nerdexam
Cisco

300-730 · Question #19

Refer to the exhibit: HUB#show ip nhrp 0.0.0.2/32 via 10.0.0.2 Tunnel0 created 00:02:09, expire 00:00:01 Type: dynamic, Flags: unique registered used nhop NBMA address: 2.2.2.1 0.0.0.3/32 via…

The correct answer is C. interface Tunnel10 ip address 10.0.0.2 255.255.255.0 no ip redirects ip nhrp map 10.0.0.1 1.1.1.1 ip nhrp map multicast 1.1.1.1 ip nhrp network-id 1 ip nhrp holdtime 120 ip nhrp nhs 10.0.0.1 ip nhrp registration timeout 20 ip nhrp shortcut tunnel source GigabitEthernet0/1 tunnel mode gre multipoint end. DMVPN tunnels drop when NHRP entries expire before the spoke re-registers; the registration timeout must be significantly less than the holdtime to prevent this.

Troubleshooting VPNs

Question

Refer to the exhibit: HUB#show ip nhrp 0.0.0.2/32 via 10.0.0.2 Tunnel0 created 00:02:09, expire 00:00:01 Type: dynamic, Flags: unique registered used nhop NBMA address: 2.2.2.1 0.0.0.3/32 via 10.0.0.3 Tunnel0 created 00:13:25, 01:46:34 Type: dynamic, Flags: unique registered used nhop NBMA address: 3.3.3.1 The DMVPN tunnel is dropping randomly and no tunnel protection is configured. Which spoke configuration mitigates tunnel drops?

Options

  • Ainterface Tunnel10 ip address 10.0.0.2 255.255.255.0 no ip redirects ip nhrp map 10.0.0.1 1.1.1.1 ip nhrp map multicast 1.1.1.1 ip nhrp network-id 1 ip nhrp holdtime 20 ip nhrp nhs 10.0.0.1 ip nhrp registration timeout 120 ip nhrp shortcut tunnel source GigabitEthernet0/1 tunnel mode gre multipoint end
  • Binterface Tunnel10 ip address 10.0.0.2 255.255.255.0 no ip redirects ip nhrp map 10.0.0.1 1.1.1.1 ip nhrp map multicast 1.1.1.1 ip nhrp network-id 1 ip nhrp holdtime 120 ip nhrp nhs 10.0.0.1 ip nhrp registration timeout 120 ip nhrp shortcut tunnel source GigabitEthernet0/1 tunnel mode gre multipoint end
  • Cinterface Tunnel10 ip address 10.0.0.2 255.255.255.0 no ip redirects ip nhrp map 10.0.0.1 1.1.1.1 ip nhrp map multicast 1.1.1.1 ip nhrp network-id 1 ip nhrp holdtime 120 ip nhrp nhs 10.0.0.1 ip nhrp registration timeout 20 ip nhrp shortcut tunnel source GigabitEthernet0/1 tunnel mode gre multipoint end
  • Dinterface Tunnel10 ip address 10.0.0.2 255.255.255.0 no ip redirects ip nhrp map 10.0.0.1 1.1.1.1 ip nhrp map multicast 1.1.1.1 ip nhrp network-id 1 ip nhrp holdtime 120 ip nhrp nhs 10.0.0.1 ip nhrp registration timeout 150 ip nhrp shortcut tunnel source GigabitEthernet0/1 tunnel mode gre multipoint end

How the community answered

(21 responses)
  • A
    14% (3)
  • B
    5% (1)
  • C
    57% (12)
  • D
    24% (5)

Why each option

DMVPN tunnels drop when NHRP entries expire before the spoke re-registers; the registration timeout must be significantly less than the holdtime to prevent this.

Ainterface Tunnel10 ip address 10.0.0.2 255.255.255.0 no ip redirects ip nhrp map 10.0.0.1 1.1.1.1 ip nhrp map multicast 1.1.1.1 ip nhrp network-id 1 ip nhrp holdtime 20 ip nhrp nhs 10.0.0.1 ip nhrp registration timeout 120 ip nhrp shortcut tunnel source GigabitEthernet0/1 tunnel mode gre multipoint end

Option A sets holdtime 20 but registration timeout 120, meaning the hub's NHRP entry expires after 20 seconds while the spoke only re-registers every 120 seconds - guaranteeing the mapping expires and the tunnel drops.

Binterface Tunnel10 ip address 10.0.0.2 255.255.255.0 no ip redirects ip nhrp map 10.0.0.1 1.1.1.1 ip nhrp map multicast 1.1.1.1 ip nhrp network-id 1 ip nhrp holdtime 120 ip nhrp nhs 10.0.0.1 ip nhrp registration timeout 120 ip nhrp shortcut tunnel source GigabitEthernet0/1 tunnel mode gre multipoint end

Option B sets holdtime 120 and registration timeout 120 as equal values, leaving no safety margin so the hub entry may expire at exactly the same moment re-registration arrives, causing drops under any timing variance.

Cinterface Tunnel10 ip address 10.0.0.2 255.255.255.0 no ip redirects ip nhrp map 10.0.0.1 1.1.1.1 ip nhrp map multicast 1.1.1.1 ip nhrp network-id 1 ip nhrp holdtime 120 ip nhrp nhs 10.0.0.1 ip nhrp registration timeout 20 ip nhrp shortcut tunnel source GigabitEthernet0/1 tunnel mode gre multipoint endCorrect

Option C sets ip nhrp holdtime 120 and ip nhrp registration timeout 20, meaning the spoke sends a new NHRP registration every 20 seconds while the hub's NHRP entry is valid for 120 seconds. This ensures the spoke re-registers well before the holdtime expires, preventing the NHRP mapping from timing out and causing tunnel drops.

Dinterface Tunnel10 ip address 10.0.0.2 255.255.255.0 no ip redirects ip nhrp map 10.0.0.1 1.1.1.1 ip nhrp map multicast 1.1.1.1 ip nhrp network-id 1 ip nhrp holdtime 120 ip nhrp nhs 10.0.0.1 ip nhrp registration timeout 150 ip nhrp shortcut tunnel source GigabitEthernet0/1 tunnel mode gre multipoint end

Option D sets registration timeout 150 which exceeds the holdtime of 120, so the hub NHRP entry expires before the spoke attempts to re-register, producing the same tunnel instability as Option A.

Concept tested: DMVPN NHRP holdtime and registration timeout relationship

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-16/sec-conn-dmvpn-xe-16-book/sec-conn-dmvpn-dmvpn.html

Topics

#DMVPN#NHRP holdtime#registration timeout#tunnel stability

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice