300-730 · Question #168
A Cisco IOS router is reconfigured to connect to an additional DMVPN hub that is a part of a different DMVPN phase 3 cloud . After this change was made, users began to experience problems accessing co
The correct answer is D. Specify the tunnel destination in each tunnel. E. Assign a unique tunnel key to each tunnel.. When two DMVPN tunnels share the same physical interface, a unique tunnel key and an explicit tunnel destination are required to correctly disambiguate GRE traffic between the two separate DMVPN clouds.
Question
Options
- AEnable dead peer detection for both tunnels.
- BUse the same shared IPsec pre-key for both tunnels.
- CConfigure the same NHRP network IDs for both tunnels.
- DSpecify the tunnel destination in each tunnel.
- EAssign a unique tunnel key to each tunnel.
How the community answered
(53 responses)- A13% (7)
- B8% (4)
- C25% (13)
- D55% (29)
Why each option
When two DMVPN tunnels share the same physical interface, a unique tunnel key and an explicit tunnel destination are required to correctly disambiguate GRE traffic between the two separate DMVPN clouds.
Dead peer detection monitors tunnel liveliness and triggers failover for failed peers, but does not resolve the GRE packet ambiguity caused by two active tunnels sharing the same interface without differentiation.
Using the same pre-shared key for both tunnels introduces a security risk and does not address the GRE disambiguation problem; each DMVPN cloud should use its own key.
Configuring the same NHRP network ID on both tunnels would merge them into a single NHRP domain, causing mappings to be shared incorrectly across clouds and breaking spoke-to-spoke traffic in both.
Specifying an explicit tunnel destination for each GRE tunnel interface ties each tunnel to its respective hub router, preventing NHRP registrations and data traffic from being misrouted between the two distinct DMVPN clouds.
Assigning a unique tunnel key to each tunnel interface allows the router to distinguish GRE-encapsulated packets belonging to each individual DMVPN cloud when multiple mGRE tunnels share the same source interface, eliminating the session confusion that was disrupting both tunnels.
Concept tested: DMVPN dual-cloud tunnel key and destination disambiguation
Source: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/41940-dmvpn.html
Topics
Community Discussion
No community discussion yet for this question.