Spoke stuck on IKE state in DMVPN

[INBK-IT]

Hi,

We have mGRE DMVPN tunnle between one Hub and 7 Spokes. Other 6 Spokes are working fine but one Spoke is not connecting to Hub.

Spoke shows DMVPN on IKE state (tunnle is not working) and Hub is not adding nhrp entry in table.

Spoke DMVPN Tunnel

Please help.

[MHM Cisco World]

you need to check matching
1- phaseI SA
2- PhaseII SA
3- Isakmp key 
MHM

[INBK-IT]

Hub:

Spoke:

When I do  Show crypto isakmp sa on Spoke it is empty same in Hub it dosen't show this Spoke5's entry.

[MHM Cisco World]

Debug crypto isakmp

Show crypto isakmp sa

Share this

MHM

[INBK-IT]

@MHM Cisco World 

This is what is see debug crypto isakmp

Hub:

Spoke:

Show crypto isakmp sa on Spoke it is empty same in Hub it dosen't show this Spoke5's entry.

[MHM Cisco World]

Hmm, 
first use tunnel mode 
second config keepalive in both Hub and Spokes

MHM

[INBK-IT]

@MHM Cisco World 

Tunnel mode is already set as gre multipoint on both side.

I searched and found out keepalives is not supported on DMVPN. Where and how do you want me to config keepalive on Hub and Spoke?

[MHM Cisco World]

Keepalive of isamkp

And tunnel mode of crypto ipsec trans

MHM

[INBK-IT]

@MHM Cisco World 

I inserted keepalive command for ISAKMP and now I see QM_IDLE state in both Hub & Spoke for each other when I do sh cryprto isakmp sa.

Also, I do see in Hub details when I do sh crypto ipsec sa in Spoke but when I do sh crypto ipsec sa in a Hub I do not see Spoke details.

Now, when I do sh dmvpn in Spoke it shows NHRP State all the time and in Hub dosen't show entry of this spoke. 

IPsec Transform-Sets are already sets in both Hub and Spoke from beginning.

Hub:

Spoke:

[MHM Cisco World]

This meanly issue of NHRP register'

And try use 

Mode tunnel under crypto ipsec trans

You still use transport mode in hub.

Please share the config of ipsec all in spoke

Thanks 

MHM

[INBK-IT]

@MHM Cisco World 

Yes you are right, there is an issue with NHRP Registration.

Don't want to change tunnel mode in Hub because other Spokes are connected and don't want mess with them.

Also, this Spoke was working with transport mode. 

[MHM Cisco World]

it OK, in real you dont need to change the mode in Hub

you can change it in spoke only ( I am talking about mode tunnel)
for point it was work and now it not 
are the spoke WAN interface use DHCP or PPPoE to get IP ?

MHM

[INBK-IT]

@MHM Cisco World 

As you recommended, I changed mode tunnel for Spoke.

This is what is see in Hub-sh log

And Spoke WAN Interface do not use DHCP or PPPoE to get IP.

[INBK-IT]

This is what I see in Spoke's log:

[MHM Cisco World]

I run Lab and the transport mode is not effect NHRP register 
so, retrun back use transport mode in Spoke 
share the 
show dmvpn detail <<- in spoke and Hub (for onyl this spoke)
and run 

debug nhrp packet <<- in spoke only 

share this 

MHM