CloudLabBox
Try the free demo

CCIE Enterprise Infrastructure practice lab 4 of 8

DMVPN Phase 3 dual-hub fault hunt

You inherit a dual-hub DMVPN with front-door VRFs, IKEv2 and EIGRP that has never worked properly. Find and fix nine faults, layer by layer, prove shortcuts and hub failover with a fault injector, then add a static GRE tunnel and an IPv6 overlay. A 3 to 4 hour practice lab that starts broken.

Run this lab

It needs Standard: its 9 nodes are set to 9 vCPU and 4,608 MB in total.

In your workspace: Shared, then CCIE Enterprise Infrastructure practice guided labs, then 04 - DMVPN Phase 3 dual-hub fault hunt

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 9 vCPU and 4,608 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 210 minutes
Nodes need
9 vCPU, 4,608 MB
Smallest plan
Standard

The scenario

Halden Freight's last network engineer left halfway through a WAN migration. The design below is what the company paid for. What's on the routers is what he left. Some sites have never joined, some work only through one hub, and nobody has ever tested a hub failure.

                      10.4.100.0/24
                          DC1 -------------- ISP  (for the GRE tunnel only)
                         /   \
                     HUB1     HUB2           primary and backup hub
                       \       /
                     +---------+
                     |   ISP   |             Internet, public addresses only
                     +---------+
                    /  |     |  \    \
                 SP1  SP2   SP3  SP4  PARTNER
Design itemStandard
UnderlayEach hub and spoke WAN interface sits in VRF INET with a default route to ISP.
OverlayTunnel0, 10.4.0.0/24, GRE multipoint, tunnel key 100, NHRP authentication HALDEN, NHRP Phase 3
CryptoIKEv2 with pre-shared key Halden-Dmvpn-2026, ESP AES-256 and SHA-256 in transport mode
HubsHUB1 192.0.2.2 is primary and HUB2 192.0.2.6 is backup. Every spoke registers with both, all the time.
RoutingEIGRP named HALDEN, AS 100. Hubs send spokes only 10.0.0.0/8, and spokes are stubs. Hellos 5 seconds, hold 15.
Tunnel MTU1400 bytes on every overlay interface, and TCP MSS 1360
Spoke to spokeDirect, after the first packets, through NHRP shortcuts. Encrypted spoke to spoke as well.

Addressing

DeviceInterfaceAddressConnects to
ISPLo010.255.4.254/32
ISPGi0/0192.0.2.1/30HUB1 Gi0/0
ISPGi0/1192.0.2.5/30HUB2 Gi0/0
ISPGi0/2192.0.2.9/30SP1 Gi0/0
ISPGi0/3192.0.2.13/30SP2 Gi0/0
ISPGi0/4192.0.2.17/30SP3 Gi0/0
ISPGi0/5192.0.2.21/30SP4 Gi0/0
ISPGi0/6192.0.2.25/30PARTNER Gi0/0
ISPGi0/7192.0.2.29/30DC1 Gi0/2
HUB1Gi0/0192.0.2.2/30ISP Gi0/0
HUB1Lo010.255.4.1/32
HUB1Tunnel010.4.0.1/24
HUB1Gi0/110.4.101.1/30DC1 Gi0/0
HUB2Gi0/0192.0.2.6/30ISP Gi0/1
HUB2Lo010.255.4.2/32
HUB2Tunnel010.4.0.2/24
HUB2Gi0/110.4.102.1/30DC1 Gi0/1
DC1Lo010.255.4.100/32
DC1Lo1010.4.100.1/24, 2001:db8:4:100::1/64
DC1Gi0/010.4.101.2/30HUB1 Gi0/1
DC1Gi0/110.4.102.2/30HUB2 Gi0/1
DC1Gi0/2192.0.2.30/30ISP Gi0/7
SP1Gi0/0192.0.2.10/30ISP Gi0/2
SP1Lo010.255.4.11/32
SP1Lo1010.4.11.1/24, 2001:db8:4:11::1/64
SP1Tunnel010.4.0.11/24
SP2Gi0/0192.0.2.14/30ISP Gi0/3
SP2Lo010.255.4.12/32
SP2Lo1010.4.12.1/24, 2001:db8:4:12::1/64
SP2Tunnel010.4.0.12/24
SP3Gi0/0192.0.2.18/30ISP Gi0/4
SP3Lo010.255.4.13/32
SP3Lo1010.4.13.1/24, 2001:db8:4:13::1/64
SP3Tunnel010.4.0.13/24
SP4Gi0/0192.0.2.22/30ISP Gi0/5
SP4Lo010.255.4.14/32
SP4Lo1010.4.14.1/24, 2001:db8:4:14::1/64
SP4Tunnel010.4.0.14/24
PARTNERLo1010.4.200.1/24
PARTNERGi0/0192.0.2.26/30ISP Gi0/6

Rules for the whole lab

  • Fix each fault where it is. Don't rebuild tunnels, rename objects or remove the VRF design, and don't reload anything.
  • ISP is outside your control.
  • Crypto may not be turned off, even for a test. Nothing in the global routing table may route to a public address, apart from the two host routes for the partner tunnel.
  • Don't remove the LAB-FAIL-* applets.

What you’ll practise

  • Troubleshoot DMVPN from the underlay up: IKEv2, IPsec, GRE, NHRP and the routing protocol
  • Prove spoke-to-spoke shortcuts and dual-hub failover by what traffic does
  • Find latent faults that only appear when the primary hub fails
  • Build a static GRE tunnel with keepalives, and an IPv6 overlay on the same DMVPN

The tasks

  • Section 1: Tickets 1 to 4: bring every site onto the overlay (30 points)
  • Section 2: Tickets 5 to 7: make Phase 3 work (24 points)
  • Section 3: Tickets 8 and 9: faults nobody has seen yet (16 points)
  • Section 4: Static GRE to the partner (12 points)
  • Section 5: An IPv6 overlay (18 points)

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of DMVPN Phase 3 dual-hub fault hunt9 nodes, 10 links. Every link is listed as text below the diagram.ISPHUB1HUB2DC1SP1SP2SP3SP4PARTNERGi0/4Gi0/0Gi0/0Gi0/0Gi0/1Gi0/0Gi0/3Gi0/0Gi0/1Gi0/0Gi0/1Gi0/1Gi0/7Gi0/2Gi0/5Gi0/0Gi0/2Gi0/0Gi0/6Gi0/0
9 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP Gi0/0 to HUB1 Gi0/0
  • ISP Gi0/1 to HUB2 Gi0/0
  • ISP Gi0/2 to SP1 Gi0/0
  • ISP Gi0/3 to SP2 Gi0/0
  • ISP Gi0/4 to SP3 Gi0/0
  • ISP Gi0/5 to SP4 Gi0/0
  • ISP Gi0/6 to PARTNER Gi0/0
  • ISP Gi0/7 to DC1 Gi0/2
  • HUB1 Gi0/1 to DC1 Gi0/0
  • HUB2 Gi0/1 to DC1 Gi0/1
Nodes in DMVPN Phase 3 dual-hub fault hunt, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
HUB1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
HUB2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
DC1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SP1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SP2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SP3Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SP4Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PARTNERCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCIE Enterprise Infrastructure practice guided labs.

  3. Open 04 - DMVPN Phase 3 dual-hub fault hunt and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCIE Enterprise Infrastructure practice labs

All CCIE Enterprise Infrastructure practice labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.