A housing authority spoke stops registering to the DMVPN hub after…

Question

A housing authority spoke stops registering to the DMVPN hub after the branch firewall’s NAT pool changes. What registration detail should engineers verify first?

Accepted Answer

That NHRP and IKE still advertise the spoke’s current public (mapped) NBMA address and that NAT-T keeps UDP 4500 open through the new pool. — When the firewall’s public face changes, the spoke’s “home address on the Internet” changes too. NHRP registration and NAT-T have to advertise that new NBMA mapping—old pool leftovers leave the hub staring at a ghost.

Answer

That OSPF network type on the tunnel was flipped to broadcast after the NAT change.

Answer

That the hub crypto ACL still mirrors the old public address instead of any dynamic mapping.

Answer

That VTP pruning was disabled on the campus access switches behind the spoke.

A housing authority spoke stops registering to the DMVPN hub after the branch firewall’s NAT pool changes. What registration detail should engineers verify first?

Short Explanation

Full Explanation