DMVPN CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A network engineer is troubleshooting a DMVPN Phase 3 network where spoke-to-spoke traffic is not being established. The engineer has verified that NHRP redirect is enabled on the hubs and that the spokes are registered. However, the spokes are still sending traffic through the hub. What is the most likely reason for this issue?

   • AThe hub is not configured with NHRP redirect.
   • BThe routing protocol on the spokes is not advertising the tunnel network.
   • CThe NHRP holdtime on the spokes is set too high.
   • DThe tunnel interface on the spokes is not configured with a valid source IP.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A network administrator is verifying the operation of a dual-hub DMVPN Phase 3 network. The administrator wants to confirm that a spoke is registered with both hubs. Which command output would provide this information?

   • Ashow crypto session on the spoke, showing two active IPsec sessions.
   • Bshow dmvpn on the spoke, showing two NHRP mappings for the hubs.
   • Cshow ip route on the spoke, showing routes to both hubs.
   • Dshow interface tunnel 0 on the spoke, showing the tunnel is up.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is deploying a DMVPN Phase 3 network with two hubs in different data centers. Spokes must be able to establish direct tunnels to each other for latency-sensitive traffic. The network team wants to verify that spoke-to-spoke shortcuts are actually being used after deployment. Which verification approach will most directly confirm that the Phase 3 shortcut mechanism is working?

   • ARun 'show nhrp summary' on a hub to see the total number of registered spokes.
   • BRun 'show dmvpn' on a spoke and check for NHRP peer entries with a 'shortcut' flag.
   • CRun 'show crypto ipsec sa' on a spoke and count the number of active IPsec tunnels.
   • DRun 'show ip route' on a spoke and look for routes learned via the tunnel interface.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A spoke in a DMVPN Phase 3 network is unable to establish a direct tunnel to another spoke. The 'show dmvpn' output on the source spoke shows a shortcut entry, but traffic is still going through the hub. What is the most likely cause?

   • AThe destination spoke is not registered with the hub.
   • BThe hub is configured with 'ip nhrp redirect'.
   • CThe shortcut entry is stale or has expired.
   • DThe source spoke is missing the 'ip nhrp shortcut' command.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company has a dual-hub DMVPN Phase 3 network. Hub1 is in the primary data center, Hub2 in a backup data center. Spokes are configured with two NHRP server mappings, one for each hub. BGP is used for routing. After a recent change, when Hub1 fails, spokes take several minutes to converge and some traffic is black-holed. The engineer suspects that the spokes are still trying to use Hub1 for NHRP resolution. What is the most likely cause and the best fix?

   • AThe spokes are missing the 'ip nhrp shortcut' command; add it to allow faster failover.
   • BThe BGP hold timer on the spokes is too long; reduce the hold timer to speed up convergence.
   • CThe hubs are not configured with 'ip nhrp redirect'; enable it on both hubs.
   • DThe spokes have a static NHRP mapping for Hub1 that does not expire; remove the static mapping and rely on dynamic registration.
   Reveal Solution Discussion Select an answer first