Cisco CSR100V as a DMVPN hub

Has anyone managed to get this to work ? I have just launched a new CSR and it has a public and private interface. But I just cant get the DMVPN to go past NHRP. Does anyone have an example CSR config they could share. The CSR comes up as a spoke to the current HUB ok and EIGRP advertises the private subnet OK. The issue is if I try and get another spoke site to use the CSR as the hub. The inbound security group on the private CSR interface is currently set to accept all traffic from the spoke site.