I am having a problem with a DMVPN tunnel I recently created. I have done some torubleshooting on this and discovered the tunnel to be up between both sites, but they are not passing any traffic between each other. To create this tunnel I used code from a working tunnel and modified for the needs of this new tunnel. In my research i have not found a configuration example similar to what is configured on my routers. I feel like the problem is with either EIGRP or an access list
Here is the config of the spoke router (Cisco 1921 Running 15.4) that is not passing traffic over the tunnel, internet works.
interface Tunnel0
bandwidth 10000
ip unnumbered GigabitEthernet0/1
tunnel source Cellular0/0/0
tunnel mode ipsec ipv4
tunnel destination (IP Removed)
tunnel path-mtu-discovery
tunnel protection ipsec profile Mesh-VPN
router eigrp 1
network 192.168.154.0
passive-interface default
no passive-interface Tunnel0
Here are the results of the show commands EIGRP neighbor and ip access-lists on the Spoke Router that is not passing Traffic
PatonBMCXRou#show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(1)
PatonBMCXRou#show ip access-list
Extended IP access list Internet-IN
10 permit udp any any eq non500-isakmp
20 permit udp any any eq isakmp (3 matches)
30 permit esp any any
Extended IP access list InternetIn
Extended IP access list NAT
10 deny ip 192.168.148.0 0.0.2.255 192.168.154.0 0.0.0.255
20 deny ip 192.168.152.0 0.0.7.255 192.168.154.0 0.0.0.255
30 permit ip 192.168.154.0 0.0.0.255 any (11004 matches)
Extended IP access list VPDNSplitTunnel
10 permit ip 192.168.148.0 0.0.2.255 192.168.154.0 0.0.0.255
20 permit ip 192.168.152.0 0.0.7.255 192.168.154.0 0.0.0.255
Extended IP access list acl-nat
Extended IP access list acl-static-nat
Here is the config on the spoke router (Cisco 3925 running 15.2) The Port Arthur Tunnel works and I can pass traffic over it. The BMCX one, the tunnel is up but I cannot
interface Tunnel2
description BMCX
bandwidth 5000
no ip address
delay 100
tunnel source GigabitEthernet0/0
tunnel mode ipsec ipv4
tunnel destination (IP Removed)
tunnel path-mtu-discovery
tunnel protection ipsec profile Mesh-VPN
!
interface Tunnel4
description Port Arthur
bandwidth 10000
ip unnumbered Vlan1
tunnel source GigabitEthernet0/0
tunnel mode ipsec ipv4
tunnel destination (IP Removed)
tunnel path-mtu-discovery
tunnel protection ipsec profile Mesh-VPN
Here are the results of the show commands EIGRP neighbor and ip access-lists on the Hub Router
HouCoreRou#show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(1)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 172.31.254.246 Tu0 11 1d21h 51 582 0 6335
1 172.31.254.251 Tu1 10 2d00h 80 582 0 12169
2 192.168.153.1 Tu4 11 6d02h 17 102 0 260
HouCoreRou#show ip access-list
Standard IP access list 10
10 permit any
Standard IP access list Management
10 permit (IP Removed), wildcard bits 0.0.0.3
20 permit 192.168.148.0, wildcard bits 0.0.3.255
30 permit 192.168.153.0, wildcard bits 0.0.0.255
40 permit 10.0.8.0, wildcard bits 0.0.3.255
50 permit 10.0.44.0, wildcard bits 0.0.3.255
60 permit 192.168.150.0, wildcard bits 0.0.0.255
Extended IP access list InternetIn
200 permit icmp any any (1143766 matches)
210 permit udp any any eq non500-isakmp
220 permit udp any any eq isakmp
Extended IP access list NAT
10 deny ip 192.168.146.0 0.0.4.255 10.0.12.0 0.0.1.255
20 deny ip 192.168.146.0 0.0.4.255 10.0.40.0 0.0.3.255
30 deny ip 192.168.146.0 0.0.4.255 10.0.44.0 0.0.3.255
40 deny ip 10.0.8.0 0.0.3.255 192.168.146.0 0.0.4.255
50 deny ip 10.0.8.0 0.0.3.255 10.0.8.0 0.0.3.255
60 deny ip 10.0.8.0 0.0.3.255 10.0.12.0 0.0.1.255
