GRE Tunnel up/up Cannot ping tunnel interface

GRE Tunnel up/up Cannot ping tunnel interface
NewsGroups | Search | Tools
User Password
Register Now! Lost Password?
 comp.dcom.sys.cisco  Post an article  get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content  add this group's latest topics to your Google content  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
GRE Tunnel up/up Cannot ping tunnel interface tsvanduyn@yahoo.com 03-06-2006
Posted by tsvanduyn@yahoo.com on March 6, 2006, 3:55 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I setup a GRE tunnel between two cisco 2621 routers. They are both
running IOS c2600-advsecurityk9-mz.123-6c.bin. When I do a show ip int
brief they both show up/up. I can ping the tunnel address the router
is on but not the far end. This is true for both routers. I can also
ping both the source and dest. of the tunnel from both routers. So I
know that there shouldn't be any recurvise routing problems. I have
looked all over the cisco site trying to find some troubleshooting
information but, I don't see anything that applies. Any help would be
appreciated.

Here is a copy of my configs:

Corp Router:
interface Tunnel65
ip address 10.15.65.1 255.255.255.0
tunnel source FastEthernet0/0
tunnel destination 200.62.203.198
interface FastEthernet0/0
ip address 60.197.140.33 255.255.255.248
no ip mroute-cache
duplex auto
speed auto
ip route 200.62.203.198 255.255.255.255 60.197.140.34

Dest. Router
interface Tunnel65
ip address 10.15.65.65 255.255.255.0
tunnel source Dialer2
tunnel destination 60.197.140.33
interface Dialer2
ip address negotiated (Stays the same-Really a static)
no ip redirects
no ip unreachables
ip mtu 1492
ip nat outside
ip inspect to_internet out
encapsulation ppp
dialer pool 2
dialer-group 2
no cdp enable
ppp authentication chap pap callin
ppp pap sent-username *******@static.sbcglobal.net password 7
*************************
ip route 60.197.140.33 255.255.255.255 dialer2

Thanks,
Travis


home networking made easy, greater protection, less stress, introducing nm 5.0, 728x90
Posted by Charlie Root on March 6, 2006, 5:41 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

>I setup a GRE tunnel between two cisco 2621 routers. They are both
> running IOS c2600-advsecurityk9-mz.123-6c.bin. When I do a show ip int
> brief they both show up/up. I can ping the tunnel address the router

By default, a tunnel will stay up as long as there is route entry to reach
destination of the tunnel. If you would like tunnel to actually reflect its
operational capability you can enable 'keepalive' command in interface
tunnel configuration.

> is on but not the far end. This is true for both routers. I can also
> ping both the source and dest. of the tunnel from both routers. So I
> know that there shouldn't be any recurvise routing problems. I have
> looked all over the cisco site trying to find some troubleshooting
> information but, I don't see anything that applies. Any help would be
> appreciated.
>
> Here is a copy of my configs:
>
[...]

> interface Dialer2
> ip address negotiated (Stays the same-Really a static)
^^^^
the problem is here - this address is not known at the time when Tunnel
interface is created or lost at during interface reset (unfortunatelly it
won't be communicated back to the tunnel interface). I have just tried to
reproduce this scenario and it was working as long as I had statically
configured IP on the interface used as source for the tunnel. As soon as I
reconfigured it to be 'ip addr nego' and got interface reset, and 'sh int
tun0' displays that source address is 0.0.0.0. And I can ping destination of
the tunnel, but tunnel is down (because I enabled keepalive). As soon as I
change ip of the wan interface back to static tunnel comes up.

So my suggestion to you would be to have some static IP as source of the
tunnel. I always try to use loopback as source of a tunnel interface.

I've put some output here -
http://citadel.nobulus.com/~ilya/notes/archives/000018.html - so that you
can compare it with what you're seeing.

Hope it helps.

Kind regards,
iLya




Posted by tsvanduyn@yahoo.com on March 6, 2006, 6:31 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Ilya,

Thank you very much for you reply. I added the keepalives to both
router configs and now they are reporting tunnel is up/down. Which
makes sense because I cannot ping the far end of the tunnel interfaces.
Your explaination about the ip add negociated also makes sense but, the
static address I get from my provider is only issued with the ip
address negotiated command. Is there a way around this? Have you
ever setup GRE tunnels with nhrp? I read that that kind of setup would
support negotiated addresses. Again, thank you for all your input.

Travis


Posted by tsvanduyn@yahoo.com on March 6, 2006, 6:53 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Ilya,

Thank you very much for you reply. I added the keepalives to both
router configs and now they are reporting tunnel is up/down. Which
makes sense because I cannot ping the far end of the tunnel interfaces.
Your explaination about the ip add negociated also makes sense but, the
static address I get from my provider is only issued with the ip
address negotiated command. Is there a way around this? Have you
ever setup GRE tunnels with nhrp? I read that that kind of setup would
support negotiated addresses. Again, thank you for all your input.

Travis


Posted by Charlie Root on March 7, 2006, 5:40 am
If you were  Registered and logged in, you could reply and use other advanced thread options
> Ilya,
>
> Thank you very much for you reply. I added the keepalives to both
> router configs and now they are reporting tunnel is up/down. Which
> makes sense because I cannot ping the far end of the tunnel interfaces.
> Your explaination about the ip add negociated also makes sense but, the
> static address I get from my provider is only issued with the ip
> address negotiated command. Is there a way around this? Have you

If this is the address you always get, perhaps you could configure it
statically?

> ever setup GRE tunnels with nhrp? I read that that kind of setup would
> support negotiated addresses. Again, thank you for all your input.
>
I've just briefly looked at GRE and NHRP setups and they always seem to be
used in NMBA fashion. I don't do many tunnels as we basically setup either
MPLS VPN for a customer or IPSec terminated in MPLS VPN, or if there are
tunnels for multiple VPN access they sourced from loopback interfaces, so I
can't comment on applicability of NHRP in your case. One practical solution
I could suggest is to configure your central router as IPSec concentrator
and use Easy-VPN on the remote routers.

Kind regards,
iLya



Similar ThreadsPosted
Can't ping local side of GRE tunnel July 21, 2004, 2:52 pm
Can't ping local side of GRE tunnel July 21, 2004, 4:39 pm
Ping does not work inside the VPN tunnel September 8, 2006, 5:48 pm
GRE - Tunnel Interface March 15, 2005, 6:25 pm
tunnel interface ip September 14, 2005, 10:37 am
Backup Interface using Tunnel August 5, 2007, 1:37 pm
DECnet over GRE tunnel with serial interface October 4, 2005, 8:33 pm
GRE, importance of IP address for tunnel interface September 1, 2006, 11:48 am
GRE/IPSEC Tunnel and loopback interface April 30, 2007, 7:01 am
priority-list functionality on a tunnel interface December 22, 2004, 9:12 pm

other useful resources:
The Federal Communications Commission (FCC)
Telecommunications Industry Association
Electronic and Software Security Products and Services
International Telecommunication Union

Custom CGI Perl and PHP programming by 1-Script.com

Contact Us | Privacy Policy
The site map in XML format XML site map