service-policy output IWAN-INTERFACE-1000MB

!
router eigrp IWAN-EIGRP
!
address-family ipv4 unicast autonomous-system 100
!
af-interface default
passive-interface
exit-af-interface
!
af-interface Tunnel11
authentication mode md5
authentication key-chain KEY
hello-interval 30
hold-time 90
no next-hop-self
no passive-interface
no split-horizon
exit-af-interface
!
af-interface Tunnel14
authentication mode md5
authentication key-chain KEY
hello-interval 30
hold-time 90
no next-hop-self
no passive-interface
no split-horizon
exit-af-interface
!
topology base
offset-list 99 out 10000 Tunnel14
exit-af-topology
network x.x.x.x

eigrp router-id x.x.x.x
exit-address-family
!

ip route vrf INET 0.0.0.0 0.0.0.0 x.x.x.x
ip route vrf INET2 0.0.0.0 0.0.0.0 x.x.x.x

access-list 99 permit 0.0.0.0
access-list 99 permit 10.0.0.0 0.255.255.255
access-list 99 permit 192.168.0.0 0.0.255.255
access-list 99 permit 172.16.0.0 0.0.255.255

HUB2
####################

version 16.9
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname HUB2
!
!
key chain KEY
key 1
key-string 123456789

!
!
!
!
!

