A minor correction: When I redacted the details, I changed the tunnel key at each side to a different one. In fact, the keys are identical, just not listed as such in my original e-mail.
Thanks to David for pointing that out! -- Stephen Stephen Fulton wrote: > Hi all, > > I've got a set up which has DMVPN working fine with a dozen remote > locations, except for one. The hub is a 2811 running > c2800nm-advipservicesk9-mz.124-9.T1.bin, and the problem spoke is an > older 1721 running c1700-advipservicesk9-mz.123-23.bin. Essentially the > tunnel is not coming up between the hub and spoke, and the only clue > I've seen in debug nhrp is the following: > > Sep 7 03:31:06.460: NHRP: Attempting to send packet via DEST 128.1.254.4 > Sep 7 03:31:06.460: NHRP: Send Error Indication via Tunnel0, packet > size: 94 > Sep 7 03:31:06.460: src: 128.1.254.1, dst: 128.1.254.4 > Sep 7 03:31:06.460: NHRP: Encapsulation failed for destination > 128.1.254.4 out Tunnel0 > > The crypto map configuration on the spoke is identical to all the other > spokes, which work perfectly. Mind you, those are more recent routers > (2611XM's, 2811's, 1841's etc). > > The spoke is a PPPoE connection, which the static IP configured on > Loopback1 and the dialer interface using ip unnumbered Loopback1 > > Here's a redacted copy of the tunnel config for both the hub and problem > spoke: > > Hub: > > interface Tunnel0 > description VPN GRE Tunnel Template > ip vrf forwarding CUSTOMER-VRF > ip address 128.1.254.1 255.255.255.0 > no ip redirects > ip mtu 1400 > ip nhrp authentication PASSWD12 > ip nhrp map multicast dynamic > ip nhrp network-id 1 > ip nhrp holdtime 300 > no ip route-cache cef > no ip route-cache > no ip mroute-cache > ip ospf network broadcast > ip ospf priority 255 > delay 1000 > keepalive 10 3 > tunnel source FastEthernet0/0 > tunnel mode gre multipoint > tunnel key 123 > tunnel protection ipsec profile VPN-PROFILE shared > > > Spoke: > > interface Tunnel0 > ip address 128.1.254.4 255.255.255.0 > no ip redirects > ip mtu 1400 > ip nhrp authentication PASSWD12 > ip nhrp map multicast dynamic > ip nhrp map 128.1.254.1 1.2.3.4 > ip nhrp map multicast 1.2.3.4 > ip nhrp network-id 1 > ip nhrp holdtime 300 > ip nhrp nhs 128.1.254.1 > no ip route-cache cef > no ip route-cache > no ip mroute-cache > ip ospf network broadcast > ip ospf mtu-ignore > delay 1000 > keepalive 10 3 > tunnel source Loopback1 > tunnel mode gre multipoint > tunnel key 0 > tunnel protection ipsec profile VPN-PROFILE > > > Any thoughts? > > -- Stephen. > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
