DMVPN EIGRP Config Error - No EIGRP Hello packets sent out interface

Question

I've been tasked with helping to troubleshoot a DMVPN Phase 3 connection over the internet. Unfortunately, I'm not experienced with DMVPN configs and setups. We have two test devices right now that are set up as a hub and spoke to communicate over the internet.

Our DMVPN test devices work just fine if they all are connected locally. However, if we mimic the config on two other test devices to pass over the internet, the tunnel appears to be set up but that is all. The devices cannot ping each other.

Initial troubleshooting leads me to believe at least part of the problem is the hub router's EIGRP config. EIGRP adjacency is not being established and then I noticed no EIGRP hello packets are being sent out the interface for the DMVPN tunnel. I figured it may just be best to copy over the config and let more experienced NE's tell me if they spot any red flags.

The config has had the IP's and Names changed. This is also only a small portion of the config. The hub has multiple DMVPN clouds set up that all seem to be working just fine when not passing over the internet.

If you need more information or more of the config posted, please let me know and I will post necessary parts of it.

This is the EIGRP and associated interface config:

interface Port-channel2.7
 description Link to Internet
 encapsulation dot1Q 7
 ip vrf forwarding PLACEHOLDER3
 ip address 1.1.1.1 255.255.255.248
 ip virtual-reassembly

interface Tunnel1601
 description PLACEHOLDER1
 bandwidth 1000
 ip vrf forwarding PLACEHOLDER2
 ip address 172.17.1.1 255.255.252.0
 no ip redirects
 ip mtu 1400
 ip hello-interval eigrp 1601 20
 ip hold-time eigrp 1601 60
 no ip next-hop-self eigrp 1601
 no ip split-horizon eigrp 1601
 ip pim neighbor-filter PIM_NEIGHBORS
 ip pim nbma-mode
 ip pim sparse-mode
 ip nhrp authentication NHRPKey2
 ip nhrp map multicast dynamic
 ip nhrp network-id 1601
 ip nhrp holdtime 300
 ip nhrp nhs 172.18.1.2
 ip nhrp nhs 172.18.1.3
 ip tcp adjust-mss 1360
 if-state nhrp
 cdp enable
 tunnel source Port-channel2.7
 tunnel mode gre multipoint
 tunnel key 100001
 tunnel vrf PLACEHOLDER3
 tunnel protection ipsec profile IPSEC-INTERNET

router eigrp DMVPN-INTERNET
 !
 address-family ipv4 unicast vrf PLACEHOLDER2 autonomous-system 1601
  !
  af-interface Tunnel1601
   hello-interval 20
   hold-time 60
   no next-hop-self no-ecmp-mode
   no split-horizon
  exit-af-interface
  !
  topology base
   auto-summary
   redistribute connected
   redistribute eigrp 1 route-map ROUTE-TAG-OUT-1601
   redistribute eigrp 4 route-map ROUTE-TAG-OUT-1601
   redistribute eigrp 95 route-map ROUTE-TAG-OUT-1601
   redistribute eigrp 1600 route-map ROUTE-TAG-OUT-1601
  exit-af-topology
  network 172.18.1.0 0.0.3.255
  network 172.18.64.0 0.0.63.255
  eigrp router-id 192.168.2.2
  eigrp log-neighbor-warnings 300
 exit-address-family
 !
 service-family ipv4 vrf PLACEHOLDER2 autonomous-system 1601
  !
  topology base
  exit-sf-topology
 exit-service-family

Answer 1

I dont have any experience with multi-hub DMVPN, but it seems like you need to provide mapping from the tunnel address for the NHS's to their NBMA/external addresses under your tunnel interface at the spokes:

! on each spoke
int Tunnel1601
ip nhrp map 172.18.1.2 <NBMA Address for hub1>
ip nhrp map 172.18.1.3 <NBMA Address for hub2>
! probably also need to send multicast somewhere for EIGRP to form neighbors
ip nhrp map multicast <NBMA Address for hub1>
ip nhpp map multicast <NBMA Address for hub2>

I would not bother troubleshooting EIGRP until you get the DMVPN up and can ping between the tunnel IPs.

Answer 2

On the spoke routers make sure you have the hub routers configured as multicast destinations under the nhrp configuration.

ip nhrp map multicast "hub ip address"

EIGRP won't send hellos on interfaces that aren't configured to allow multicast, and by default DMVPN interfaces don't allow it. The other option is to configure EIGRP to use unicast instead of multicast by configuring 'neighbor' statements under the eigrp config (usually instead of network statements).

router eigrp 300
 neighbor x.x.x.x

I hope this helps!

cheers,

Answer 3

IPsec does not support multicast. EIGRP uses multicast to communicate with adjacent routers. You might have to configure a GRE tunnel to carry the multicast traffic.