Comments on: DMVPN Explained http://blog.ine.com/2008/08/02/dmvpn-explained/ Helping you become a Cisco Certified Internetwork Expert Wed, 10 Mar 2010 16:27:50 -0800 http://wordpress.org/?v=2.8.6 hourly 1 By: Zen http://blog.ine.com/2008/08/02/dmvpn-explained/comment-page-1/#comment-95317 Zen Mon, 22 Feb 2010 11:01:43 +0000 http://blog.ine.com/?p=214#comment-95317 About my above post, i think it could help someone on the same foot. After implementing the following command I havent noticed anymore weird nhrp registers, and also we changed the address which crypto should allow to make a request for registers. crypto isakmp aggressive-mode disable crypto isakmp key 0 CISCO address [b]ActualIPAdress[/b] About my above post, i think it could help someone on the same foot.

After implementing the following command I havent noticed anymore weird nhrp registers, and also we changed the address which crypto should allow to make a request for registers.

crypto isakmp aggressive-mode disable
crypto isakmp key 0 CISCO address [b]ActualIPAdress[/b]

]]> By: Ali http://blog.ine.com/2008/08/02/dmvpn-explained/comment-page-1/#comment-89881 Ali Wed, 20 Jan 2010 10:44:33 +0000 http://blog.ine.com/?p=214#comment-89881 Can I implement a Laptop installed with Cisco VPN client as a DMVPN Spoke Site, LIke for eg. I have an employee working from a remote location and has internet connectivity and needs to access other spokes too , directly without the traffic being sent from the laptop to the hub and then to the other remote site, instead a dynamic tunnel needs to be created from the Laptop to the other spoke? Is it possible to implement DMVPN/NHRP on a Cisco VPN client? Can I implement a Laptop installed with Cisco VPN client as a DMVPN Spoke Site, LIke for eg. I have an employee working from a remote location and has internet connectivity and needs to access other spokes too , directly without the traffic being sent from the laptop to the hub and then to the other remote site, instead a dynamic tunnel needs to be created from the Laptop to the other spoke?

Is it possible to implement DMVPN/NHRP on a Cisco VPN client?

]]> By: Zen http://blog.ine.com/2008/08/02/dmvpn-explained/comment-page-1/#comment-86795 Zen Mon, 28 Dec 2009 14:08:19 +0000 http://blog.ine.com/?p=214#comment-86795 Hello, I implemented DMVPN a while ago, and used to work great. Recently I noticed memory & cpu usages going very high, and when I checked with show processes cpu , I saw that NHRP was using 40-60% of the CPU constantly. I ran show ip nhrp , and the results really frightened me, there are lots of unknown ip address in there , same is happening on my Hub and on Spokes. Here's one of the many entries: 97.100.x.x/32 via 192.168.x.1 Tunnel0 created 00:00:03, expire 00:05:58 Type: dynamic, Flags: router There are many other different IP addresses that look like the one above, any idea whats going on? Hello,

I implemented DMVPN a while ago, and used to work great.
Recently I noticed memory & cpu usages going very high, and when I checked with show processes cpu , I saw that NHRP was using 40-60% of the CPU constantly.

I ran show ip nhrp , and the results really frightened me, there are lots of unknown ip address in there , same is happening on my Hub and on Spokes.

Here’s one of the many entries:

97.100.x.x/32 via 192.168.x.1
Tunnel0 created 00:00:03, expire 00:05:58
Type: dynamic, Flags: router

There are many other different IP addresses that look like the one above, any idea whats going on?

]]> By: Sinisa http://blog.ine.com/2008/08/02/dmvpn-explained/comment-page-1/#comment-83981 Sinisa Wed, 09 Dec 2009 11:03:22 +0000 http://blog.ine.com/?p=214#comment-83981 @Naru You can use ip sla traps and snmp. @Naru

You can use ip sla traps and snmp.

]]> By: Naru http://blog.ine.com/2008/08/02/dmvpn-explained/comment-page-1/#comment-73893 Naru Thu, 22 Oct 2009 12:48:19 +0000 http://blog.ine.com/?p=214#comment-73893 I am currently using Orion SolarWinds NPM to monitor my nodes, though I needed to monitor the tunnels when they go up & down so I can send the report to my ISP, but I saw that even if the tunnel is not connected, it still shows as UP - UP, is there a way to change this behavior? For example, when you can't reach that tunnel, the tunnel should go like UP - DOWN , or if there's any other method to monitor those tunnels would be great. Thanks I am currently using Orion SolarWinds NPM to monitor my nodes, though I needed to monitor the tunnels when they go up & down so I can send the report to my ISP, but I saw that even if the tunnel is not connected, it still shows as UP – UP, is there a way to change this behavior? For example, when you can’t reach that tunnel, the tunnel should go like UP – DOWN , or if there’s any other method to monitor those tunnels would be great.

