Configuring MVPN with mGRE Mode Interface
Configure and verify DMVPN (single hub)
Refer to the exhibit. An administrator is setting up above shown routers to enable MVPN with mGRE mode. What would be the recommended interface configuration that must be done by the engineer to make it to work?
Answer
Correct answer: C — The engineer must configure the tunnel source to the physical interface IP (172.17.0.1) and ensure the tunnel mode is set to GRE multipoint with IPsec protection.
Community Insight
It tests the distinction between GRE multipoint and the non-existent 'IPsec multipoint' mode, while highlighting that the tunnel source must be a physical interface IP, not the tunnel IP.
This question addresses the configuration of a DMVPN Phase 3 hub using mGRE and IPsec. The correct interface setup requires referencing a physical source address and utilizing the tunnel protection command for encryption.
Candidates often select options containing 'tunnel mode IPsec multipoint', which is an invalid Cisco IOS command, or they mistakenly use the tunnel interface's own IP address as the tunnel source.
Community Discussion (27 comments)
Mario73
👍 1
Selected: C
Gre multipoint
XxnightwingxX
👍 1
Selected: C
C is the closest. "tunnel mode gre multipoint" is what we need along with the correct source IP.
Fenix7
👍 6
Selected: B
"tunnel mode IPsec multipoint" does not exist.
1chung
👍 1
Selected: B
Correct answer is B
yasmiine
👍 3
Selected: B
I choose B, the configuration seems correct except the @IP tunnel source which should be: 172.17.0.1 I think C is wrong because the config missed "ip nhrp map multicast dynamic" and the config tunnel mode IPsec multipoint does not exist !
packl74
👍 3
None of the possible answers are correct, the most similar is B, but the tunnel source must be the NMBA of the external interface or the physical IP of that interface. In all the others, the "tunnel mode IPsec multipoint" command does not exist. Personally, I'm going for B. I hope that the tunnel source command is an error and that the ENARSI test works well.
bk989
👍 1
Hub: IOU1(config-if)#tunnel source e0/0 IOU1(config-if)# Spoke: IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms IOU2(config-if)# So B seems wrong although it is technically able to be configured. I go with C.
bk989
👍 1
Hub: interface Tunnel0 ip address 2.2.2.2 255.255.255.0 no ip redirects ip nhrp network-id 1 ip ospf network point-to-multipoint ip ospf 1 area 0 tunnel source 2.2.2.2 tunnel mode gre multipoint Spoke: interface Tunnel0 ip address 2.2.2.3 255.255.255.0 no ip redirects ip nhrp map 2.2.2.2 1.1.1.1 ip nhrp network-id 1 ip nhrp nhs 2.2.2.2 tunnel source Ethernet0/0 tunnel mode gre multipoint IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: ....
bk989
👍 1
only answer is C or B. B technically works although if we advertise our tunnel in a routing protocol we have a flap. Also if we do choose answer B the spokes can't ping to the hub( see below). Answer =C
bk989
👍 1
Here is an example of an ipsec multipoint tunnel: interface Tunnel0 ip address 2.2.2.2 255.255.255.0 ip ospf network point-to-multipoint ip ospf 1 area 0 tunnel mode ipsec ipv4 Although the configuration command in C does not exist, it is the only answer that has a correct source interface. However with answer C in my lab the tunnel is in a down state.
bk989
👍 1
here is an example of answer B: interface Tunnel0 ip address 2.2.2.2 255.255.255.0 no ip redirects ip nhrp network-id 1 ip ospf network point-to-multipoint ip ospf 1 area 0 tunnel source 2.2.2.2 tunnel mode gre multipoint IOU1(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/6 ms IOU1(config-if)#
bk989
👍 1
B is the only one that has a valid configuration.
chinopla
👍 1
There is no right answer. You cannot do "tunnel mode IPSEC multipoint", it doesn't exists. And, you cannot tunnel source from the tunnel neither.
dapardo
👍 2
Answers relies on the question it self, it says that mgre tunnel must be setup and the only command that allows that is tunnel mode gre multipoint. Im going with B
kaupz
👍 3
there is no right answer... ACD are excluded because: R1(config-if)#tunnel mode ipsec multipoint ^ % Invalid input detected at '^' marker. And B is excluded because tunnel source cannot be tunnel itself
Pietjeplukgeluk
👍 1
You pointed out the issue with this question really clearly. B and C are partly correct, you can argue what is better, in essence they are are both "least wrong". Anyway, i agree C is less wrong if you have an opinion on it anyway.
Brand
👍 4
"tunnel mode IPsec multipoint" doesn't seem like a valid command at all. But the options A and B using tunnel source as tunnel IP itself so they can't be correct too. WTF is this nonsense... C1-HUB(config-if)#tunnel mode ipsec ? ipv4 over IPv4 ipv6 over IPv6 C1-HUB(config-if)#tunnel mode ipsec ipv4 ? v6-overlay Overlay traffic v6 <cr> C1-HUB(config-if)#tunnel mode ipsec ipv4
inteldarvid
👍 3
Selected: C
100 % is C because 127.17.0.1 is a NBMA PUBLIC soruce
HungarianDish_111
👍 5
Selected: C
"tunnel source" = physical interface tunnel mode gre multipoint Do one of the following: tunnel protection ipsec profile name tunnel protection psk key https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-16-11/sec-conn-dmvpn-xe-16-11-book/sec-conn-dmvpn-dmvpn.html
forccnp
👍 3
Selected: C
Tunel source should be physical address
Lilienen
👍 2
Selected: C
Answer is C
sylvesterbello1
👍 3
C is the correct answer. Physical interface ip is the source interface, not the tunnel ip
jarz
👍 4
Selected: C
Answer is C
DUBC89x
👍 3
Answer is C You cannot have a tunnel destination from the Tunnel IP address, has to be the address of the physical link.
kebkim
👍 9
Answer is C. The same question is 113.
CiscoTerminator
👍 1
C. interface Tunnel0 description mGRE - DMVPN Tunnel ip address 10.0.0.1 255.255.255.0 ip nhrp network-id 1 tunnel source 172.17.0.1 tunnel mode IPsec multipoint here is your C : tunnel mode IPsec is the issue mate...they want mGRE
raw007
👍 1
But C is configured with GRE Multipoint
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is C because it correctly identifies that thetunnel source must be a physical interface IP (172.17.0.1) rather than the tunnel interface IP (10.0.0.1). In modern DMVPN configurations, the tunnel mode gre multipoint is used on the tunnel interface, and encryption is applied via the tunnel protection ipsec profile command, avoiding the invalid syntax found in other options.Why the Other Options Are Wrong
Options A, B, and D all contain fatal errors. A and B use the tunnel IP (10.0.0.1) as the tunnel source, which creates a conflict. D includes a statictunnel destination, which defeats the purpose of mGRE dynamic spokes. Furthermore, options C and D imply the use of tunnel mode IPsec multipoint, which is not a valid command; however, C is the only option that gets the critical source address right.Community Comment Notes
As Fenix7 noted, "tunnel mode IPsec multipoint" does not exist. HungarianDish_111 pointed out that the tunnel source must be the physical interface and mentioned the need fortunnel protection. Brand also confirmed that "tunnel mode IPsec multipoint" isn't a valid command, reinforcing that the question's provided options are technically flawed but C is the intended best choice due to the source address. Official Reference
Exam Strategy
Always verify if the tunnel source references a physical loopback or interface IP, never the tunnel IP itself. Be wary of exam questions proposing invalid commands like 'IPsec multipoint'; choose the option that adheres to the most fundamental logical requirement, such as the correct source address.
Frequently Asked Questions
Why can't the tunnel source be the tunnel IP?
The tunnel source must be a stable, always-up physical interface IP. Using the tunnel IP would cause the tunnel to depend on itself, creating a bootstrapping failure.
Is 'tunnel mode IPsec multipoint' a valid command?
No, it is not. The standard command is tunnel mode gre multipoint, and IPsec encryption is applied separately using tunnel protection ipsec profile.
Related Analysis
Practice All 300-410 Questions
Access 159 questions with complete answers and detailed explanations.
View Full 300-410 Practice Test →