Solved: EIGRP Routing and DMVPN Tunnel issue

NPT_2 · ‎03-12-2010

I have redundant paths to a remote 2811 router from my host site network. The first links is a T1 frame relay connection that has been in place for years, and the new link is over a 54 Mbit fixed wireless link that was just recently established.

I am running EIGRP for my routing protocol process 100 for both links.

I have setup a DMVPN Tunnel between the remote 2811 and a 2851 router at my host site. The tunnel interface is showing up/up on both sides and I can ping the remote tunnel IP address from my host side networks.

However my eigrp routes are not propagating over this new tunnel link and if I run a show ip eigrp neighbor command on either router I only show the neighbor on the frame relay link and not the new wireless link.

What am I missing here?

A show tunnel0 shows the following:

Tunnel0 is up, line protocol is up
Hardware is Tunnel
Internet address is 10.x.x.x/24
MTU 1514 bytes, BW 54000 Kbit/sec, DLY 10000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel source 10.x.x.x (FastEthernet0/1), destination 172.x.x.x
Tunnel protocol/transport GRE/IP
    Key 0x186A0, sequencing disabled
    Checksumming of packets disabled
Tunnel TTL 255
Fast tunneling enabled
Tunnel transmit bandwidth 8000 (kbps)
Tunnel receive bandwidth 8000 (kbps)
Tunnel protection via IPSec (profile "CiscoCP_Profile1")
Last input 00:00:01, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 947
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
     880 packets input, 63000 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     910 packets output, 81315 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out

Federico Coto Fajardo · ‎03-16-2010

Please go ahead and add a static route on the Hub so it goes through the Wireless link and let me know if everything works fine.

Federico.

View solution in original post

Federico Coto Fajardo · ‎03-13-2010

Hi,

Is the 2851 configured as the Hub for the DMVPN network?

This is because the tunnel0 interface should be a mGRE interface, otherwise the tunnel interface will only go to a single destination (frame relay link).

Do you see the NHRP mappings for both connections?

Federico.

NPT_2 · ‎03-15-2010

Yes, the 2851 is the hub.

nhrp tunnels are up as shown below.

Hub Router

2851I#show ip nhrp
10.86.1.2/32 via 10.86.1.2, Tunnel0 created 2d18h, never expire
Type: static, Flags: authoritative used
NBMA address: 10.99.99.11

Remote Router

2811#show ip nhrp
10.86.1.1/32 via 10.86.1.1, Tunnel0 created 2d19h, never expire
Type: static, Flags: authoritative
NBMA address: 172.16.1.56
Orofino2811#

Federico Coto Fajardo · ‎03-15-2010

No L2 problems.

Most likely the issue is at L3.

Could you attach a sh run from both the Hub and the Spoke routers?

Federico.

NPT_2 · ‎03-15-2010

The configs for the VPN, interfaces, and routing are attached.

Federico Coto Fajardo · ‎03-15-2010

So, as I understand you have two links from the 2811 to the 2851.
This two links are the T1 and the Wireless.

T1 = Serial0/0/0 on 2811
Wireless = FastEthernet0/1 on 2811

Can you post the sh ip eigrp neigh on both routers?

Seems like a routing issue...
Why do you have this two commands on the remote 2811?
ip default-network 172.16.0.0
ip route 0.0.0.0 0.0.0.0 192.168.104.5

Federico.

NPT_2 · ‎03-16-2010

For redundancy the T1 at the remote site actually terminates at a separate router at my host site. The ip default-network 172.16.0.0 and
ip route 0.0.0.0 0.0.0.0 192.168.104.5 give me a default route back to our main site for Internet access for routes not defined explictly. I probably will eventually have to get rid of the second one since it only references the T1 and not the wireless link.

show ip eigrp nei from hub 2851:

