Hi all, I've got a set up which has DMVPN working fine with a dozen remote locations, except for one. The hub is a 2811 running c2800nm-advipservicesk9-mz.124-9.T1.bin, and the problem spoke is an older 1721 running c1700-advipservicesk9-mz.123-23.bin. Essentially the tunnel is not coming up between the hub and spoke, and the only clue I've seen in debug nhrp is the following:
Sep 7 03:31:06.460: NHRP: Attempting to send packet via DEST 128.1.254.4 Sep 7 03:31:06.460: NHRP: Send Error Indication via Tunnel0, packet size: 94 Sep 7 03:31:06.460: src: 128.1.254.1, dst: 128.1.254.4 Sep 7 03:31:06.460: NHRP: Encapsulation failed for destination 128.1.254.4 out Tunnel0 The crypto map configuration on the spoke is identical to all the other spokes, which work perfectly. Mind you, those are more recent routers (2611XM's, 2811's, 1841's etc). The spoke is a PPPoE connection, which the static IP configured on Loopback1 and the dialer interface using ip unnumbered Loopback1 Here's a redacted copy of the tunnel config for both the hub and problem spoke: Hub: interface Tunnel0 description VPN GRE Tunnel Template ip vrf forwarding CUSTOMER-VRF ip address 128.1.254.1 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication PASSWD12 ip nhrp map multicast dynamic ip nhrp network-id 1 ip nhrp holdtime 300 no ip route-cache cef no ip route-cache no ip mroute-cache ip ospf network broadcast ip ospf priority 255 delay 1000 keepalive 10 3 tunnel source FastEthernet0/0 tunnel mode gre multipoint tunnel key 123 tunnel protection ipsec profile VPN-PROFILE shared Spoke: interface Tunnel0 ip address 128.1.254.4 255.255.255.0 no ip redirects ip mtu 1400 ip nhrp authentication PASSWD12 ip nhrp map multicast dynamic ip nhrp map 128.1.254.1 1.2.3.4 ip nhrp map multicast 1.2.3.4 ip nhrp network-id 1 ip nhrp holdtime 300 ip nhrp nhs 128.1.254.1 no ip route-cache cef no ip route-cache no ip mroute-cache ip ospf network broadcast ip ospf mtu-ignore delay 1000 keepalive 10 3 tunnel source Loopback1 tunnel mode gre multipoint tunnel key 0 tunnel protection ipsec profile VPN-PROFILE Any thoughts? -- Stephen. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
