NHRP Registration Failure(NHRP: no error)

[Verbatim]

Would someone elaborate a bit on these log entries? This is saying the next hop server is down because of failure to register? What might cause a registration failure? In this particular case the other side (also a Cisco router) had no corresponding log entries.

UPDATE 2: When running NHRP over GRE tunnels, it seems that if the underlying medium causes dropped packets, this can lead to this problem (as the registration packets are dropped). Not sure if that's the cause in this circumstance, but we recently have come across a situation with a bad link which consistently has caused nhrp registration failures.

UPDATE: there were no other relevant log entries around these 2 lines; nothing that would suggest a connectivity issue or other problem. Also, the dmvpn tunnel is normally fine, this was just a brief hiccup.

Log entries:

005495: Aug 27 02:01:51.471 utc: %DMVPN-5-NHRP_NHS_DOWN: Tunnel1000: Next Hop Server : (Tunnel: 10.23.72.1 NBMA: 22.22.22.22 ) for (Tunnel: 10.23.73.17 NBMA: 33.33.33.33) is DOWN, Reason: NHRP Registration Failure(NHRP: no error)
005496: Aug 27 02:01:51.548 utc: %DMVPN-5-NHRP_NHS_UP: Tunnel1000: Next Hop Server : (Tunnel: 10.23.72.1 NBMA: 22.22.22.22) for (Tunnel: 10.23.73.17 NBMA: 33.33.33.33) is UP

[duratecaustralia]

I had this problem too on a brand new C1161-8PLTEP running IOS 17.09.04.

The DMVPN tunnel would not establish back to the hub router in HQ. 

When I downgraded the IOS to 17.03.04 the DMVPN worked, however the 5G NIM was not detected by the router as this IOS is too old.

I came across this article which says:

If the IPsec configuration is not updated to use strong cryptographic algorithms prior to the Cisco IOS XE Release 17.11.1 software upgrade. I'm not using 17.11 but I thought this could be my problem. I did notice on C1161 my spoke router it added "group 14" under my "crypto isakmp policy 10"

Field Notice: FN - 72510 - Cisco IOS XE SW: Weak Cryptographic Algorithms Are Not Allowed by Default for IPsec Configuration in Cisco IOS XE Release 17.11.1 and Later - Configuration Change Recommended - Cisco

I didn't really want to go with the not-recommended workaround: 

crypto engine compliance shield disable

However, I thought I'd give it a try and once I modified the following config: 

"crypto isakmp policy 10"

"no group 14" 

"group 1"

Bang - it worked!

So I wasn't stuck with unsupported configuration, I undid my changes, logged into the Hub router at HQ and added a second crypto isakmp policy (15) to my config with a group of 14.

I also applied the same config on my spoke router C1161:

crypto isakmp policy 15
encr aes 256
hash sha256
authentication pre-share
group 14

Bang - it also worked!

I hope this help you out - I was stuck on this one for a few days.

[Verbatim]

Glad it worked for you, and thanks for sharing! In our case, the tunnel / dmvpn is established most of the time; this was an almost instantaneous 'flap' of the registration (went down and back up in less than a second).

[simonstoll]

Your workaround works like a charm, was stuck with this when setting up multiple tunnels from the same device over Ethernet based WAN Service plus a backup over 5G. I couldn't bring all tunnels up at the same time, only WAN or 5G, but never both at the same time. Lowering the DH Group to 1 solved the problem. Do you know, if this is intended behavior or a bug? I don't think, it's clean to operate DMVPN with DH-Group1.

[SS2020]

Hello Gents,

i have the same issues but creating new policy didn't sort my issues.

any other sggestions please?

[MHM Cisco World]

Make new post it better 

MHM

[SS2020]

hello MHM,

thank you for reply. see below errors 

%DMVPN-5-NHRP_NHS_DOWN: Tunnel1250: Next Hop Server : (Tunnel: 10.25.10.2 NBMA: 199.0.36.4 ) for (Tunnel: 10.25.10.19 NBMA: 197.20.16.10) is DOWN, Reason: NHRP Registration Failure(NHRP: no error)

[SS2020]

Hello MHM,

this issue is solved it was DMVPN cert issues

[MHM Cisco World]

Show ip dmvpn details 

Share this 

[Verbatim]

Not seeing the dmvpn option following show ip ?

show ip nhrp nhs detail

Legend: E=Expecting replies, R=Responding, W=Waiting
Tunnel1000:
10.23.72.1 RE priority = 0 cluster = 0 req-sent 12894 req-failed 0 repl-recv 12884 (00:01:28 ago)

Tunnel1100:
10.23.8.1 RE priority = 0 cluster = 0 req-sent 12908 req-failed 0 repl-recv 12884 (00:01:28 ago)