interface Tunnel11
description DMVPN: INTERNET
bandwidth 1000000
ip address x.x.x.x
no ip redirects
ip mtu 1400
no ip split-horizon eigrp 100
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-dense-mode
ip nhrp authentication x
ip nhrp network-id 11
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast <--HUB1
ip nhrp redirect
ip summary-address eigrp 100 0.0.0.0 0.0.0.0
ip tcp adjust-mss 1360
load-interval 30
nhrp map group RS-GROUP-75MBPS service-policy output RS-GROUP-75MBPS-POLICY
nhrp map group RS-GROUP-50MBPS service-policy output RS-GROUP-50MBPS-POLICY
nhrp map group RS-GROUP-20MBPS service-policy output RS-GROUP-20MBPS-POLICY
nhrp map group RS-GROUP-10MBPS service-policy output RS-GROUP-10MBPS-POLICY
nhrp map group RS-GROUP-7MBPS service-policy output RS-GROUP-7MBPS-POLICY
nhrp map group RS-GROUP-5MBPS service-policy output RS-GROUP-5MBPS-POLICY
nhrp map group RS-GROUP-16MBPS service-policy output RS-GROUP-16MBPS-POLICY
nhrp map group RS-GROUP-3MBPS service-policy output RS-GROUP-3MBPS-POLICY
nhrp map group RS-GROUP-150MBPS service-policy output RS-GROUP-150MBPS-POLICY
nhrp map group RS-GROUP-100MBPS service-policy output RS-GROUP-100MBPS-POLICY
nhrp map group RS-GROUP-6MBPS service-policy output RS-GROUP-6MBPS-POLICY
nhrp map group RS-GROUP-25MBPS service-policy output RS-GROUP-25MBPS-POLICY
nhrp map group RS-GROUP-1.5MBPS service-policy output RS-GROUP-1.5MBPS-POLICY
nhrp map group RS-GROUP-60MBPS service-policy output RS-GROUP-60MBPS-POLICY
nhrp map group RS-GROUP-9MBPS service-policy output RS-GROUP-9MBPS-POLICY
nhrp map group RS-GROUP-35MBPS service-policy output RS-GROUP-35MBPS-POLICY
nhrp map group RS-GROUP-40MBPS service-policy output RS-GROUP-40MBPS-POLICY
nhrp map group RS-GROUP-45MBPS service-policy output RS-GROUP-45MBPS-POLICY
nhrp map group RS-GROUP-200MBPS service-policy output RS-GROUP-200MBPS-POLICY
nhrp map group RS-GROUP-500MBPS service-policy output RS-GROUP-500MBPS-POLICY
tunnel source GigabitEthernet0/0/2
tunnel mode gre multipoint
tunnel key 11
tunnel vrf INET
tunnel protection ipsec profile DMVPN-IPSEC-PROFILE-INET
!
interface Tunnel14
description DMVPN: INTERNET
bandwidth 1000000
ip address x.x.x.x
no ip redirects
ip mtu 1400
no ip split-horizon eigrp 100
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-dense-mode
ip nhrp authentication
ip nhrp network-id 14
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip nhrp redirect
ip tcp adjust-mss 1360
load-interval 30
delay 50000
nhrp map group RS-GROUP-75MBPS service-policy output RS-GROUP-75MBPS-POLICY
nhrp map group RS-GROUP-50MBPS service-policy output RS-GROUP-50MBPS-POLICY
nhrp map group RS-GROUP-20MBPS service-policy output RS-GROUP-20MBPS-POLICY
nhrp map group RS-GROUP-10MBPS service-policy output RS-GROUP-10MBPS-POLICY
nhrp map group RS-GROUP-7MBPS service-policy output RS-GROUP-7MBPS-POLICY
nhrp map group RS-GROUP-5MBPS service-policy output RS-GROUP-5MBPS-POLICY
nhrp map group RS-GROUP-16MBPS service-policy output RS-GROUP-16MBPS-POLICY
nhrp map group RS-GROUP-3MBPS service-policy output RS-GROUP-3MBPS-POLICY
nhrp map group RS-GROUP-150MBPS service-policy output RS-GROUP-150MBPS-POLICY
nhrp map group RS-GROUP-100MBPS service-policy output RS-GROUP-100MBPS-POLICY
nhrp map group RS-GROUP-6MBPS service-policy output RS-GROUP-6MBPS-POLICY
nhrp map group RS-GROUP-25MBPS service-policy output RS-GROUP-25MBPS-POLICY
nhrp map group RS-GROUP-1.5MBPS service-policy output RS-GROUP-1.5MBPS-POLICY
nhrp map group RS-GROUP-60MBPS service-policy output RS-GROUP-60MBPS-POLICY
nhrp map group RS-GROUP-9MBPS service-policy output RS-GROUP-9MBPS-POLICY
nhrp map group RS-GROUP-35MBPS service-policy output RS-GROUP-35MBPS-POLICY
nhrp map group RS-GROUP-40MBPS service-policy output RS-GROUP-40MBPS-POLICY
nhrp map group RS-GROUP-45MBPS service-policy output RS-GROUP-45MBPS-POLICY
nhrp map group RS-GROUP-500MBPS service-policy output RS-GROUP-500MBPS-POLICY
tunnel source GigabitEthernet0/0/3
tunnel mode gre multipoint
tunnel key 14
tunnel vrf INET2
tunnel protection ipsec profile DMVPN-IPSEC-PROFILE-INET2
!

interface GigabitEthernet0/0/2
description WAN: Internet via DMZ
vrf forwarding INET
ip address x.x.x.x
negotiation auto
service-policy output IWAN-INTERFACE-1000MB
!
interface GigabitEthernet0/0/3
description WAN: Internet via DMZ
vrf forwarding INET2
ip address x.x.x.x
negotiation auto
service-policy output IWAN-INTERFACE-1000MB

router eigrp IWAN-EIGRP
!
address-family ipv4 unicast autonomous-system 100
!
af-interface Tunnel11
authentication mode md5
authentication key-chain KEY
hello-interval 30
hold-time 90
no next-hop-self
no passive-interface
no split-horizon
exit-af-interface
!
af-interface Tunnel14
authentication mode md5
authentication key-chain KEY
hello-interval 30
hold-time 90
no next-hop-self
no passive-interface
no split-horizon
exit-af-interface
!
topology base
offset-list 99 out 10000 Tunnel14
exit-af-topology
network x.x.x.x
eigrp router-id x.x.x.x
exit-address-family
!

ip route vrf INET 0.0.0.0 0.0.0.0 x.x.x.x
ip route vrf INET2 0.0.0.0 0.0.0.0 x.x.x.x

access-list 99 permit 0.0.0.0
access-list 99 permit 10.0.0.0 0.255.255.255
access-list 99 permit 192.168.0.0 0.0.255.255
access-list 99 permit 172.16.0.0 0.0.255.255
access-list 99 permit 172.20.0.0 0.0.255.255
!

