EIGRP learning routes from slower WAN connection

[Amills]

I got 2 WAN connections coming into a ISR4331 router, one is cable at 10Mbps and the other is a fiber 500Mbps link. 

Without any metric modification EIGRP always learns its routes from tunnel 14, the cable WAN connection at 10Mbps. 

I've even set on the hub routers a delay of 50000 on the tunnel interfaces and setup offset lists and configured crazy high delay of 8000 but it keeps choosing to learn routes from the slower tunnel 14.

It isn't until I set a delay of 5000 on the tunnel 14 of the spoke site it will learn its routes from tunnel 11. Why do I have to set such a crazy high delay for a 10Mbps link?? Shouldn't it prefer the 500Mbps link?! 

The other thing is both HUBS are learning the routes for the spoke through tunnel 14 as well. Everything should go through tunnel 11 from the spoke site to the hubs as that is the faster connection.

Why would EIGRP choose the slowest connection? 

SPOKE SITE

#################################

version 16.9
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname SPOKE-SITE
!

!
key chain KEY
key 1
key-string 123456789
!

!
!
!
!

!
interface Tunnel11
description DMVPN: INET
bandwidth 512000
ip address .x.x.x. x.x.x.x
no ip redirects
ip mtu 1400
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-mode
ip nhrp authentication x
ip nhrp network-id 11
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip nhrp redirect
ip tcp adjust-mss 1360
load-interval 30
nhrp group RS-GROUP-500MBPS
no nhrp route-watch
if-state nhrp
tunnel source GigabitEthernet0/0/2
tunnel mode gre multipoint
tunnel key 11
tunnel vrf INET
tunnel protection ipsec profile DMVPN-IPSEC-PROFILE-INET
!
interface Tunnel14
description DMVPN-INET
bandwidth 10240
ip address .x.x.x. x.x.x.x
no ip redirects
ip mtu 1400
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-mode
ip nhrp authentication x
ip nhrp network-id 14
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip tcp adjust-mss 1360
load-interval 30
delay 2000
nhrp group RS-GROUP-10MBPS
no nhrp route-watch
if-state nhrp
tunnel source GigabitEthernet0/0/1
tunnel mode gre multipoint
tunnel key 14
tunnel vrf INET2
tunnel protection ipsec profile DMVPN-IPSEC-PROFILE-INET2

!

interface GigabitEthernet0/0/1
description WAN: CABLE INTERNET 10MBPS
bandwidth 10240
vrf forwarding INET2
ip address x.x.x.x x.x.x.x
negotiation auto
service-policy output IWAN-INTERFACE-10MB
!
interface GigabitEthernet0/0/2
description FIBER INTERNET 500MBPS
bandwidth 512000
vrf forwarding INET
ip address x.x.x.x x.x.x.x
negotiation auto
service-policy output IWAN-INTERFACE-500MB
!

router eigrp IWAN-EIGRP
!
address-family ipv4 unicast autonomous-system 100
!
af-interface default
passive-interface
exit-af-interface
!
af-interface Tunnel11
authentication mode md5
authentication key-chain KEY
hello-interval 30
hold-time 90
no passive-interface
stub-site wan-interface
exit-af-interface
!
af-interface Tunnel14
authentication mode md5
authentication key-chain KEY
hello-interval 30
hold-time 90
no passive-interface
stub-site wan-interface
exit-af-interface
!
topology base
exit-af-topology
network x.x.x.x 
network x.x.x.x 
network x.x.x.x.0 
network x.x.x.x 
eigrp router-id x.x.x.x
eigrp stub-site 100:5
exit-address-family
!

ip route vrf INET 0.0.0.0 0.0.0.0 x.x.x.x
ip route vrf INET2 0.0.0.0 0.0.0.0 x.x.x.x

!

HUB1 
############################

!
version 16.9
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
platform qos port-channel-aggregate 30
platform hardware throughput level 300000
!
hostname HUB1

!
!

key chain KEY
key 1
key-string 123456789

!
!
!

!
interface Port-channel30
description Link to
vrf forwarding INET
ip address x.x.x.x
no negotiation auto
!
interface Tunnel11
description DMVPN: INTERNET
bandwidth 1000000
ip address x.x.x.x
no ip redirects
ip mtu 1400
no ip split-horizon eigrp 100
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-dense-mode
ip nhrp authentication
ip nhrp network-id 11
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip nhrp redirect
ip tcp adjust-mss 1360
load-interval 30
nhrp map group RS-GROUP-75MBPS service-policy output RS-GROUP-75MBPS-POLICY
nhrp map group RS-GROUP-50MBPS service-policy output RS-GROUP-50MBPS-POLICY
nhrp map group RS-GROUP-20MBPS service-policy output RS-GROUP-20MBPS-POLICY
nhrp map group RS-GROUP-10MBPS service-policy output RS-GROUP-10MBPS-POLICY
nhrp map group RS-GROUP-7MBPS service-policy output RS-GROUP-7MBPS-POLICY
nhrp map group RS-GROUP-5MBPS service-policy output RS-GROUP-5MBPS-POLICY
nhrp map group RS-GROUP-16MBPS service-policy output RS-GROUP-16MBPS-POLICY
nhrp map group RS-GROUP-3MBPS service-policy output RS-GROUP-3MBPS-POLICY
nhrp map group RS-GROUP-150MBPS service-policy output RS-GROUP-150MBPS-POLICY
nhrp map group RS-GROUP-100MBPS service-policy output RS-GROUP-100MBPS-POLICY
nhrp map group RS-GROUP-6MBPS service-policy output RS-GROUP-6MBPS-POLICY
nhrp map group RS-GROUP-25MBPS service-policy output RS-GROUP-25MBPS-POLICY
nhrp map group RS-GROUP-1.5MBPS service-policy output RS-GROUP-1.5MBPS-POLICY
nhrp map group RS-GROUP-60MBPS service-policy output RS-GROUP-60MBPS-POLICY
nhrp map group RS-GROUP-9MBPS service-policy output RS-GROUP-9MBPS-POLICY
nhrp map group RS-GROUP-35MBPS service-policy output RS-GROUP-35MBPS-POLICY
nhrp map group RS-GROUP-40MBPS service-policy output RS-GROUP-40MBPS-POLICY
nhrp map group RS-GROUP-45MBPS service-policy output RS-GROUP-45MBPS-POLICY
nhrp map group RS-GROUP-200MBPS service-policy output RS-GROUP-200MBPS-POLICY
nhrp map group RS-GROUP-500MBPS service-policy output RS-GROUP-500MBPS-POLICY
tunnel source Port-channel30
tunnel mode gre multipoint
tunnel key 11
tunnel vrf INET
tunnel protection ipsec profile DMVPN-IPSEC-PROFILE-TUN11
!
interface Tunnel14
description DMVPN: INTERNET
bandwidth 1000000
ip address x.x.x.x
no ip redirects
ip mtu 1400
no ip split-horizon eigrp 100
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-dense-mode
ip nhrp authentication
ip nhrp network-id 14
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast <-- HUB2
ip nhrp redirect
ip tcp adjust-mss 1360
load-interval 30
delay 50000
nhrp map group RS-GROUP-75MBPS service-policy output RS-GROUP-75MBPS-POLICY
nhrp map group RS-GROUP-50MBPS service-policy output RS-GROUP-50MBPS-POLICY
nhrp map group RS-GROUP-20MBPS service-policy output RS-GROUP-20MBPS-POLICY
nhrp map group RS-GROUP-10MBPS service-policy output RS-GROUP-10MBPS-POLICY
nhrp map group RS-GROUP-7MBPS service-policy output RS-GROUP-7MBPS-POLICY
nhrp map group RS-GROUP-5MBPS service-policy output RS-GROUP-5MBPS-POLICY
nhrp map group RS-GROUP-16MBPS service-policy output RS-GROUP-16MBPS-POLICY
nhrp map group RS-GROUP-3MBPS service-policy output RS-GROUP-3MBPS-POLICY
nhrp map group RS-GROUP-150MBPS service-policy output RS-GROUP-150MBPS-POLICY
nhrp map group RS-GROUP-100MBPS service-policy output RS-GROUP-100MBPS-POLICY
nhrp map group RS-GROUP-6MBPS service-policy output RS-GROUP-6MBPS-POLICY
nhrp map group RS-GROUP-25MBPS service-policy output RS-GROUP-25MBPS-POLICY
nhrp map group RS-GROUP-1.5MBPS service-policy output RS-GROUP-1.5MBPS-POLICY
nhrp map group RS-GROUP-60MBPS service-policy output RS-GROUP-60MBPS-POLICY
nhrp map group RS-GROUP-9MBPS service-policy output RS-GROUP-9MBPS-POLICY
nhrp map group RS-GROUP-35MBPS service-policy output RS-GROUP-35MBPS-POLICY
nhrp map group RS-GROUP-40MBPS service-policy output RS-GROUP-40MBPS-POLICY
nhrp map group RS-GROUP-45MBPS service-policy output RS-GROUP-45MBPS-POLICY
nhrp map group RS-GROUP-500MBPS service-policy output RS-GROUP-500MBPS-POLICY
tunnel source Port-channel30
tunnel mode gre multipoint
tunnel key 14
tunnel vrf INET
tunnel protection ipsec profile DMVPN-IPSEC-PROFILE-TUN14

