issue with DMVPN and LTE (EE)

[jethrosabin76489]

 Hi

I'm experiencing an issue with the DMVPN links on LTE networks. Its an intermittent problem but I regularly find that the Tunnel is showing UP UP on the hub and spoke but "SHOW DMVPN" showing on the spoke side that the link is down which then caused it to drop OSPF.

Trying to understand why these links will intermittently just go down for what looks like no reason?

These links are back up links and very rarely become the main link with OSPF on top. I thought it could have been to do with long periods of inactivity on the line affecting something related to the carrier, but I would have though that the OSPF LSA's etc would be enough to avoid that?

The hub and spoke are c2911 with a LTE card on the Spoke side?

Many thanks

[balaji.bandi]

Do you have any keepalive configured along with DPD config ?

are you running OSPF over the tunnel ?

Can you post some configuration. example outputs of when this failed.

[jethrosabin76489]

Yes I am running OSPF over the tunnel and I obviously loose the neighbor etc when DMVPN shows that the state is down between the Spoke to the Hub... today it randomly came back up a few hours later.

Which outputs would be most helpful? I will get those the next time it goes back down as it stands I only have logs of it coming back up 

the tunnel configs are as such ( Minus the IP's ETC.)

Spoke

interface Tunnel2
description
bandwidth 256
ip address
no ip redirects
ip mtu 1400
ip nhrp authentication DMVPN_2
ip nhrp map
ip nhrp map multicast
ip nhrp map
ip nhrp map multicast
ip nhrp network-id 100005
ip nhrp holdtime 360
ip nhrp nhs
ip nhrp nhs
ip tcp adjust-mss 1360
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 7
ip ospf network broadcast
ip ospf priority 0
ip ospf transmit-delay 3
delay 1500
tunnel source Dialer1
tunnel mode gre multipoint
tunnel key 100005
tunnel protection ipsec profile DMVPN_Pr2
end

HUB

interface Tunnel7
description
bandwidth 1200
ip address
no ip redirects
ip mtu 1400
ip flow ingress
ip flow egress
ip nhrp authentication DMVPN_2
ip nhrp map multicast dynamic
ip nhrp network-id 100005
ip nhrp holdtime 360
ip tcp adjust-mss 1360
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 7
ip ospf network broadcast
ip ospf priority 5
delay 1000
tunnel source GigabitEthernet0/1
tunnel mode gre multipoint
tunnel key 100005
tunnel protection ipsec profile DMVPN_Pr2 shared
end

I am about to remove the Transmit-delay 3 but I have other LTE devices that do not have this command enabled which are doing the same thing

Thanks again

[balaji.bandi]

You can capture as much as Logs and show status to see how we can investigate based on the logs.

worth Looking health : "DMVPN Tunnel Health Monitoring and Recovery"

https://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-2mt/sec-conn-dmvpn-tun-mon.html

[MHM Cisco World]

config the If-state NHRP in spoke and Hub, this make the DMVPN check the health of tunnel and not depend on timeout of NHRP register.

[jethrosabin76489]

Appreciate that response I will look into that, many thanks

[MHM Cisco World]

You are so so welcome friend.