Refer to the exhibit. An administrator is setting up above shown routers to enable MVPN with mGRE mode. What would be the recommended interface configuration that must be done by the engineer to make it to work?
ENARSI Exam QuestionsBrowse all questions from this exam
ENARSI Exam - Question 327
Show AnswerHide Answer
Correct Answer: C
To correctly configure the interface for MVPN with mGRE mode, the tunnel source must be the physical interface's IP address, not the tunnel interface's IP address. Additionally, while the command 'tunnel mode IPSec multipoint' is invalid, 'tunnel mode gre multipoint' is correct for setting up dynamic multipoint VPN (DMVPN) in mGRE mode. Therefore, among the provided options, the correct configuration is to use the physical IP address as the tunnel source and to set the tunnel mode to 'gre multipoint'.
Discussion
17 commentskebkim
Nov 27, 2022Answer is C. The same question is 113.
raw007
Jun 6, 2023But C is configured with GRE Multipoint
CiscoTerminator
Feb 26, 2025C. interface Tunnel0 description mGRE - DMVPN Tunnel ip address 10.0.0.1 255.255.255.0 ip nhrp network-id 1 tunnel source 172.17.0.1 tunnel mode IPsec multipoint here is your C : tunnel mode IPsec is the issue mate...they want mGRE
HungarianDish_111Option: C
May 15, 2023"tunnel source" = physical interface tunnel mode gre multipoint Do one of the following: tunnel protection ipsec profile name tunnel protection psk key https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-16-11/sec-conn-dmvpn-xe-16-11-book/sec-conn-dmvpn-dmvpn.html
jarzOption: C
Dec 23, 2022Answer is C
Brand
Sep 5, 2023"tunnel mode IPsec multipoint" doesn't seem like a valid command at all. But the options A and B using tunnel source as tunnel IP itself so they can't be correct too. WTF is this nonsense... C1-HUB(config-if)#tunnel mode ipsec ? ipv4 over IPv4 ipv6 over IPv6 C1-HUB(config-if)#tunnel mode ipsec ipv4 ? v6-overlay Overlay traffic v6 <cr> C1-HUB(config-if)#tunnel mode ipsec ipv4
DUBC89x
Dec 3, 2022Answer is C You cannot have a tunnel destination from the Tunnel IP address, has to be the address of the physical link.
sylvesterbello1
Jan 5, 2023C is the correct answer. Physical interface ip is the source interface, not the tunnel ip
forccnpOption: C
Mar 19, 2023Tunel source should be physical address
inteldarvidOption: C
Jul 17, 2023100 % is C because 127.17.0.1 is a NBMA PUBLIC soruce
kaupz
Dec 15, 2023there is no right answer... ACD are excluded because: R1(config-if)#tunnel mode ipsec multipoint ^ % Invalid input detected at '^' marker. And B is excluded because tunnel source cannot be tunnel itself
Pietjeplukgeluk
May 25, 2024You pointed out the issue with this question really clearly. B and C are partly correct, you can argue what is better, in essence they are are both "least wrong". Anyway, i agree C is less wrong if you have an opinion on it anyway.
dapardo
Jun 25, 2024Answers relies on the question it self, it says that mgre tunnel must be setup and the only command that allows that is tunnel mode gre multipoint. Im going with B
dapardo
Jun 25, 2024Answers relies on the question it self, it says that mgre tunnel must be setup and the only command that allows that is tunnel mode gre multipoint. Im going with B
LilienenOption: C
Feb 13, 2023Answer is C
packl74
Oct 27, 2024None of the possible answers are correct, the most similar is B, but the tunnel source must be the NMBA of the external interface or the physical IP of that interface. In all the others, the "tunnel mode IPsec multipoint" command does not exist. Personally, I'm going for B. I hope that the tunnel source command is an error and that the ENARSI test works well.
yasmiineOption: B
Apr 21, 2025I choose B, the configuration seems correct except the @IP tunnel source which should be: 172.17.0.1 I think C is wrong because the config missed "ip nhrp map multicast dynamic" and the config tunnel mode IPsec multipoint does not exist !
chinopla
Jun 25, 2024There is no right answer. You cannot do "tunnel mode IPSEC multipoint", it doesn't exists. And, you cannot tunnel source from the tunnel neither.