70 deny ip 10.0.8.0 0.0.3.255 10.0.40.0 0.0.3.255
80 deny ip 10.0.8.0 0.0.3.255 10.0.44.0 0.0.3.255
90 deny ip 10.0.12.0 0.0.1.255 192.168.146.0 0.0.4.255
100 deny ip 10.0.12.0 0.0.1.255 10.0.8.0 0.0.3.255
110 deny ip 10.0.12.0 0.0.1.255 10.0.12.0 0.0.1.255
120 deny ip 10.0.12.0 0.0.1.255 10.0.40.0 0.0.3.255
130 deny ip 10.0.12.0 0.0.1.255 10.0.44.0 0.0.3.255
140 deny ip 10.0.40.0 0.0.3.255 192.168.146.0 0.0.4.255
150 deny ip 10.0.40.0 0.0.3.255 10.0.8.0 0.0.3.255
160 deny ip 10.0.40.0 0.0.3.255 10.0.12.0 0.0.1.255
170 deny ip 10.0.40.0 0.0.3.255 10.0.40.0 0.0.3.255
180 deny ip 10.0.40.0 0.0.3.255 10.0.44.0 0.0.3.255
190 deny ip 10.0.44.0 0.0.3.255 192.168.146.0 0.0.4.255
200 deny ip 10.0.44.0 0.0.3.255 10.0.8.0 0.0.3.255
210 deny ip 10.0.44.0 0.0.3.255 10.0.12.0 0.0.1.255
220 deny ip 10.0.44.0 0.0.3.255 10.0.40.0 0.0.3.255
230 deny ip 10.0.44.0 0.0.3.255 10.0.44.0 0.0.3.255
240 permit ip 192.168.150.0 0.0.1.255 any (20325248 matches)
250 permit ip 192.168.152.0 0.0.1.255 any
260 permit ip 192.168.153.0 0.0.0.255 any
270 permit ip 10.0.8.0 0.0.3.255 any (7381154 matches)
280 permit ip 10.0.12.0 0.0.1.255 any (430120 matches)
290 permit ip 10.0.40.0 0.0.3.255 any (672384 matches)
300 permit ip 10.0.44.0 0.0.3.255 any (2 matches)
310 deny ip 192.168.146.0 0.0.4.255 192.168.146.0 0.0.4.255
320 deny ip 192.168.146.0 0.0.4.255 10.0.8.0 0.0.3.255
Extended IP access list VPDNSplitTunnel
10 permit ip 192.168.150.0 0.0.1.255 192.168.150.0 0.0.1.255
20 permit ip 192.168.150.0 0.0.1.255 192.168.152.0 0.0.0.255
30 permit ip 192.168.152.0 0.0.0.255 192.168.150.0 0.0.1.255
40 permit ip 192.168.152.0 0.0.0.255 192.168.152.0 0.0.0.255
Extended IP access list acl-nat
10 permit ip object-group og-rfc1918 any
20 permit ip any object-group og-rfc1918
30 deny ip object-group og-rfc1918 object-group og-rfc1918
Extended IP access list acl-static-nat
10 permit ip object-group og-rfc1918 any (12138 matches)
20 permit ip any object-group og-rfc1918
30 deny ip object-group og-rfc1918 object-group og-rfc1918
Here is the config of the spoke router (Cisco 1921 Running 15.1) that is passing traffic over the tunnel. This is where i sourced my code for the spoke that is not working
interface Tunnel0
bandwidth 10000
ip unnumbered GigabitEthernet0/0
tunnel source GigabitEthernet0/1
tunnel mode ipsec ipv4
tunnel destination (IP Removed)
tunnel path-mtu-discovery
tunnel protection ipsec profile Mesh-VPN
router eigrp 1
network 192.168.153.0
passive-interface default
no passive-interface Tunnel0
no passive-interface Tunnel1
Here are the results of the show commands EIGRP neighbor and ip access-lists on the Spoke Router that is passing Traffic
PAFiberRou#show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(1)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 192.168.150.1 Tu0 14 6d02h 17 200 0 867
PAFiberRou#show ip access-list
Standard IP access list Management
10 permit (IP Removed), wildcard bits 0.0.0.3
20 permit 192.168.150.0, wildcard bits 0.0.0.255 (10 matches)
30 permit 192.168.153.0, wildcard bits 0.0.0.255
Extended IP access list InternetIn
10 permit tcp any any eq 22 (38338 matches)
20 permit udp any any eq isakmp (2885 matches)
30 permit udp any any eq non500-isakmp (45565572 matches)
40 permit esp any any (373917919 matches)
Extended IP access list NAT
10 deny ip 192.168.150.0 0.0.1.255 192.168.153.0 0.0.0.255 (26 matches)
20 deny ip 192.168.152.0 0.0.7.255 192.168.153.0 0.0.0.255 (2440069 matches)
30 permit ip 192.168.153.0 0.0.0.255 any (5027871 matches)
Extended IP access list VPDNSplitTunnel
10 permit ip 192.168.150.0 0.0.1.255 192.168.153.0 0.0.0.255
20 permit ip 192.168.152.0 0.0.7.255 192.168.153.0 0.0.0.255
