I have a DMVPN spoke router setup almost identically to the spoke configuration listed here (Also quoted below): https://www.cisco.com/c/en/us/support/docs/security-vpn/dynamic-multi-point-vpn-dmvpn/119022-configure-dmvpn-00.html
In short, each ISP's WAN IP and default route are in its own VRF. The two tunnels each use a different VRF/ISP to go to their respective hub router. The global routing table contains only the LAN and other networks learned by EIGRP coming through the VPN tunnels.
This setup is working very well and failover times for the VPNs are great, though I was hoping to figure out the best way to have the LAN on this router get NAT/default route for internet access when each ISP in a VRF.
Normally I'd just do an IP SLA on one default route, but I don't really know where to begin with VRFs being involved.
version 15.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname SPOKE1 ! vrf definition ISP1 rd 1:1 ! address-family ipv4 exit-address-family ! vrf definition ISP2 rd 2:2 ! address-family ipv4 exit-address-family ! crypto keyring ISP2 vrf ISP2 pre-shared-key address 0.0.0.0 0.0.0.0 key cisco123 crypto keyring ISP1 vrf ISP1 pre-shared-key address 0.0.0.0 0.0.0.0 key cisco123 ! crypto isakmp policy 1 encr aes 256 hash sha256 authentication pre-share group 24 crypto isakmp keepalive 10 periodic ! crypto ipsec transform-set transform-dmvpn esp-aes 256 esp-sha256-hmac mode transport ! ! crypto ipsec profile profile-dmvpn set transform-set transform-dmvpn ! interface Loopback10 ip address 192.168.1.1 255.255.255.0 ! interface Tunnel0 description Primary mGRE interface source as Primary ISP bandwidth 1000 ip address 10.0.0.10 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp network-id 100000 ip nhrp holdtime 600 ip nhrp nhs 10.0.0.1 nbma 172.16.0.1 multicast ip nhrp shortcut ip tcp adjust-mss 1360 delay 1000 tunnel source Ethernet0/0 tunnel mode gre multipoint tunnel key 100000 tunnel vrf ISP1 tunnel protection ipsec profile profile-dmvpn ! interface Tunnel1 description Secondary mGRE interface source as Secondary ISP bandwidth 1000 ip address 10.0.1.10 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp network-id 100001 ip nhrp holdtime 360 ip nhrp nhs 10.0.1.1 nbma 172.16.0.1 multicast ip nhrp shortcut ip tcp adjust-mss 1360 delay 1500 tunnel source Ethernet0/1 tunnel mode gre multipoint tunnel key 100001 tunnel vrf ISP2 tunnel protection ipsec profile profile-dmvpn ! interface Ethernet0/0 description Primary ISP vrf forwarding ISP1 ip address 198.51.100.1 255.255.255.0 ! interface Ethernet0/1 description Seconday ISP vrf forwarding ISP2 ip address 203.0.113.1 255.255.255.0 ! router eigrp 1 network 10.0.0.0 0.0.0.255 network 10.0.1.0 0.0.0.255 network 192.168.0.0 0.0.255.255 ! ip route vrf ISP1 0.0.0.0 0.0.0.0 198.51.100.254 ip route vrf ISP2 0.0.0.0 0.0.0.0 203.0.113.254 ! logging dmvpn ! end