Thanks

]]> By: Sinisa http://blog.ine.com/2008/08/02/dmvpn-explained/comment-page-1/#comment-66960 Sinisa Tue, 22 Sep 2009 23:05:40 +0000 http://blog.ine.com/?p=214#comment-66960 This is a grat explanation of DMVPN, the best one I could find on the Internet. Question: I have DMVPN topology with two redundant NHSs (pointing each other) and several NHCs, and that topology works fine. Problem is when I shut NHS#1 (or it crashes) and bring it back, and then the same with NHS#2, my NHCs can't see each other any more. They even can't see NHSs, and NHSs can see only each other. I can only solve it by shut/no shut tunnel interfaces on NHCs. Is there a rule or a behaviour of NHRP that NHSs have to be configured first in network, then NHCs? I run multi area OSPF over multiple GRE tunnels, and it's all protected with IPSec. I have removed IPSec protection and OSPF in observed mGRE tunnel to have a clear situation. Any help? This is a grat explanation of DMVPN, the best one I could find on the Internet.

Question: I have DMVPN topology with two redundant NHSs (pointing each other) and several NHCs, and that topology works fine. Problem is when I shut NHS#1 (or it crashes) and bring it back, and then the same with NHS#2, my NHCs can’t see each other any more. They even can’t see NHSs, and NHSs can see only each other. I can only solve it by shut/no shut tunnel interfaces on NHCs.
Is there a rule or a behaviour of NHRP that NHSs have to be configured first in network, then NHCs?

I run multi area OSPF over multiple GRE tunnels, and it’s all protected with IPSec. I have removed IPSec protection and OSPF in observed mGRE tunnel to have a clear situation.

Any help?

]]> By: Naru http://blog.ine.com/2008/08/02/dmvpn-explained/comment-page-1/#comment-65668 Naru Mon, 14 Sep 2009 14:50:41 +0000 http://blog.ine.com/?p=214#comment-65668 Very nice explanation, keep the good work up! ;) Very nice explanation, keep the good work up! ;)

]]> By: Petr Lapukhov, CCIE #16379 http://blog.ine.com/2008/08/02/dmvpn-explained/comment-page-1/#comment-58834 Petr Lapukhov, CCIE #16379 Wed, 05 Aug 2009 04:13:43 +0000 http://blog.ine.com/?p=214#comment-58834 1) You need to use PIM-NBMA mode on the hub tunnel interface to allow for neighbor tracking and splitting the NBMA interface into a group of P2P links. This of course only works with PIM sparse. 2) With Phase 2, you need to configure every spoke with two NHS addresses and configure both NHSes to point to each other. This will ensure proper NHS cache syncrhonization. 2) With Phase 3, everythin should be working automatically, even if you have multiple spokes registering to different hubs, the chain of redirects is based on the routing topology, not the NHS connections. 1) You need to use PIM-NBMA mode on the hub tunnel interface to allow for neighbor tracking and splitting the NBMA interface into a group of P2P links. This of course only works with PIM sparse.
2) With Phase 2, you need to configure every spoke with two NHS addresses and configure both NHSes to point to each other. This will ensure proper NHS cache syncrhonization.
2) With Phase 3, everythin should be working automatically, even if you have multiple spokes registering to different hubs, the chain of redirects is based on the routing topology, not the NHS connections.

]]> By: ob http://blog.ine.com/2008/08/02/dmvpn-explained/comment-page-1/#comment-58515 ob Sat, 01 Aug 2009 16:27:44 +0000 http://blog.ine.com/?p=214#comment-58515 Great article! I have two questions though: 1) How do I get spoke-to-spoke multicasting to work. Even the simple "ping 224.0.0.1" on spokeA will not get a reply from spokeB, only the HUB. 2) How do I set up redundant NHS? Great article!

I have two questions though:

1) How do I get spoke-to-spoke multicasting to work. Even the simple “ping 224.0.0.1″ on spokeA will not get a reply from spokeB, only the HUB.

2) How do I set up redundant NHS?

]]> By: Security « CCIE Study Notes http://blog.ine.com/2008/08/02/dmvpn-explained/comment-page-1/#comment-47137 Security « CCIE Study Notes Tue, 12 May 2009 09:03:37 +0000 http://blog.ine.com/?p=214#comment-47137 [...] explained here but i’m out of steam for security today Comments [...] [...] explained here but i’m out of steam for security today Comments [...]

]]>