In a FlexVPN deployment, the spokes successfully connect to the hub, but spoke-to-spoke tunnels do not form.
Which troubleshooting step solves the issue?
Click on the arrows to vote for the correct answer
A. B. C. D.B.
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/15-mt/sec-conn-dmvpn-15-mt-book/sec-conn-dmvpn-summ-Flex VPN is a Virtual Private Network ( VPN) technology that allows secure communication between various sites over the Internet. In a Flex VPN deployment, the spokes can successfully connect to the hub, but spoke-to-spoke tunnels do not form. To troubleshoot this issue, the following steps can be taken:
A. Verify the spoke configuration to check if the NHRP redirect is enabled: NHRP (Next Hop Resolution Protocol) redirect is a mechanism used by Flex VPN to provide spoke-to-spoke communication. By enabling NHRP redirect, spokes can redirect traffic to the hub for resolution. To check if NHRP redirect is enabled on the spoke, the following command can be used:
makefileshow run | include nhrp redirect If NHRP redirect is not enabled, the following command can be used to enable it:
ip nhrp redirect
B. Verify that the spoke receives redirect messages and sends resolution requests: To verify if the spoke receives redirect messages and sends resolution requests, the following command can be used:
sqlshow dmvpn This command shows the DM VPN (Dynamic Multipoint VPN) status, including the NHRP status. If the spoke is not receiving redirect messages, there may be an issue with the hub configuration.
C. Verify the hub configuration to check if the NHRP shortcut is enabled: NHRP shortcut is a mechanism used by Flex VPN to create spoke-to-spoke tunnels. By enabling NHRP shortcut, the hub can provide spoke-to-spoke communication without sending traffic to the spoke. To check if NHRP shortcut is enabled on the hub, the following command can be used:
makefileshow run | include nhrp shortcut If NHRP shortcut is not enabled, the following command can be used to enable it:
ip nhrp shortcut
D. Verify that the tunnel interface is contained within a VR: If the tunnel interface is not contained within a Virtual Routing (VR) instance, spoke-to-spoke communication may not be possible. To check if the tunnel interface is contained within a VR, the following command can be used:
cppshow run | include virtual-template This command shows the configuration of the virtual template, which is used to create tunnel interfaces. The virtual template should be contained within a VR. If it is not, the following command can be used to create a VR and contain the virtual template within it:
cppip vrf <vrf-name> interface virtual-template <template-number> ip vrf forwarding <vrf-name> In summary, to troubleshoot the issue of spoke-to-spoke tunnels not forming in a Flex VPN deployment, one can verify the spoke configuration to check if NHRP redirect is enabled, check that the spoke receives redirect messages and sends resolution requests, verify the hub configuration to check if NHRP shortcut is enabled, and check that the tunnel interface is contained within a VR.