DMVPN attrb - I2 - Please help

Routing & Switching
1

Hello! I have run into an issue where I’m using DMVPN v3 withouth the ip nhrp shortcut command. I have dual tunnels set to a primary and secondary router and then use nhrp mapping statements for each tunnel.
Example:

ip nhrp nhs 192.168.1.1 nbma 172.16.1.1 multicast  ! to primary nhs
ip nhrp nhs 192.168.1.2 nbma 172.16.1.2 multicast ! to primary nhs
ip nhrp server-only

When I want to disable or take down the secondary tunnel I removed the ip nhrp nhs 192.168.1.2 nbma 172.16.1.2 multicast line, but instead of the tunnel being removed I get this:

# Ent  Peer  NBMA  Addr  Peer  Tunnel  Add  State   UpDn  Tm  Attrb
--------  ------  ---------  -------  ---------------------------  ------   ---------  -----  ----
    2  172.16.1.1       192.168.1.1         UP   00:16:27      S
                        192.168.1.2         UP   00:00:29      I2

Do you have any information on the meaning of the I2 Attribute?

2

Hello James

The “I2” state (that’s the capital letter “i” and the number 2) relates to the NHRP registration process. The “I” stands for “Initiating” and refers to the NHRP initiation phase. The number “2” indicates the number of retries that have been attempted for the NHRP registration process.

So in this instance, I2 indicates that the DMVPN spoke has tried twice to register to the NHRP Next Hop Server (NHS), but was unsuccessful. This is to be expected when you remove the command you have removed. The router will continue to attempt a few retries before it gives up.

If you’re trying to remove or disable the secondary tunnel, you should not only remove the NHRP mapping statement, but also shut down the tunnel interface. This will remove the second entry and any additional (failed) attempts to reach the NHS.

I hope this has been helpful!

Laz

3

Thank you!
The response is very helpful. Do you happen to have any reference links? I searched for two days before posting. I also created a basic dual hub lab in Gns3 using csr1000v but couldn’t recreate the I2 Temporary state. I will add ipsec and test again.

Thanks again

4

Hello James

After getting your response I did a little more digging and I found that depending upon the IOS version you are using, you may have additional possible attributes in the Attrib column of the output of the show dmvpn command. The following command reference indicates that there is the “I” attribute which shows an incomplete state of that particular session.

The legend of the command as shown in the above documentation is the following:

Router# show dmvpn detail

Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
        N - NATed, L - Local, X - No Socket
        # Ent --> Number of NHRP entries with same NBMA peer
        NHS Status: E --> Expecting Replies, R --> Responding
        UpDn Time --> Up or Down Time for a Tunnel

However, going into the lab and powering up a CSR100V I get the following output from the show dmvpn command:

Router#show dmvpn
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
        N - NATed, L - Local, X - No Socket
        T1 - Route Installed, T2 - Nexthop-override, B - BGP
        C - CTS Capable, I2 - Temporary
        # Ent --> Number of NHRP entries with same NBMA peer
        NHS Status: E --> Expecting Replies, R --> Responding, W --> Waiting
        UpDn Time --> Up or Down Time for a Tunnel
==========================================================================

CORE#

The legend here indicates some additional possible attributes beyond those shown in the command reference. One of those is the I2 attribute which is denoted as “Temporary”. This is the attribute that is appearing in your output. In the context of DMVPN and NHRP this seems to indicate a “temporary” NHRP entry that’s created in response to a specific event or requirement but isn’t intended to be long-lived in the NHRP cache.

I have been unable to find documentation to indicate the specific meaning of this particular attribute.

How did you get that state the first time? In any case, keep us posted. In the meantime I will ask @ReneMolenaar to see if he has any further insight into these aspects…

I hope this has been helpful!

Laz