VG2851LAPWAI#show ip eigrp nei
IP-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO Q Seq
                                            (sec)         (ms)       Cnt Num
5   10.86.1.2               Tu0               14 00:00:41    1 5000 2 0
4   192.168.******          Mu3               13 6d04h      38   228 0 688
3   192.168.******           Mu2               11 6d04h       5   200 0 3696
2   192.168.******         Mu1               13 6d04h       4   200 0 346
1   172.16.***             Gi0/0             12 6d04h       1   200 0 114
0   172.16.*******            Gi0/0             14 6d04h       1   200 0 614

show ip eigrp nei from remote 2811:

Orofino2811#show ip eigrp nei
IP-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO Q Seq
                                            (sec)         (ms)       Cnt Num
0   192.168.104.5           Se0/0/0.30        13 3d14h     103   618 0 612
Orofino2811#

It looks like I am seeing the neighbor over the wireless link on the hub site but not on the remote side.

Federico Coto Fajardo · ‎03-16-2010

So,

You have a DMVPN tunnel established between the 2851 and the 2811.
You are running EIGRP through the tunnel.
You're seeing the EIGRP peer 2811 from the 2851.
You're not seeing the EIGRP peer 2851 from the 2811.
Is this correct?

The sh ip eigrp neigh command on the hub shows the peer connection to the wireless Link.
The sh ip eigrp neigh command on the spoke does not show any IP for the Hub?
What IP should it show as the EIGRP peer, and can you PING that IP from the 2811's Wireless interface IP?

If for testing purposes you create a static route pointing to the local network at the Hub on the 2811,
you access the local network on the 2851?

Federico.

NPT_2 · ‎03-16-2010

You have a DMVPN tunnel established between the 2851 and the 2811.
You are running EIGRP through the tunnel.
You're seeing the EIGRP peer 2811 from the 2851.
You're not seeing the EIGRP peer 2851 from the 2811.
Is this correct?

This is correct

The sh ip eigrp neigh command on the hub shows the peer connection to the wireless Link.
The sh ip eigrp neigh command on the spoke does not show any IP for the Hub?

Correct

What IP should it show as the EIGRP peer, and can you PING that IP from the 2811's Wireless interface IP?

it should be 10.86.1.1 (the hub side of the tunnel) and I can't seem to ping that from the wireless interface IP

If for testing purposes you create a static route pointing to the local network at the Hub on the 2811,
you access the local network on the 2851?

This works if I use the local LAN IP as the source but I can't ping it if I use the 2811's wireless interface IP as the source IP.

Federico Coto Fajardo · ‎03-16-2010

So, the hub site has no knowledge on how to reach 10.99.99.x? It will send it out the default gateway.

If you check the routing table on the hub, there's no way to reach 10.99.99.x?

sh ip route

You have not included the 10.99.99.x in the EIGRP process on the spoke router either.

Federico.

NPT_2 · ‎03-16-2010

Ok, I added 10.99.99.x to the routing process at the spoke router. Now I have a route in the routing table on the hub router to 10.99.99.x but it goes through my T1 link and not my wireless link and I still don't show an eigrp neighbor on the wireless link from the spoke router.

Should I add a static route to the 10.99.99.x network on the hub router?

Federico Coto Fajardo · ‎03-16-2010

Please go ahead and add a static route on the Hub so it goes through the Wireless link and let me know if everything works fine.

Federico.

NPT_2 · ‎03-16-2010

Should I point that route to the tunnel or the next physical router connected?

Federico Coto Fajardo · ‎03-16-2010

The hub should have a route to reach the spoke pointing to the next-physical router.

I think that this link is pretty much your scenario:

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008014bcd7.shtml

Federico.

NPT_2 · ‎03-17-2010

Ok, I found my problem, or at least a solution.

By adding my eigrp neighbors manually to my routing process

I.E.

Router eigrp 100

neighbor 10.86.1.1 tunnel0

on both routers my eigrp neighbors came back up and my traffic is now routing and encrypting over the tunnel.

On a related note, any idea how much throughput I should expect max on this AES-256 tunnel between the 2851 and 2811. I seem to be getting a bit low of performance on this link (around 5 MB's of actual throughput) and have yet to determine whether this is due to the routers, the tunnel, or my wireless link itself. Latency is great only 5 ms across the tunnel.