DMVPN: Too many spoke to spoke tunnels created!

[lap]

Hi all,

We have a customer wiht a DMVPN network phase 2. There are around 40 spokes. What I can see on all the spokes is between 10 and 15 IPsec spoke to spoke tunnels which is really strange as most of the spoke locations should only have between 1 to 4 spoke to spoke tunnels maximum.

My question is what could cause the spoke routers to create an IPsec spoke to spoke tunnel? Some weired applications?

IOS version: 12.4(15)T11 Platform: Cisco 1812.

Best regards,

Laurent

[ajay chauhan]

Its all depend on traffic between spoke to spoke and DMVPN is ment for that only ,if there will be interesting traffic Ipsec tunnel will be formed.

[lap]

Hi,

But there may be an apllication that trigger this Spoke to spoke tunnels?

I cannot in the inspect sessions the IP of the destination spokes. So it looks it is a quick trigger, then inspect session time ud og IPsec SAs stayded for the defaut life time.

Regards,

Laurent

[ajay chauhan]

You can also verify with " show crypto ipsec sa " if the traffic is passing over tunnel.

[lap]

Most the Spoke Spoke tunnels haven't any packets encrypted.

Regards,

Laurent

[ajay chauhan]

Then tunnels will teardown after sometime should not be issue .

[lap]

Does the SAs cosume any ressource on the router?

[ajay chauhan]

Actual resources are consumed when encryption/decryption is there for traffic and performamce  depends upon the hardware you using.

[lap]

Thanks a lot!