nerdexam
Cisco

300-730 · Question #55

In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?

The correct answer is C. Verify the hub configuration to check if the NHRP shortcut is enabled. In FlexVPN, spoke-to-spoke tunnels rely on NHRP to redirect traffic; if the hub is not configured with NHRP shortcut, it cannot signal spokes to build direct tunnels.

Troubleshooting Using ASDM and CLI

Question

In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form. Which troubleshooting step solves the issue?

Options

  • AVerify the spoke configuration to check if the NHRP redirect is enabled.
  • BVerify that the spoke receives redirect messages and sends resolution requests.
  • CVerify the hub configuration to check if the NHRP shortcut is enabled.
  • DVerify that the tunnel interface is contained within a VRF.

How the community answered

(34 responses)
  • A
    6% (2)
  • B
    18% (6)
  • C
    50% (17)
  • D
    26% (9)

Why each option

In FlexVPN, spoke-to-spoke tunnels rely on NHRP to redirect traffic; if the hub is not configured with NHRP shortcut, it cannot signal spokes to build direct tunnels.

AVerify the spoke configuration to check if the NHRP redirect is enabled.

NHRP redirect is a hub-side function, not a spoke configuration; verifying the spoke for redirect settings targets the wrong device in the architecture.

BVerify that the spoke receives redirect messages and sends resolution requests.

Verifying that spokes receive redirects and send resolution requests is a downstream diagnostic step that only becomes relevant after confirming the hub is correctly generating those messages.

CVerify the hub configuration to check if the NHRP shortcut is enabled.Correct

In a FlexVPN deployment, the hub's virtual-template interface must have 'ip nhrp shortcut virtual-template' enabled to allow spoke-to-spoke shortcuts. Without this, the hub will never send the necessary NHRP redirect or shortcut signals that trigger direct spoke-to-spoke tunnel establishment, even if spoke-to-hub tunnels are working correctly.

DVerify that the tunnel interface is contained within a VRF.

Placing the tunnel interface in a VRF is a routing isolation concern unrelated to the NHRP signaling mechanism required for spoke-to-spoke tunnel formation.

Concept tested: FlexVPN NHRP shortcut configuration for spoke-to-spoke

Source: https://www.cisco.com/c/en/us/support/docs/security/flexvpn/116413-technote-flexvpn-00.html

Topics

#FlexVPN#NHRP shortcut#spoke-to-spoke#hub configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice