うらねこ

In that case, you have to pay attention on IPsec encap mode…

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/12-4t/sec-conn-dmvpn-12-4t-book/sec-conn-dmvpn-dt-spokes-b-nat.html

NHRP Registration

When an NHRP registration is received, the hub checks the source IP address on the encapsulating GRE/IP header of the NHRP packet with the source NBMA IP address, which is contained in the NHRP registration packet. If these IP addresses are different, then NHRP knows that NAT is changing the outer IP header source address. The hub preserves both the pre- and post-NAT address of the registered spoke.

Note	If encryption is used, then IPsec transport mode must be used to enable NHRP.

Let’s see this behavior.

1) show ip nhrp output in transport mode DMVPN.

Router-NHS#sh ip nhrp
10.10.10.1/32 via 10.10.10.2
Tunnel0 created 00:16:58, expire 01:43:02
Type: dynamic, Flags: unique registered
NBMA address: 1.1.1.1
(Claimed NBMA address: 192.168.1.1)

NHRP realize the IP address is changed by NAT (192.168.1.1 to 1.1.1.1).

2) show ip nhrp output in tunnel mode DMVPN.

Router-NHS#sh ip nhrp
10.10.10.1/32 via 10.10.10.2
Tunnel0 created 00:00:11, expire 01:59:49
Type: dynamic, Flags: unique registered used
NBMA address: 192.168.1.1

Iｎ the Case(2), NHRP believes the packet is not NATted since the original IP header is encapsulation and not changed. Therefore, original local(before nat) address is used as the NBMA address.