CloudLabBox
Try the free demo

CCNP ENARSI lab 24 of 35

Troubleshooting DMVPN

Six faults stop Ibis Pharmacy's encrypted phase 3 DMVPN from working: registrations fail, an IKE negotiation is rejected, a spoke has no routing neighbour, branches can't reach head office and spoke-to-spoke traffic never goes direct. Work layer by layer: underlay, IPsec, NHRP, routing, phase 3.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 2,560 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNP ENARSI 300-410 guided labs, then 24 - Troubleshooting DMVPN

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 80 minutes
Nodes need
5 vCPU, 2,560 MB
Smallest plan
Lite

The scenario

Ibis Pharmacy rebuilt its DMVPN routers from a template after a security audit, and Monday morning is chaos. The design (lab 23) is unchanged: phase 3 DMVPN on Tunnel0 (172.16.0.0/24), NHRP network ID 100, NHRP authentication **DMVPNKEY, tunnel key 100, the hub (172.16.0.1, NBMA 198.51.100.1) as the only NHS, EIGRP AS 10 with the hub sending only the summary 10.0.0.0/8**, NHRP redirect on the hub and shortcuts on the spokes, and every tunnel protected by IPsec profile DMVPN-PROF with the IKEv2 pre-shared key **Ibis-Dmvpn-Psk**.

Tickets:

  1. "BR2 isn't in the hub's DMVPN table."
  2. "BR3's tunnel never comes up; the hub logs IKE errors."
  3. "BR4 shows nothing useful in show dmvpn."
  4. "Once BR4 was registered, it still had no EIGRP neighbour." (you'll see this after fixing ticket 3)
  5. "Branches that are connected can't reach the head-office servers on 10.1.1.0/24."
  6. "Branch-to-branch video calls are choppy: traffic always goes through head office."
DevicePublic (NBMA) addressTunnel0LAN
HUB198.51.100.1172.16.0.1/2410.1.1.0/24
BR2203.0.113.2172.16.0.2/2410.2.2.0/24
BR3203.0.113.6172.16.0.3/2410.3.3.0/24
BR4203.0.113.10172.16.0.4/2410.4.4.0/24

What you’ll practise

  • Troubleshoot DMVPN in layers: underlay, IKE/IPsec, GRE/NHRP, routing protocol, data path
  • Read show dmvpn, show ip nhrp, show crypto ikev2 sa and NHRP and IKE logs
  • Diagnose NHS, NHRP authentication and multicast mapping mistakes
  • Diagnose an IKEv2 pre-shared key mismatch
  • Diagnose summary and NHRP redirect faults that break phase 3

The tasks

  1. Work bottom-up
  2. Fix registration and encryption (tickets 1–3)
  3. Fix the routing problems (tickets 4 and 5)
  4. Fix spoke-to-spoke (ticket 6)

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshooting DMVPN5 nodes, 4 links. Every link is listed as text below the diagram.HUBISPBR2BR3BR4Gi0/0Gi0/0Gi0/0Gi0/2Gi0/0Gi0/1Gi0/0Gi0/3
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HUB Gi0/0 to ISP Gi0/0
  • BR2 Gi0/0 to ISP Gi0/1
  • BR3 Gi0/0 to ISP Gi0/2
  • BR4 Gi0/0 to ISP Gi0/3
Nodes in Troubleshooting DMVPN, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HUBCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
BR2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
BR3Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
BR4Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENARSI 300-410 guided labs.

  3. Open 24 - Troubleshooting DMVPN and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENARSI labs

All CCNP ENARSI labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.