[Removed]Option: C
Jul 25, 2024it´s C
bk989
Aug 24, 2024B is the only one that has a valid configuration.
bk989
Sep 2, 2024Here is an example of an ipsec multipoint tunnel: interface Tunnel0 ip address 2.2.2.2 255.255.255.0 ip ospf network point-to-multipoint ip ospf 1 area 0 tunnel mode ipsec ipv4 Although the configuration command in C does not exist, it is the only answer that has a correct source interface. However with answer C in my lab the tunnel is in a down state.
bk989
Sep 2, 2024here is an example of answer B: interface Tunnel0 ip address 2.2.2.2 255.255.255.0 no ip redirects ip nhrp network-id 1 ip ospf network point-to-multipoint ip ospf 1 area 0 tunnel source 2.2.2.2 tunnel mode gre multipoint IOU1(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/6 ms IOU1(config-if)#
bk989
Sep 2, 2024only answer is C or B. B technically works although if we advertise our tunnel in a routing protocol we have a flap. Also if we do choose answer B the spokes can't ping to the hub( see below). Answer =C
bk989
Sep 2, 2024Hub: interface Tunnel0 ip address 2.2.2.2 255.255.255.0 no ip redirects ip nhrp network-id 1 ip ospf network point-to-multipoint ip ospf 1 area 0 tunnel source 2.2.2.2 tunnel mode gre multipoint Spoke: interface Tunnel0 ip address 2.2.2.3 255.255.255.0 no ip redirects ip nhrp map 2.2.2.2 1.1.1.1 ip nhrp network-id 1 ip nhrp nhs 2.2.2.2 tunnel source Ethernet0/0 tunnel mode gre multipoint IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: ....
bk989
Sep 2, 2024Hub: IOU1(config-if)#tunnel source e0/0 IOU1(config-if)# Spoke: IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms IOU2(config-if)# So B seems wrong although it is technically able to be configured. I go with C.
bk989
Sep 2, 2024Hub: IOU1(config-if)#tunnel source e0/0 IOU1(config-if)# Spoke: IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms IOU2(config-if)# So B seems wrong although it is technically able to be configured. I go with C.
bk989
Sep 2, 2024Hub: interface Tunnel0 ip address 2.2.2.2 255.255.255.0 no ip redirects ip nhrp network-id 1 ip ospf network point-to-multipoint ip ospf 1 area 0 tunnel source 2.2.2.2 tunnel mode gre multipoint Spoke: interface Tunnel0 ip address 2.2.2.3 255.255.255.0 no ip redirects ip nhrp map 2.2.2.2 1.1.1.1 ip nhrp network-id 1 ip nhrp nhs 2.2.2.2 tunnel source Ethernet0/0 tunnel mode gre multipoint IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: ....
bk989
Sep 2, 2024Hub: IOU1(config-if)#tunnel source e0/0 IOU1(config-if)# Spoke: IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms IOU2(config-if)# So B seems wrong although it is technically able to be configured. I go with C.
bk989
Sep 2, 2024Hub: IOU1(config-if)#tunnel source e0/0 IOU1(config-if)# Spoke: IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms IOU2(config-if)# So B seems wrong although it is technically able to be configured. I go with C.
bk989
Sep 2, 2024only answer is C or B. B technically works although if we advertise our tunnel in a routing protocol we have a flap. Also if we do choose answer B the spokes can't ping to the hub( see below). Answer =C
bk989
Sep 2, 2024Hub: interface Tunnel0 ip address 2.2.2.2 255.255.255.0 no ip redirects ip nhrp network-id 1 ip ospf network point-to-multipoint ip ospf 1 area 0 tunnel source 2.2.2.2 tunnel mode gre multipoint Spoke: interface Tunnel0 ip address 2.2.2.3 255.255.255.0 no ip redirects ip nhrp map 2.2.2.2 1.1.1.1 ip nhrp network-id 1 ip nhrp nhs 2.2.2.2 tunnel source Ethernet0/0 tunnel mode gre multipoint IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: ....
bk989
Sep 2, 2024Hub: IOU1(config-if)#tunnel source e0/0 IOU1(config-if)# Spoke: IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms IOU2(config-if)# So B seems wrong although it is technically able to be configured. I go with C.
bk989
Sep 2, 2024Hub: IOU1(config-if)#tunnel source e0/0 IOU1(config-if)# Spoke: IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms IOU2(config-if)# So B seems wrong although it is technically able to be configured. I go with C.
bk989
Sep 2, 2024Hub: interface Tunnel0 ip address 2.2.2.2 255.255.255.0 no ip redirects ip nhrp network-id 1 ip ospf network point-to-multipoint ip ospf 1 area 0 tunnel source 2.2.2.2 tunnel mode gre multipoint Spoke: interface Tunnel0 ip address 2.2.2.3 255.255.255.0 no ip redirects ip nhrp map 2.2.2.2 1.1.1.1 ip nhrp network-id 1 ip nhrp nhs 2.2.2.2 tunnel source Ethernet0/0 tunnel mode gre multipoint IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: ....
bk989
Sep 2, 2024Hub: IOU1(config-if)#tunnel source e0/0 IOU1(config-if)# Spoke: IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms IOU2(config-if)# So B seems wrong although it is technically able to be configured. I go with C.
bk989
Sep 2, 2024Hub: IOU1(config-if)#tunnel source e0/0 IOU1(config-if)# Spoke: IOU2(config-if)#do ping 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 2/4/6 ms IOU2(config-if)# So B seems wrong although it is technically able to be configured. I go with C.
1chungOption: B
May 3, 2025Correct answer is B