5

I've been tasked with helping to troubleshoot a DMVPN Phase 3 connection over the internet. Unfortunately, I'm not experienced with DMVPN configs and setups. We have two test devices right now that are set up as a hub and spoke to communicate over the internet.

Our DMVPN test devices work just fine if they all are connected locally. However, if we mimic the config on two other test devices to pass over the internet, the tunnel appears to be set up but that is all. The devices cannot ping each other.

Initial troubleshooting leads me to believe at least part of the problem is the hub router's EIGRP config. EIGRP adjacency is not being established and then I noticed no EIGRP hello packets are being sent out the interface for the DMVPN tunnel. I figured it may just be best to copy over the config and let more experienced NE's tell me if they spot any red flags.

The config has had the IP's and Names changed. This is also only a small portion of the config. The hub has multiple DMVPN clouds set up that all seem to be working just fine when not passing over the internet.

If you need more information or more of the config posted, please let me know and I will post necessary parts of it.

This is the EIGRP and associated interface config:

interface Port-channel2.7
 description Link to Internet
 encapsulation dot1Q 7
 ip vrf forwarding PLACEHOLDER3
 ip address 1.1.1.1 255.255.255.248
 ip virtual-reassembly

interface Tunnel1601
 description PLACEHOLDER1
 bandwidth 1000
 ip vrf forwarding PLACEHOLDER2
 ip address 172.17.1.1 255.255.252.0
 no ip redirects
 ip mtu 1400
 ip hello-interval eigrp 1601 20
 ip hold-time eigrp 1601 60
 no ip next-hop-self eigrp 1601
 no ip split-horizon eigrp 1601
 ip pim neighbor-filter PIM_NEIGHBORS
 ip pim nbma-mode
 ip pim sparse-mode
 ip nhrp authentication NHRPKey2
 ip nhrp map multicast dynamic
 ip nhrp network-id 1601
 ip nhrp holdtime 300
 ip nhrp nhs 172.18.1.2
 ip nhrp nhs 172.18.1.3
 ip tcp adjust-mss 1360
 if-state nhrp
 cdp enable
 tunnel source Port-channel2.7
 tunnel mode gre multipoint
 tunnel key 100001
 tunnel vrf PLACEHOLDER3
 tunnel protection ipsec profile IPSEC-INTERNET

router eigrp DMVPN-INTERNET
 !
 address-family ipv4 unicast vrf PLACEHOLDER2 autonomous-system 1601
  !
  af-interface Tunnel1601
   hello-interval 20
   hold-time 60
   no next-hop-self no-ecmp-mode
   no split-horizon
  exit-af-interface
  !
  topology base
   auto-summary
   redistribute connected
   redistribute eigrp 1 route-map ROUTE-TAG-OUT-1601
   redistribute eigrp 4 route-map ROUTE-TAG-OUT-1601
   redistribute eigrp 95 route-map ROUTE-TAG-OUT-1601
   redistribute eigrp 1600 route-map ROUTE-TAG-OUT-1601
  exit-af-topology
  network 172.18.1.0 0.0.3.255
  network 172.18.64.0 0.0.63.255
  eigrp router-id 192.168.2.2
  eigrp log-neighbor-warnings 300
 exit-address-family
 !
 service-family ipv4 vrf PLACEHOLDER2 autonomous-system 1601
  !
  topology base
  exit-sf-topology
 exit-service-family
  • To establish an EIGRP adjacency, the routers need to be able to speak with eachother. You said 'The devices cannot ping each other and EIGRP is not propagating over the DMVPN internet cloud.' You should focus on fixing that first. Can they ping eachother on the public address? How about ont the tunnel addresses? Even if you can't ping, do you get a correct arp entry? Is the tunnel actually up? – JelmerS Sep 3 '14 at 16:54
  • Right. Thats exactly what I'm trying to focus on. Thats why I copied the EIGRP portion for this particular DMVPN tunnel. The tunnel appears to be up and working. The NHRP requests are being sent and received on each end. The mappings are being made dynamically and are in the table. I mentioned above that EIGRP Hello packets are not being sent out the interface at all. Any ideas why this would be the case based on the config I pasted? Thank you. – Rumblebutt Sep 3 '14 at 17:03
  • The problem seems to be before the EIGRP even enters the equasion. First the routers need to know how to reach eachothers public addresses to set up the Tunnel (via vrf INTERNET). Then they need to be able to communicate over the tunnel over their private addresses. Only after this has already started, can they start with the EIGRP setup. There is no EIGRP for vrf INTERNET in the config posted. – JelmerS Sep 3 '14 at 17:08
  • Thank you for pointing that out. INTERNET should have been changed to PLACEHOLDER3. Not much point now, but I've changed them both to PLACEHOLDER3. Thank you for your patience in helping me with this! It is appreciated. – Rumblebutt Sep 3 '14 at 17:12
  • 2
    Are you sure thats a phase 3 DMVPN? No ip nhrp map & ip nhrp shortcut command on tunnel interface. The underlay & overlay IP have to be mapped. – LucentMoon Sep 3 '14 at 19:12
2

I dont have any experience with multi-hub DMVPN, but it seems like you need to provide mapping from the tunnel address for the NHS's to their NBMA/external addresses under your tunnel interface at the spokes:

! on each spoke
int Tunnel1601
ip nhrp map 172.18.1.2 <NBMA Address for hub1>
ip nhrp map 172.18.1.3 <NBMA Address for hub2>
! probably also need to send multicast somewhere for EIGRP to form neighbors
ip nhrp map multicast <NBMA Address for hub1>
ip nhpp map multicast <NBMA Address for hub2>

I would not bother troubleshooting EIGRP until you get the DMVPN up and can ping between the tunnel IPs.

1

On the spoke routers make sure you have the hub routers configured as multicast destinations under the nhrp configuration.

ip nhrp map multicast "hub ip address"

EIGRP won't send hellos on interfaces that aren't configured to allow multicast, and by default DMVPN interfaces don't allow it. The other option is to configure EIGRP to use unicast instead of multicast by configuring 'neighbor' statements under the eigrp config (usually instead of network statements).

router eigrp 300
 neighbor x.x.x.x

I hope this helps!

cheers,

-2

IPsec does not support multicast. EIGRP uses multicast to communicate with adjacent routers. You might have to configure a GRE tunnel to carry the multicast traffic.

  • from the looks of it - his config is GRE. so this isn't an issue in this instance – knotseh Sep 6 '14 at 5:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.