gre DMVPN 2 tunnels, 1 works one does not

[Michael Durham]

I have a hub router and two spoke routers, and I am having an issue with the VPN working between one spoke and the hub.  The hub (a 3925 router) and spoke CME (a 3925 router) works PERFECTLY!  But the hub to the other spoke WebTest does not work yet I am copying the code from CME spoke so it should work.  All routers are running IOS 15.7 and all have the security license installed.  I have attached trimmed down configs from all three routers and some test results from each too.

I am getting this error when WebTEST tries to connect to the hub:

%CRYPTO-4-IKMP_BAD_MESSAGE: IKE message from 192.168.69.253 failed its sanity check or is malformed

What debug command should I run?  What should I look for?

[Muhammad Awais Khan]

Hi,

I notice that there is mismatch in NHRP Authentication on TestWeb Router.

On Hub and CME , you have "ip nhrp authentication Cisco" while on TestWeb you have "ip nhrp authentication R3m0t3PS" under tunnel1 interfaces. Can you change it to Cisco on Testweb to match with every one ?

[Deepak Kumar]

Hi,

NHRP authentication is miss matching as:

On HUB Router:

 interface Tunnel1
description mGRE - DMVPN Tunnel for customer remote support
ip address 172.16.0.1 255.255.0.0
no ip redirects
ip nhrp authentication Cisco
ip nhrp network-id 479

On Spoke Router:

interface Tunnel1
description DMVPN mGRE tunnel to support
ip address 172.16.1.55 255.255.0.0
no ip redirects
ip nhrp authentication R3m0t3PS
ip nhrp map 172.16.0.1 12.4.2.5
ip nhrp map multicast 12.4.2.5
ip nhrp network-id 479

You have to make change the NHRP authentication on the Spoke as:

interface Tunnel1
description DMVPN mGRE tunnel to support
ip address 172.16.1.55 255.255.0.0
no ip redirects
ip nhrp authentication Cisco
ip nhrp map 172.16.0.1 12.4.2.5
ip nhrp map multicast 12.4.2.5
ip nhrp network-id 479

[paul driver]

Hello

Just like to add to the other comments, 

Both spokes DMVPN tunnels are adminstrative down, both have the duplicate loopback1 addressing and both have a default static route thats incorrect.

The default route should read:
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 dhcp

[Michael Durham]

The ip nhrp authentication settings were/are correct.  I just forgot to change it on the printout.

Neither spoke routers are administratively down.  

HUB -->  SPOKE CME is working

HUB --> SPOKE WebTEST is NOT working