Configuring MVPN with mGRE Mode Interface

300-410 By islever Editorial Last updated

Configure and verify DMVPN (single hub)

Short answer

C The engineer must configure the tunnel source to the physical interface IP (172.17.0.1) and ensure the tunnel mode is set to GRE multipoint with IPsec protection.

Question

Exhibit: Configuring MVPN with mGRE Mode Interface
Refer to the exhibit. An administrator is setting up above shown routers to enable MVPN with mGRE mode. What would be the recommended interface configuration that must be done by the engineer to make it to work?
  1. interface Tunnel0 description mGRE - DMVPN Tunnel ip address 10.0.0.1 255.255.255.0 ip nhrp map multicast dynamic ip nhrp network-id 1 tunnel source 10.0.0.1 tunnel mode IPSec multipoint
  2. interface Tunnel0 description mGRE - DMVPN Tunnel ip address 10.0.0.1 255.255.255.0 ip nhrp map multicast dynamic ip nhrp network-id 1 tunnel source 10.0.0.1 tunnel mode gre multipoint
  3. interface Tunnel0 description mGRE - DMVPN Tunnel ip address 10.0.0.1 255.255.255.0 ip nhrp network-id 1 tunnel source 172.17.0.1 tunnel mode IPsec multipoint Correct Answer
  4. interface Tunnel0 description mGRE - DMVPN Tunnel ip address 10.0.0.1 255.255.255.0 ip nhrp map multicast dynamic ip nhrp network-id 1 tunnel source 10.0.0.1 tunnel destination 172.17.0.2 tunnel mode IPsec multipoint

Key Takeaways

It tests the distinction between GRE multipoint and the non-existent 'IPsec multipoint' mode, while highlighting that the tunnel source must be a physical interface IP, not the tunnel IP.

This question addresses the configuration of a DMVPN Phase 3 hub using mGRE and IPsec. The correct interface setup requires referencing a physical source address and utilizing the tunnel protection command for encryption.

Common mistake: Candidates often select options containing 'tunnel mode IPsec multipoint', which is an invalid Cisco IOS command, or they mistakenly use the tunnel interface's own IP address as the tunnel source.

Expert Analysis

Why the Answer Is Correct

The correct answer is C because it correctly identifies that the tunnel source must be a physical interface IP (172.17.0.1) rather than the tunnel interface IP (10.0.0.1). In modern DMVPN configurations, the tunnel mode gre multipoint is used on the tunnel interface, and encryption is applied via the tunnel protection ipsec profile command, avoiding the invalid syntax found in other options.

Why the Other Options Are Wrong

Options A, B, and D all contain fatal errors. A and B use the tunnel IP (10.0.0.1) as the tunnel source, which creates a conflict. D includes a static tunnel destination, which defeats the purpose of mGRE dynamic spokes. Furthermore, options C and D imply the use of tunnel mode IPsec multipoint, which is not a valid command; however, C is the only option that gets the critical source address right.

Community Comment Notes

As Fenix7 noted, "tunnel mode IPsec multipoint" does not exist. HungarianDish_111 pointed out that the tunnel source must be the physical interface and mentioned the need for tunnel protection. Brand also confirmed that "tunnel mode IPsec multipoint" isn't a valid command, reinforcing that the question's provided options are technically flawed but C is the intended best choice due to the source address.

Official Reference

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-16-11/sec-conn-dmvpn-xe-16-11-book/sec-conn-dmvpn-dmvpn.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always verify if the tunnel source references a physical loopback or interface IP, never the tunnel IP itself. Be wary of exam questions proposing invalid commands like 'IPsec multipoint'; choose the option that adheres to the most fundamental logical requirement, such as the correct source address.

Frequently Asked Questions

Why can't the tunnel source be the tunnel IP?

The tunnel source must be a stable, always-up physical interface IP. Using the tunnel IP would cause the tunnel to depend on itself, creating a bootstrapping failure.

Is 'tunnel mode IPsec multipoint' a valid command?

No, it is not. The standard command is tunnel mode gre multipoint, and IPsec encryption is applied separately using tunnel protection ipsec profile.

