300-730 · Question #196
Refer to the exhibit. A network engineer is troubleshooting a new DMVPN configuration. The network connectivity between the hub and spoke is working as it should, but users cannot access VPN…
The correct answer is C. Ensure that the IPsec profile is configured on the tunnel interface. MM_NO_STATE in the ISAKMP SA table means IKE Phase 1 cannot complete, and in DMVPN this is caused by a missing IPsec profile on the tunnel interface.
Question
R1#show crypto isakmp sa
IPv4 Crypto ISAKMP SA
DST SRC STATE conn-id slot status
192.168.10.1 192.168.20.1 MM_NO_STATE 0 0 ACTIVE
192.168.10.1 192.168.20.1 MM_NO_STATE 0 0 ACTIVE (delete)
192.168.10.5 192.168.20.1 MM_NO_STATE 0 0 ACTIVE (delete)
192.168.10.5 192.168.10.1 MM_NO_STATE 0 0 ACTIVE
Exhibit
Options
- AReview ISAKMP packets on devices between the VPN devices.
- BUnblock IP protocol 50 on devices between the VPN devices.
- CEnsure that the IPsec profile is configured on the tunnel interface.
- DEnsure that the NHS is configured on the tunnel interface.
How the community answered
(39 responses)- A13% (5)
- B28% (11)
- C51% (20)
- D8% (3)
Why each option
MM_NO_STATE in the ISAKMP SA table means IKE Phase 1 cannot complete, and in DMVPN this is caused by a missing IPsec profile on the tunnel interface.
Reviewing ISAKMP packets is a passive diagnostic step rather than a corrective action and does not resolve the Phase 1 MM_NO_STATE failure.
Blocking ESP (protocol 50) would disrupt Phase 2 data encryption but would not prevent IKE Phase 1 from reaching a completed state; the exhibit shows Phase 1 itself is stalled.
In DMVPN, the IPsec profile applied to the tunnel interface ties IKE and IPsec parameters to tunnel traffic; without it, the router initiates IKE Phase 1 but stalls at MM_NO_STATE because there is no profile to drive negotiation to completion. Adding the correct IPsec profile to the tunnel interface allows Phase 1 and Phase 2 to complete, restoring encrypted access to VPN resources.
The question states hub-to-spoke connectivity is functional, confirming NHRP registration succeeded and the NHS is already correctly configured on the tunnel interface.
Concept tested: IPsec profile on DMVPN tunnel interface for IKE completion
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-16/sec-conn-dmvpn-xe-16-book/sec-conn-dmvpn-dmvpn.html
Topics
Community Discussion
No community discussion yet for this question.