[David Ruess]

Hello,

Eigrp by default uses the slowest bandwidth in the path as part of its metric. So while you have links with different BW configurations, further down the line your faster link could be worse because whoever is advertising the route to you could have set high delays or low BW on your incoming high BW link (something you don’t have visibility on)

can you do a show ip eigrp topology all-links

Added-can you also provide a diagram of how devices are connected please.

-David

[Georg Pauwen]

Hello,

I agree with @David Ruess , a topology diagram as well as the full running configurations (sh run) would be useful in order to lab this up. Is this supposed to be a Phase 3 DMVPN ?

[Amills]

I cannot provide full running configs as that would be a security risk. The configs I posted I removed passwords, IP addressing and the DMVPN configuration. 

[David Ruess]

Thank you for the diagram. I am looking the diagram now. Can you provide the out put of the command:

show ip eigrp topology all-links for all 3 devices?

This command will show the metrics EIGRP has calculated and where it learned it from (Tunnel11 or Tunnel14) to determine why its using the link less desirable.

-David

[Amills]

Here are the configs, only the IPs and passwords are removed. I am hesitant to provide IPs, you guys think I'm being overly cautious?

[David Ruess]

Not putting your IP addresses on the internet is not being overly cautious. While we are here to help you, you don't know anyone and I would not provide them to outsiders, especially on a public forum. That in mind our troubleshooting ability is limited by that fact alone.

According to your statement they will learn the routes through Tunnel 11 once the metrics are adjusted. With that information it seems like routes are able to access both tunnels eventually, so I would assume nothing is blocking it.

Something I noticed:

You are using EIGRP named mode. These metrics are substantially higher than EIGRP Classic mode. That being said your offset list I saw on HUB 1 of adding 2000 to the metric may not cut it as sometimes these metrics can get into the millions. (Which could be why you need to adjust the metrics at a crazy high amount).

Are you able to provide output of : 'show ip eigrp topology all-links' 

I can see the metrics with this command

[Amills]

I didn't put the full topology from the spoke, it keeps freezing up the webpage when I paste it in. 

HUB1
Hub1#sh ip eigrp top | s 10.40.122.0
P 10.40.122.0/27, 1 successors, FD is 1967390720
via 10.67.14.39 (1967392720/1312720), Tunnel14
via 10.67.11.39 (3278110720/1310720), Tunnel11
Hub1#sh ip eigrp top | s 10.68.68.39
P 10.68.68.39/32, 1 successors, FD is 1966817280
via 10.67.14.39 (1966819280/165840), Tunnel14
via 10.67.11.39 (3277537280/163840), Tunnel11
P 10.40.120.0/24, 1 successors, FD is 1967390720
via 10.67.14.39 (1967392720/1312720), Tunnel14
via 10.67.11.39 (3278110720/1310720), Tunnel11
Hub1#sh ip eigrp top | s 10.40.121.0
P 10.40.121.0/24, 1 successors, FD is 1967390720
via 10.67.14.39 (1967392720/1312720), Tunnel14
via 10.67.11.39 (3278110720/1310720), Tunnel11

###############################################################################

Hub2

Hub2#sh ip eigrp top | s 10.68.68.39
P 10.68.68.39/32, 1 successors, FD is 656097280
via 10.67.14.39 (1966820280/166840), Tunnel14
via 10.67.11.39 (3277537280/163840), Tunnel11
Hub2#sh ip eigrp top | s 10.40.120.0
P 10.40.120.0/24, 1 successors, FD is 656670720
via 10.67.14.39 (1967393720/1313720), Tunnel14
via 10.67.11.39 (3278110720/1310720), Tunnel11
Hub2#sh ip eigrp top | s 10.40.121.0
P 10.40.121.0/24, 1 successors, FD is 656670720
via 10.67.14.39 (1967393720/1313720), Tunnel14
via 10.67.11.39 (3278110720/1310720), Tunnel11
Hub2#sh ip eigrp top | s 10.40.122.0
P 10.40.122.0/27, 1 successors, FD is 656670720
via 10.67.14.39 (1967393720/1313720), Tunnel14
via 10.67.11.39 (3278110720/1310720), Tunnel11
Hub2#

###############################################################################

SPOKE#sh ip eigrp topology
EIGRP-IPv4 VR(IWAN-EIGRP) Topology Table for AS(100)/ID(10.68.68.39)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
r - reply Status, s - sia Status

P 10.40.146.32/27, 2 successors, FD is 6555535360, tag is 11
10.67.11.45 via 10.67.11.2 (6555535360/3278110720), Tunnel11
10.67.11.45 via 10.67.11.100 (6555535360/3278110720), Tunnel11
via 10.67.14.100 (6618257360/3278112720), Tunnel14
via 10.67.14.2 (6618258360/3278113720), Tunnel14
P 10.8.1.4/30, 1 successors, FD is 72747960, tag is 11
via 10.67.11.100 (3278735360/983040), Tunnel11
via 10.67.14.100 (3341457360/985040), Tunnel14
P 10.40.22.0/27, 2 successors, FD is 3349547960, tag is 11
10.67.11.42 via 10.67.11.2 (6555535360/3278110720), Tunnel11
10.67.11.42 via 10.67.11.100 (6555535360/3278110720), Tunnel11
via 10.67.14.100 (6618257360/3278112720), Tunnel14
via 10.67.14.2 (6618258360/3278113720), Tunnel14
P 10.40.46.176/29, 2 successors, FD is 3349875640, tag is 11
10.67.11.15 via 10.67.11.2 (6555863040/3278438400), Tunnel11
10.67.11.15 via 10.67.11.100 (6555863040/3278438400), Tunnel11
via 10.67.14.100 (6618585040/3278440400), Tunnel14
via 10.67.14.2 (6618586040/3278441400), Tunnel14
P 10.40.6.32/27, 2 successors, FD is 3349875640, tag is 11
10.67.11.6 via 10.67.11.2 (6555863040/3278438400), Tunnel11
10.67.11.6 via 10.67.11.100 (6555863040/3278438400), Tunnel11
via 10.67.14.100 (6618585040/3278440400), Tunnel14
via 10.67.14.2 (6618586040/3278441400), Tunnel14
P 10.40.142.192/29, 2 successors, FD is 3349547960, tag is 11
10.67.11.35 via 10.67.11.2 (6555535360/3278110720), Tunnel11
10.67.11.35 via 10.67.11.100 (6555535360/3278110720), Tunnel11
via 10.67.14.100 (6618257360/3278112720), Tunnel14
via 10.67.14.2 (6618258360/3278113720), Tunnel14
P 10.68.68.53/32, 2 successors, FD is 3348974520, tag is 11
