From: xiongxiaogang (xiongxg@msn.com)
Date: Thu Jan 10 2008 - 16:31:19 ARST
Hi,
I configure dmvpn between one hub and two spokes, the tunnels of spoke-to-spoke and spoke-to-hub both work, but I found there is a weired problem, that is if I only ping from one spoke to the other spoke, it works normally, but meanwhile if I also ping a spoke to the hub, although tunnel is up normally, but the tunnel cannot keep up always, it becoming down when ip nhrp expires, and the worse is eigrp neighbor between hub and spoke is affected by the disconnect tunnel, when ip nhrp expires, eigrp neighbor between hub and spoke is down with the error message "*Jan 5 17:32:02.743: %CRYPTO-4-RECVD_PKT_NOT_IPSEC: Rec'd packet not an IPSEC packet. (ip) vrf/dest_addr= /105.1.2.5, src_addr= 105.1.50.2, prot= 47..."
when the eigrp neigbhor is down, even if you ping from spoke to hub, cannot enable tunnel up. so I have to go to spoke and shut/no shut tunnel interface to resolve it. but I do not think
it is a good solution, considering in the real world, cannot always let the router administrator to login to the spoke router and shut/no shut tunnel interface to let the traffic between spokes and hub to go through, and in the lab exam, considering proctor maybe see the error message if he have ever ping from spoke to hub and provided you set the ip nhrp holdtime to 300 seconds, it is expected that the proctor will see the error message after 5 minutes and he know the eigrp neighbor is down.
so I doubt the solution could be improved in some place, but I read a lot of dmvpn documents, including the long thread discuss about the dmvpn in the forum, but have no idea now, I am wondering who can throw me a light for it, I am very appreciate of it.
Regards
Steven
This archive was generated by hypermail 2.1.4 : Fri Feb 01 2008 - 10:37:58 ARST