DMVPN and EIGRP

[rawsonfang]

Three sites, one hub and two spokes with DMVPN and eigrp deployed. The Hub site communicates with both spoke site properly, and have eigrp neighbor relationship with both spoke sites, but when initiates the IP traffic from one spoke site LAN the other spoke site 's LAN, we notice that the traffic route through the Hub site, instead of creating dynamical tunnel between the two spoke sites router, any idea??

[mheusinger]

Hello,

are you aware of the restrictions in this scenario?

According to "Dynamic Multipoint VPN (DMVPN)" found at

http://www.cisco.com/en/US/products/sw/iosswrel/ps1839/products_feature_guide09186a0080110ba1.html#wp1039490

you should take the following into consideration:

Restrictions for Dynamic Multipoint VPN (DMVPN)

•If you use the Dynamic Creation for Spoke-to-Spoke Tunnels benefit of this feature, you must use IKE Certificates or wildcard preshared keys for Internet Security Association Key Management Protocol (ISAKMP) authentication.

Note It is highly recommended that you do not use wildcard preshared keys because the attacker will have access to the VPN if one spoke router is compromised.

In addition, did you follow the configuration guidelines found in "Configuring Dynamic Multipoint VPN Using GRE Over IPSec With EIGRP, NAT, and CBAC"

at

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00801982ae.shtml

Hope this helps! Please rate all posts.

Regards, Martin