10.67.11.53 via 10.67.11.2 (6554961920/3277537280), Tunnel11
10.67.11.53 via 10.67.11.100 (6554961920/3277537280), Tunnel11
via 10.67.14.100 (6617683920/3277539280), Tunnel14
via 10.67.14.2 (6617684920/3277540280), Tunnel14
P 10.40.146.176/29, 2 successors, FD is 6555535360, tag is 11
10.67.11.45 via 10.67.11.2 (6555535360/3278110720), Tunnel11
10.67.11.45 via 10.67.11.100 (6555535360/3278110720), Tunnel11
via 10.67.14.100 (6618257360/3278112720), Tunnel14
via 10.67.14.2 (6618258360/3278113720), Tunnel14
P 10.20.34.0/23, 1 successors, FD is 73075640, tag is 11
via 10.67.11.100 (3279063040/1638400), Tunnel11
via 10.67.14.100 (3341785040/1640400), Tunnel14
P 192.168.74.0/24, 1 successors, FD is 4652178360, tag is 11
via 10.67.11.100 (5244817360/1967392720), Tunnel11
via 10.67.11.2 (5244818360/1967393720), Tunnel11
10.67.14.26 via 10.67.14.100 (5307539360/1967394720), Tunnel14
10.67.14.26 via 10.67.14.2 (5307541360/1967396720), Tunnel14
P 10.40.97.0/24, 2 successors, FD is 3349547960, tag is 11
10.67.11.21 via 10.67.11.2 (6555535360/3278110720), Tunnel11
10.67.11.21 via 10.67.11.100 (6555535360/3278110720), Tunnel11
via 10.67.14.100 (6618257360/3278112720), Tunnel14
via 10.67.14.2 (6618258360/3278113720), Tunnel14
P 10.40.98.176/29, 2 successors, FD is 3349547960, tag is 11
10.67.11.21 via 10.67.11.2 (6555535360/3278110720), Tunnel11
10.67.11.21 via 10.67.11.100 (6555535360/3278110720), Tunnel11
via 10.67.14.100 (6618257360/3278112720), Tunnel14
via 10.67.14.2 (6618258360/3278113720), Tunnel14
P 10.40.154.0/27, 2 successors, FD is 6555535360, tag is 11
10.67.11.47 via 10.67.11.2 (6555535360/3278110720), Tunnel11
10.67.11.47 via 10.67.11.100 (6555535360/3278110720), Tunnel11
via 10.67.14.100 (6618257360/3278112720), Tunnel14
via 10.67.14.2 (6618258360/3278113720), Tunnel14
P 10.40.74.192/29, 2 successors, FD is 3349547960, tag is 11
10.67.11.34 via 10.67.11.2 (6555535360/3278110720), Tunnel11
10.67.11.34 via 10.67.11.100 (6555535360/3278110720), Tunnel11
via 10.67.14.100 (6618257360/3278112720), Tunnel14
via 10.67.14.2 (6618258360/3278113720), Tunnel14
P 10.40.145.0/24, 2 successors, FD is 6555535360, tag is 11
10.67.11.45 via 10.67.11.2 (6555535360/3278110720), Tunnel11
10.67.11.45 via 10.67.11.100 (6555535360/3278110720), Tunnel11
via 10.67.14.100 (6618257360/3278112720), Tunnel14
via 10.67.14.2 (6618258360/3278113720), Tunnel14
P 10.40.162.208/29, 1 successors, FD is 4652178360, tag is 14
via 10.67.11.100 (5244817360/1967392720), Tunnel11
via 10.67.11.2 (5244818360/1967393720), Tunnel11
10.67.14.49 via 10.67.14.100 (5307539360/1967394720), Tunnel14
10.67.14.49 via 10.67.14.2 (5307541360/1967396720), Tunnel14
P 10.40.73.0/24, 2 successors, FD is 3349547960, tag is 11

