300-730 · Question #2
Which two commands help determine why the NHRP registration process is not being completed even after the IPsec tunnel is up? (Choose two.)
The correct answer is D. show ip nhrp traffic E. show dmvpn detail. When IPsec is up but NHRP registration fails in DMVPN, the problem is at the NHRP layer - commands that inspect NHRP traffic and DMVPN state are needed, not IPsec-layer commands.
Question
Options
- Ashow crypto isakmp sa
- Bshow ip traffic
- Cshow crypto ipsec sa
- Dshow ip nhrp traffic
- Eshow dmvpn detail
How the community answered
(61 responses)- A3% (2)
- B11% (7)
- C7% (4)
- D79% (48)
Why each option
When IPsec is up but NHRP registration fails in DMVPN, the problem is at the NHRP layer - commands that inspect NHRP traffic and DMVPN state are needed, not IPsec-layer commands.
show crypto isakmp sa shows IKE Phase 1 status, but since the IPsec tunnel is already confirmed up, the IKE SA is not the problem.
show ip traffic shows aggregate IP protocol counters and is too general to isolate an NHRP-specific registration failure.
show crypto ipsec sa confirms IPsec Phase 2 SA details, which are already known to be up, so this does not help diagnose the NHRP layer issue.
show ip nhrp traffic displays NHRP packet send and receive counters, allowing you to verify whether registration requests and replies are actually being exchanged between spoke and hub.
show dmvpn detail provides the NHRP state machine per peer, showing whether spokes are stuck in a particular state such as IINITIAL or IKE, and reveals the specific reason registration is not completing.
Concept tested: DMVPN NHRP registration troubleshooting commands
Source: https://www.cisco.com/c/en/us/support/docs/security/dynamic-multipoint-vpn-dmvpn/111976-dmvpn-troubleshoot-00.html
Topics
Community Discussion
No community discussion yet for this question.