!
interface GigabitEthernet0/0/1
description Link to
vrf forwarding INET
no ip address
negotiation auto
channel-group 30 mode active
service-policy output IWAN-INTERFACE-1000MB
!

interface GigabitEthernet0/1/0
description Link to
vrf forwarding INET
no ip address
negotiation auto
channel-group 30 mode active
service-policy output IWAN-INTERFACE-1000MB

!
router eigrp IWAN-EIGRP
!
address-family ipv4 unicast autonomous-system 100
!
af-interface default
passive-interface
exit-af-interface
!
af-interface Tunnel11
authentication mode md5
authentication key-chain KEY
hello-interval 30
hold-time 90
no next-hop-self
no passive-interface
no split-horizon
exit-af-interface
!
af-interface Tunnel14
authentication mode md5
authentication key-chain KEY
hello-interval 30
hold-time 90
no next-hop-self
no passive-interface
no split-horizon
exit-af-interface
!
topology base
offset-list 99 out 10000 Tunnel14
exit-af-topology
network x.x.x.x

eigrp router-id x.x.x.x
exit-address-family
!

ip route vrf INET 0.0.0.0 0.0.0.0 x.x.x.x
ip route vrf INET2 0.0.0.0 0.0.0.0 x.x.x.x

access-list 99 permit 0.0.0.0
access-list 99 permit 10.0.0.0 0.255.255.255
access-list 99 permit 192.168.0.0 0.0.255.255
access-list 99 permit 172.16.0.0 0.0.255.255

HUB2
####################

version 16.9
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname HUB2
!
!
key chain KEY
key 1
key-string 123456789

!
!
!
!
!

interface Tunnel11
description DMVPN: INTERNET
bandwidth 1000000
ip address x.x.x.x
no ip redirects
ip mtu 1400
no ip split-horizon eigrp 100
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-dense-mode
ip nhrp authentication x
ip nhrp network-id 11
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast <--HUB1
ip nhrp redirect
ip summary-address eigrp 100 0.0.0.0 0.0.0.0
ip tcp adjust-mss 1360
load-interval 30
nhrp map group RS-GROUP-75MBPS service-policy output RS-GROUP-75MBPS-POLICY
nhrp map group RS-GROUP-50MBPS service-policy output RS-GROUP-50MBPS-POLICY
nhrp map group RS-GROUP-20MBPS service-policy output RS-GROUP-20MBPS-POLICY
nhrp map group RS-GROUP-10MBPS service-policy output RS-GROUP-10MBPS-POLICY
nhrp map group RS-GROUP-7MBPS service-policy output RS-GROUP-7MBPS-POLICY
nhrp map group RS-GROUP-5MBPS service-policy output RS-GROUP-5MBPS-POLICY
nhrp map group RS-GROUP-16MBPS service-policy output RS-GROUP-16MBPS-POLICY
nhrp map group RS-GROUP-3MBPS service-policy output RS-GROUP-3MBPS-POLICY
nhrp map group RS-GROUP-150MBPS service-policy output RS-GROUP-150MBPS-POLICY
nhrp map group RS-GROUP-100MBPS service-policy output RS-GROUP-100MBPS-POLICY
nhrp map group RS-GROUP-6MBPS service-policy output RS-GROUP-6MBPS-POLICY
nhrp map group RS-GROUP-25MBPS service-policy output RS-GROUP-25MBPS-POLICY
nhrp map group RS-GROUP-1.5MBPS service-policy output RS-GROUP-1.5MBPS-POLICY
nhrp map group RS-GROUP-60MBPS service-policy output RS-GROUP-60MBPS-POLICY
nhrp map group RS-GROUP-9MBPS service-policy output RS-GROUP-9MBPS-POLICY
nhrp map group RS-GROUP-35MBPS service-policy output RS-GROUP-35MBPS-POLICY
nhrp map group RS-GROUP-40MBPS service-policy output RS-GROUP-40MBPS-POLICY
nhrp map group RS-GROUP-45MBPS service-policy output RS-GROUP-45MBPS-POLICY
nhrp map group RS-GROUP-200MBPS service-policy output RS-GROUP-200MBPS-POLICY
nhrp map group RS-GROUP-500MBPS service-policy output RS-GROUP-500MBPS-POLICY
tunnel source GigabitEthernet0/0/2
tunnel mode gre multipoint
tunnel key 11
tunnel vrf INET
tunnel protection ipsec profile DMVPN-IPSEC-PROFILE-INET
!
interface Tunnel14
description DMVPN: INTERNET
bandwidth 1000000
ip address x.x.x.x
no ip redirects
ip mtu 1400
no ip split-horizon eigrp 100
ip pim dr-priority 0
ip pim nbma-mode
ip pim sparse-dense-mode
ip nhrp authentication
ip nhrp network-id 14
ip nhrp nhs x.x.x.x nbma x.x.x.x multicast
ip nhrp redirect
ip tcp adjust-mss 1360
load-interval 30
delay 50000
nhrp map group RS-GROUP-75MBPS service-policy output RS-GROUP-75MBPS-POLICY
nhrp map group RS-GROUP-50MBPS service-policy output RS-GROUP-50MBPS-POLICY
nhrp map group RS-GROUP-20MBPS service-policy output RS-GROUP-20MBPS-POLICY
nhrp map group RS-GROUP-10MBPS service-policy output RS-GROUP-10MBPS-POLICY
nhrp map group RS-GROUP-7MBPS service-policy output RS-GROUP-7MBPS-POLICY
nhrp map group RS-GROUP-5MBPS service-policy output RS-GROUP-5MBPS-POLICY
nhrp map group RS-GROUP-16MBPS service-policy output RS-GROUP-16MBPS-POLICY
nhrp map group RS-GROUP-3MBPS service-policy output RS-GROUP-3MBPS-POLICY
nhrp map group RS-GROUP-150MBPS service-policy output RS-GROUP-150MBPS-POLICY
nhrp map group RS-GROUP-100MBPS service-policy output RS-GROUP-100MBPS-POLICY
nhrp map group RS-GROUP-6MBPS service-policy output RS-GROUP-6MBPS-POLICY
nhrp map group RS-GROUP-25MBPS service-policy output RS-GROUP-25MBPS-POLICY
nhrp map group RS-GROUP-1.5MBPS service-policy output RS-GROUP-1.5MBPS-POLICY
nhrp map group RS-GROUP-60MBPS service-policy output RS-GROUP-60MBPS-POLICY
nhrp map group RS-GROUP-9MBPS service-policy output RS-GROUP-9MBPS-POLICY
nhrp map group RS-GROUP-35MBPS service-policy output RS-GROUP-35MBPS-POLICY
nhrp map group RS-GROUP-40MBPS service-policy output RS-GROUP-40MBPS-POLICY
nhrp map group RS-GROUP-45MBPS service-policy output RS-GROUP-45MBPS-POLICY
nhrp map group RS-GROUP-500MBPS service-policy output RS-GROUP-500MBPS-POLICY
tunnel source GigabitEthernet0/0/3
tunnel mode gre multipoint
tunnel key 14
tunnel vrf INET2
tunnel protection ipsec profile DMVPN-IPSEC-PROFILE-INET2
!

interface GigabitEthernet0/0/2
description WAN: Internet via DMZ
vrf forwarding INET
ip address x.x.x.x
negotiation auto
service-policy output IWAN-INTERFACE-1000MB
!
interface GigabitEthernet0/0/3
description WAN: Internet via DMZ
vrf forwarding INET2
ip address x.x.x.x
negotiation auto
service-policy output IWAN-INTERFACE-1000MB

router eigrp IWAN-EIGRP
!
address-family ipv4 unicast autonomous-system 100
!
af-interface Tunnel11
authentication mode md5
authentication key-chain KEY
hello-interval 30
hold-time 90
no next-hop-self
no passive-interface
no split-horizon
exit-af-interface
!
af-interface Tunnel14
authentication mode md5
authentication key-chain KEY
hello-interval 30
hold-time 90
no next-hop-self
no passive-interface
no split-horizon
exit-af-interface
!
topology base
offset-list 99 out 10000 Tunnel14
exit-af-topology
network x.x.x.x
eigrp router-id x.x.x.x
exit-address-family
!

ip route vrf INET 0.0.0.0 0.0.0.0 x.x.x.x
ip route vrf INET2 0.0.0.0 0.0.0.0 x.x.x.x

access-list 99 permit 0.0.0.0
access-list 99 permit 10.0.0.0 0.255.255.255
access-list 99 permit 192.168.0.0 0.0.255.255
access-list 99 permit 172.16.0.0 0.0.255.255
access-list 99 permit 172.20.0.0 0.0.255.255
!

[Amills]

@MHM Cisco World 

What do you suggest for a fixed design? 

[MHM Cisco World]

Now you have two DMVPN Cloud and have dual Hub 

we config the Spoke have ONE TUNNEL for ONE DMVPN CLOUD for ONE HUB.