More 300-410 FAQ →

Discussion 26 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 26

  1. kebkim 👍 9
    Answer is C. The same question is 113.
  2. Fenix7 👍 6 Answered B
    "tunnel mode IPsec multipoint" does not exist.
  3. HungarianDish_111 👍 5 Answered C
    "tunnel source" = physical interface tunnel mode gre multipoint Do one of the following: tunnel protection ipsec profile name tunnel protection psk key https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-16-11/sec-conn-dmvpn-xe-16-11-book/sec-conn-dmvpn-dmvpn.html
  4. Brand 👍 4
    "tunnel mode IPsec multipoint" doesn't seem like a valid command at all. But the options A and B using tunnel source as tunnel IP itself so they can't be correct too. WTF is this nonsense... C1-HUB(config-if)#tunnel mode ipsec ? ipv4 over IPv4 ipv6 over IPv6 C1-HUB(config-if)#tunnel mode ipsec ipv4 ? v6-overlay Overlay traffic v6 <cr> C1-HUB(config-if)#tunnel mode ipsec ipv4
  5. packl74 👍 3
    None of the possible answers are correct, the most similar is B, but the tunnel source must be the NMBA of the external interface or the physical IP of that interface. In all the others, the "tunnel mode IPsec multipoint" command does not exist. Personally, I'm going for B. I hope that the tunnel source command is an error and that the ENARSI test works well.
Show 21 more comments
  1. yasmiine 👍 3 Answered B
    I choose B, the configuration seems correct except the @IP tunnel source which should be: 172.17.0.1 I think C is wrong because the config missed "ip nhrp map multicast dynamic" and the config tunnel mode IPsec multipoint does not exist !
  2. kaupz 👍 3
    there is no right answer... ACD are excluded because: R1(config-if)#tunnel mode ipsec multipoint ^ % Invalid input detected at '^' marker. And B is excluded because tunnel source cannot be tunnel itself
  3. DUBC89x 👍 3
    Answer is C You cannot have a tunnel destination from the Tunnel IP address, has to be the address of the physical link.
  4. sylvesterbello1 👍 3
    C is the correct answer. Physical interface ip is the source interface, not the tunnel ip
  5. inteldarvid 👍 3 Answered C
    100 % is C because 127.17.0.1 is a NBMA PUBLIC soruce
  6. forccnp 👍 3 Answered C
    Tunel source should be physical address
  7. dapardo 👍 2
    Answers relies on the question it self, it says that mgre tunnel must be setup and the only command that allows that is tunnel mode gre multipoint. Im going with B
  8. Lilienen 👍 2 Answered C
    Answer is C
  9. bk989 👍 1
    Hub: interface Tunnel0 ip address 2.2.2.2 255.255.255.0 no ip redirects ip nhrp network-id 1 ip ospf network point-to-multipoint ip ospf 1 area 0 tunnel source 2.2.2.2 tunnel mode gre multipoint Spoke: interface Tunnel0 ip address 2.2.2.3 255.255.255.0 no ip redirects ip nhrp map 2.2.2.2 1.1.1.1 ip nhrp network-id 1 ip nhrp nhs 2.2.2.2 tunnel source Ethernet0/0 tunnel mode gre multipoint IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: ....
  10. bk989 👍 1
    here is an example of answer B: interface Tunnel0 ip address 2.2.2.2 255.255.255.0 no ip redirects ip nhrp network-id 1 ip ospf network point-to-multipoint ip ospf 1 area 0 tunnel source 2.2.2.2 tunnel mode gre multipoint IOU1(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/6 ms IOU1(config-if)#
  11. bk989 👍 1
    Hub: IOU1(config-if)#tunnel source e0/0 IOU1(config-if)# Spoke: IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms IOU2(config-if)# So B seems wrong although it is technically able to be configured. I go with C.
  12. bk989 👍 1
    Here is an example of an ipsec multipoint tunnel: interface Tunnel0 ip address 2.2.2.2 255.255.255.0 ip ospf network point-to-multipoint ip ospf 1 area 0 tunnel mode ipsec ipv4 Although the configuration command in C does not exist, it is the only answer that has a correct source interface. However with answer C in my lab the tunnel is in a down state.
  13. Pietjeplukgeluk 👍 1
    You pointed out the issue with this question really clearly. B and C are partly correct, you can argue what is better, in essence they are are both "least wrong". Anyway, i agree C is less wrong if you have an opinion on it anyway.
  14. CiscoTerminator 👍 1
    C. interface Tunnel0 description mGRE - DMVPN Tunnel ip address 10.0.0.1 255.255.255.0 ip nhrp network-id 1 tunnel source 172.17.0.1 tunnel mode IPsec multipoint here is your C : tunnel mode IPsec is the issue mate...they want mGRE
  15. bk989 👍 1
    only answer is C or B. B technically works although if we advertise our tunnel in a routing protocol we have a flap. Also if we do choose answer B the spokes can't ping to the hub( see below). Answer =C
  16. chinopla 👍 1
    There is no right answer. You cannot do "tunnel mode IPSEC multipoint", it doesn't exists. And, you cannot tunnel source from the tunnel neither.
  17. XxnightwingxX 👍 1 Answered C
    C is the closest. "tunnel mode gre multipoint" is what we need along with the correct source IP.
  18. bk989 👍 1
    B is the only one that has a valid configuration.
  19. raw007 👍 1
    But C is configured with GRE Multipoint
  20. 1chung 👍 1 Answered B
    Correct answer is B
  21. Mario73 👍 1 Answered C
    Gre multipoint

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Troubleshooting OSPF MD5 Authentication Interface Configuration

S-grade

Debug IP Packet Timestamps Configuration on R4

S-grade

SNMP ifindex Persist Global vs Interface

S-grade

What Is the Purpose of DHCPv6 Guard?

S-grade

Practice All 300-410 Questions

Access 159 questions with complete answers and detailed explanations.

View Full 300-410 Practice Test →

← Back to 300-410 Study Guide