...

[David Ruess · Accepted solution]

OK here is what it looks like you have and what I understand:

Things to note about EIGRP:

-By default it uses BW and Delay for its metric calculation

-It only takes the minimum BW along the entire path (so if BW is changed it needs to be changed lower than the minimum BW you have for the whole EIGRP path on all INCOMING interfaces from route being advertised)

-Metrics are affected by the INCOMING interface

HUB 1

Both tunnels have the same BW, so as it receives routes from Spoke through tunnel 11 and 14 it views it as exactly the same metric - unless Spoke router adds metrics to it with a distribute-list of some sort (it does not take into account Spoke Tunnel 11 or Tunnel 14 “sending” BW or delay). This will however affect incoming routes on Spoke so just make sure the routes are going how you want. So changing the delay on HUB1+2 Tunnel 14 interfaces will change the path to Tunnel 11 if its high enough.

Hub 2

Same scenario. You have the Same BW configured on the incoming tunnel interfaces so again it’s viewed as equal cost paths. Changing the delay on Tunnel 14 should make it choose Tunnel 11

Keep in mind it’s the receiving interface that matters. So the fact that Tunnel 14 on the Spoke is sending at 10 MBps is irrelevant, and changing that wont change the metric for the sending route…only the receiving route.

Like I mentioned EIGRP Named modes metrics are very high (into the billions). The distribute-lists on HUB1 adding 2000 to the route probably isn’t counteracting it enough to make a difference. Adjusting the delay on all Tunnel 14 incoming interfaces seems to be the fix.

[Amills]

when i set the delay to 5000 on tunnel 14 on both Hubs, I am learning all routes from tunnel 11 on the Hubs. 

[Amills]

With the new delay configured on the Hubs, I did fail over testing, turning off one tunnel at a time, everything works going through either tunnel and when both are up I am learning on the Spoke all routes from tunnel 11, and on the hubs Im learning from tunnel 11.

I did not know about the crazy high metrics(in the billions) named EIGRP uses, I felt like I was setting them ridiculously high. 

Thanks for all the help! 

[David Ruess]

Glad you were able to get the traffic flowing in the right direction.

See below for what I mean. The higher metric is to accommodate higher BW links

P 10.40.146.32/27, 2 successors, FD is 6555535360, tag is 11
10.67.11.45 via 10.67.11.2 (6555535360/3278110720), Tunnel11
10.67.11.45 via 10.67.11.100 (6555535360/3278110720), Tunnel11

That number I highlighted is the metric to get to that route from that neighbor (Feasible Distance). 6 billion and change. If you find later you don't want to configure delays because it messes with other things then an offset list (high number) should do the trick.

One more thing to note. I believe EIGRP adds delay to tunnel interfaces by default since they are generally slower, not sure what exact number it is but I dont think you can see it in any output of the config. That being said some delays you configure may not even surpass the ones in the internal process.

Please make sure to mark this post solved for the community if it met your satisfaction.

-David

[MHM Cisco World]

I one time solve issue that make me also crazy but the solution was 
Hub tunnel not need NHS map since it is NHS it need only 
ip nhrp map multicast dynamic

[paul driver]

Hello

---

@Amills wrote:

Why do I have to set such a crazy high delay for a 10Mbps link?? Shouldn't it prefer the 500Mbps link?! 

---

Hello
You are using named eigrp so wide metrics will be used to accommodate your high BW interfaces, as such eigrp will introduce two additional values used to calculate the throughput and latency of each route.

These two values are constant with each eigrp calculation:
Wide metric  =  65,536
Delay_Pico = 1,000,000 (per sec).

So I would say when you added that delay value eigrp was able to calculate correctly using these high wide metrics.

Example of a route calculation would be:

Look at a specific eigrp route in the topology table you should see the feasible distance is of a much higher value then the rib distance even though they are both valid.

sh ip protocols |in rib-scale
Metric rib-scale 128

sh ip eigrp topology 1.1.1.1/32
EIGRP-IPv4 VR(DMVPN) Topology Entry for AS(100)/ID(172.16.131.2) for 1.1.1.1/32
State is Passive, Query origin flag is 1, 1 Successor(s), FD is 9830481920, RIB is 76800640
Vector metric:
Minimum bandwidth is 100 Kbit
Total delay is 50001250000 picoseconds

Throughput
Eigrp BW * wide metric/min BW

10,000,000 * 65536 / 100 = 6,553,600,000

Latency
Total delay * wide metric/ picosecond

50001250000  * 65536  / 1000000  = 3,276,881,920


Throughput + Latency = Feasible Distance
6,553,600,000 + 3,276,881,920 = 9,830,481,920

Feasible Distance/ Metric rib-scale = RIB value
9,830,481,920 / 128  = 76800640

[MHM Cisco World]

Your design is wrong and max delay and play around metric solve your issue temporarily but for permanent I am so so sure that you will face issue in routing hub redundacy.

Good luck freind