nerdexam
Cisco

300-730 · Question #168

A Cisco IOS router is reconfigured to connect to an additional DMVPN hub that is a part of a different DMVPN phase 3 cloud . After this change was made, users began to experience problems accessing co

The correct answer is D. Specify the tunnel destination in each tunnel. E. Assign a unique tunnel key to each tunnel.. When two DMVPN tunnels share the same physical interface, a unique tunnel key and an explicit tunnel destination are required to correctly disambiguate GRE traffic between the two separate DMVPN clouds.

Troubleshooting VPNs

Question

A Cisco IOS router is reconfigured to connect to an additional DMVPN hub that is a part of a different DMVPN phase 3 cloud . After this change was made, users began to experience problems accessing corporate resources over both tunnels. Before the additional tunnel was created, users could access resources over the first tunnel without any issues. Both tunnels terminate on the same interface of the router and use the same IPsec proposals. Which two actions resolve the issue without affecting spoke-to-spoke traffic in either DMVPN cloud? (Choose two.)

Options

  • AEnable dead peer detection for both tunnels.
  • BUse the same shared IPsec pre-key for both tunnels.
  • CConfigure the same NHRP network IDs for both tunnels.
  • DSpecify the tunnel destination in each tunnel.
  • EAssign a unique tunnel key to each tunnel.

How the community answered

(53 responses)
  • A
    13% (7)
  • B
    8% (4)
  • C
    25% (13)
  • D
    55% (29)

Why each option

When two DMVPN tunnels share the same physical interface, a unique tunnel key and an explicit tunnel destination are required to correctly disambiguate GRE traffic between the two separate DMVPN clouds.

AEnable dead peer detection for both tunnels.

Dead peer detection monitors tunnel liveliness and triggers failover for failed peers, but does not resolve the GRE packet ambiguity caused by two active tunnels sharing the same interface without differentiation.

BUse the same shared IPsec pre-key for both tunnels.

Using the same pre-shared key for both tunnels introduces a security risk and does not address the GRE disambiguation problem; each DMVPN cloud should use its own key.

CConfigure the same NHRP network IDs for both tunnels.

Configuring the same NHRP network ID on both tunnels would merge them into a single NHRP domain, causing mappings to be shared incorrectly across clouds and breaking spoke-to-spoke traffic in both.

DSpecify the tunnel destination in each tunnel.Correct

Specifying an explicit tunnel destination for each GRE tunnel interface ties each tunnel to its respective hub router, preventing NHRP registrations and data traffic from being misrouted between the two distinct DMVPN clouds.

EAssign a unique tunnel key to each tunnel.Correct

Assigning a unique tunnel key to each tunnel interface allows the router to distinguish GRE-encapsulated packets belonging to each individual DMVPN cloud when multiple mGRE tunnels share the same source interface, eliminating the session confusion that was disrupting both tunnels.

Concept tested: DMVPN dual-cloud tunnel key and destination disambiguation

Source: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/41940-dmvpn.html

Topics

#DMVPN#multiple hubs#tunnel key#NHRP

Community Discussion

No community discussion yet for this question.

Full 300-730 Practice