A second DMVPN micro scenario. Keep the overlay policy intact while selecting a valid fast-reroute path in the managed transport.
01 / WORKBOOKUse these facts to decide
EXHIBIT A / TWO ROUTING LAYERS
One overlay. A managed underlay.
Northstar retains two hubs H1/H2 in one DC and three spokes S1–S3 in one DMVPN Phase 3 cloud. OSPF 100, area 0 now carries the enterprise overlay routes. OSPF 10, area 0 independently carries managed transport routes. There is no redistribution between them.
Lines = logical DMVPN connections. Every spoke connects to both hubs in OSPF 100. The highlighted S1–H1 connection uses the transport path expanded below. Branch-to-branch shortcuts form on demand and are omitted for clarity.
Numbers = underlay OSPF 10 costs. Solid links are physical point-to-point links with symmetric costs. The dashed S1–R access handoff is context only; all repair distances start at R. D is H1’s transport endpoint, not another hub. The shown distance to D includes its endpoint route.
Where are S2, S3 and H2 in the repair view? They remain part of the overlay above. Their transport access is outside this R–E repair calculation. H2’s transport path is independent of R–E and E. No omitted path changes Exhibit C’s distances.
Supplied overlay baseline
Tunnel0: 10.255.0.0/24; H1 .1, H2 .2, S1 .11, S2 .12, S3 .13. Exact branch routes 10.1.1.0/24, 10.2.2.0/24, 10.3.3.0/24. S3 NBMA: 198.51.100.13. mGRE/IPsec, authentication, MTU, dual NHS and multicast maps are supplied. No NAT or overlay default/summary.
Approved per-neighbor overlay costs and the supplied hub/core topology already give each spoke an intra-area DC route with total cost 20 through H1 and 50 through H2. No other equal or shorter paths exist. Preserve these costs and the H1-preferred core return policy. Branch LANs are passive; hubs and spokes must form the required overlay adjacencies.
EXHIBIT B / CHANGE-WINDOW EMAILS
“Fast” does not define the failure.
Operations engineer · proposal awaiting review
Can we enable FRR on every tunnel and call that both hub and link protection? B is only cost 5 from R, so I suspect it is the best backup. Please check the actual protection scope and distances before approving that claim.
Service owner · final forwarding requirement
Keep both hub adjacencies. Prefer H1 for DC traffic, use H2 if H1 fails, and return to H1 after recovery. If a local transport repair succeeds, traffic should stay on H1. The overlay must avoid DR/BDR election and retain direct encrypted spoke traffic.
Change manager · authorized repair scope
Authorize per-prefix local LFA at R in underlay OSPF 10 for physical link R–E, protecting destination D, 192.0.2.1/32. Preserve overlay costs, core return policy and process separation. Evaluate whether E is protected rather than assuming it. Remote LFA, TI-LFA, MPLS and new links are outside authorization.
Lab assumptions: the selected platform/image supports local LFA on these physical global-table OSPF interfaces. D is included in FRR coverage. Failure detection is supplied. During an isolated R–E failure, successful repair completes before overlay adjacency expiry. No numerical recovery-time SLA is claimed.
A local FRR path to a hub cannot repair the failure of that destination hub. Hub failover uses the supplied overlay routing design. Full DC loss is outside scope.
EXHIBIT C / PRE-FAILURE DISTANCES
Which neighbor is a safe repair?
R is the repairing router; E is its primary next hop; N is a candidate alternate. d(X,Y) means the pre-failure shortest OSPF distance from X to Y. Lowercase d is a distance function; uppercase D is the destination.
Synthetic measurements consistent with Exhibit A
Candidate N
d(N,D)
d(N,R)
d(N,E)
A
15
15
5
B
25
5
15
d(R,D) = 20; d(E,D) = 10. Costs from R to its neighbors: E = 10, A = 15, B = 5. A and B use interfaces different from R–E. No additional exclusion policy or shared-risk constraint affects candidate eligibility.
Notation reminder
Use the local LFA loop-free test to evaluate link protection, then the separate node-protection test to check whether the path avoids E. These are OSPF shortest-path distances, not EIGRP reported or feasible distances.
FRR is a preinstalled local repair used during convergence. An alternate that works only after SPF completes does not prove local LFA readiness.
Read the operating state named in each row before selecting. Healthy operation, a single failure, and a restored path are different cases; the selections must satisfy the supplied requirements for that case.
Use the stakeholder requirements, topology and repair-cost evidence to approve the OSPF dual-hub design. Distinguish overlay hub failover from underlay repair of R–E, and determine whether the proposed repair satisfies the stated FRR conditions.
How to answer: Complete all ten rows with one selection per row. Each row is a separate design decision; read its explanatory prompt before choosing. For slash-separated options, read the operating states from left to right in the order defined by that row. Correct rows earn independent partial credit.
Approve the design.
Select one cell in each row. Each correct row earns 10 points; partial credit is awarded across the matrix.
