Equipment Support > Hardware By Brand > Cisco > [HELP] EIGRP Issues

[HELP] EIGRP Issues

 
int tu100
ip address 192.168.4.1 255.255.252.0
exit
 
router eigrp 100
no network 192.168.17.0 0.0.0.255
network 192.168.4.0 0.0.3.255
end
 

 
int tu100
ip address 192.168.4.77 255.255.252.0
ip nhrp nhs 192.168.4.1
exit
 
router eigrp 100
network 192.168.4.0 0.0.3.255
no network 192.168.17.0
end
 

Jul  3 07:44:15.188: %DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 192.168.4.1 (Tunnel100) is down: retry limit exceeded
 

Have you checked the EIGRP timers (i.e., hello, etc...)?

Jay

reply to krock83

reply to krock83
we run DMVPN and every new site that we open gets a new ip address,

lets say we open up a new office in Miami we would create tu100 and assign ip address of 192.168.4.128 255.255.255.0

that is why I need bigger subnet since Im running out of /24

reply to DocLarge

reply to krock83
There are no ACL's blocking it because once you reboot the peering router everything works fine. I'm just trying to figure out why a reboot is needed for this to work.

If I had to guess, the routers needed to reset the tunnel in order to start using the modified configuration. With that in mind, perhaps simply reset the tunnels (shut and no shut the tunnel interfaces) would be alternative to reboot all routers.

reply to krock83
I tried that multiple times shut and leave it in that state for a few min and bring it back up, but it wouldnt stay up for more then a few min and it would reset again, and again... and so on...

reply to krock83

reply to krock83
I have been pushing the business to agree on MPLS, but their point of view is "its working fine now, I don't care what problem you have we are not paying for MPLS". sooo I will have to send out a notification that we will be reloading again

Maybe they will get tired of the constant reboot and go with my idea of MPLS....

Thanks aryoba....

we are running 15. code and have purchased license for DMVPN, what I didn't know is that we don't need those for MPLS

hmmm.. I wonder what the engineers before me were thinking!!

Thanks for the info

As I understood it, routers run IOS 15.x come by default with the IP Base license that support static routes, RIP, and some basic routing/switching/NAT functionality. Should you need EIGRP, you need Advanced IP Services license. Need ZBF, CBAC, IPSec VPN, DMVPN? You need Advanced Security. You can confirm which license your routers have with show license command.

reply to krock83
Yes, I remember that we had to get a license to unlock EIGRP on the 15.x code for a new location I just turned up. Those run about 249.00 I believe

reply to krock83

reply to krock83
This kind of sounds like a recursive routing issue.

Recursive routing is where the tunnel comes up, and <insert routing protocol> exchanges routes for each side, including the subnet of the WAN, so both ends try to route the tunnel packets over the tunnel (hence recursive) which eventually leads to the tunnel dropping out, and re-establishing once the router realises it can route the tunnel packets via the WAN again. Lather, rinse, repeat.

To verify if its a recursive routing issue, check the routing table of your hub for example and see if it contains any routes for the remote sites WAN connection in it. But in the past I have seen the router identify recursive routes and create log entries as such. Do you see anything like this in your logs?

If this is the case, you'll need to apply a prefix filter to your EIGRP configs to prevent the router advertising anything but its internal networks. That should stop it. A generic one that just covers all of the RFC1918 subnets would probably suffice, since you say you have 100 sites, maintaining individual filters for each site could be a headache.

reply to krock83
As I understand your situation... you're going to see this until every DMVPN node is set to /22. When a mismatching node joins the group, "bad things will happen." (change the vpn key so /22 and /24 are different DMVPNs)

You need to set aside a window where you can make these changes across the entire network. The entire network will be screwed up until you're done. I've been there -- luckily, I was working with a frame-relay network instead of DMVPN. (I missed a single router that wasn't on my map.)

reply to TomS_
Well there you go.

reply to krock83
@ Cramer

I have requested a maintenance window for this implemantaion. Since this is the backup tunnel to the Disaster Recovery side I don't think I will see any outages.

@TomS_

I wish I could experiment to find what the logs say, or do a debug etc but my boss is a little girl and he knows that the reload will fix the issue so I don't have much of a choice here. One of these days (I hope) he will come to a conclusion that finding out what the issue is and fixing it rether then reloading the routers every month would be more beneficial.

For now I will do what he says.. he is the boss not me

reply to TomS_