12000 GSR support of tunneling (GRE / IPinIP)

Can anyone please advise if the GSR (12000) routers support tunneling with either the GRE or the IPinIP protocols ?
If so please indicate which IOS version support those features.

no. The only tunneling supported on the GST is UTI.
http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120limit/120s/120s18/uti_gsr.htm

Similar Messages

Does WRT1900AC support 6to4 tunnel

My broadband carrier provides 6to4 tunnel to connect to IPv6 network. But I cannot find where to set 6to4 tunnel, just a 6rd tunnel in setting page. So I wanna know when will it support 6to4 tunnel. Thanks
Solved!
Go to Solution.

AFAIK only 6rd is available for the IPv6 transition protocols on the WRT1900AC unless you use OpenWRT firmware.
I don't recommend using IPv6 unless it's required by the ISP. At least not until these transition protocols are no longer needed and the net has converted to IPv6.
Please remember to Kudo those that help you.
Linksys
Communities Technical Support

Does SNCP support DCC Tunnel??

We have 30 ONS 15454 SDH nodes installed within metro area, and have several stm-1 equipements connected to this network.
There is one DCC Tunnel for each VC-4 circuits to support 3-party NMS.
All VC-4 circuits have SCNP protected when fiber cuts happened, but DCC Tunnel seemed broken. We have to recreate an Overhead Circuit to re-establish connections for 3-party NMS.
It seems like DCC Tunnel does not have SNCP protection.
Would anyone please give me any advice.
Thanks.

DCC tunneling is not linked to any circuit and can exist by itself. I dont think there is SNCP DCC tunnel protection and hence the behavior that you have got is expected.

Overlapping Networks with Tunnel GRE/IPsec and NAT

Has anyone experience with NATing on a GRE tunnel interface? I need to NAT between two private networks because they are overlapping. I tried to NAT directly on the tunnel interface.
e.g.
Ethernet 0/0
ip nat inside
Tunnel0 (GRE with CryptoMap)
ip nat outside
However I didn't succeed this way. What's the best way to achive my goal?

Thanks. I already checked this paper. The problem is that it only talks about IPsec and not about GRE/Ipsec and nating on a Tunnel interface.
However I made some tests in the lab and it worked fine. So I went back to the customer-site and I had to reboot the small 836 to get it working.
What I learnedis : "ip nat outside" on a tunnel interface on a Cisco 836 is no problem. This is good news if you have to add partners companies with GRE/IPsec and they don't have IP ranges you like, so you just NAT them and give them IP addresses of your choice.

CRS-1 support EoMPLS preferred tunnel selection ?

Can anyone help me verify the CRS-1 support EoMpls Tunnel selection function ? or this function is only on the Cisco 12000 router ?
IOS-XR configuration guide 3.6 : have this function , I do not find any restriction.
I check IOS-XR 3.7 config guide, it say :
http://www.cisco.com/en/US/docs/ios_xr_sw/iosxr_r3.7/mpls/configuration/guide/gc37te.html#wp1325561
The following PBTS functions are supported only on the Cisco XR 12000 Series Router:
*L2VPN preferred path selection lets traffic be directed to a particular
TE tunnel.
So , I am not sure CRS-1 support it or not?
Thanks for your help.
Michael

Hello Michael,
it says:
>>>The following PBTS functions are supported only on the Cisco XR 12000 Series Router:
â¢L2VPN preferred path selection lets traffic be directed to a particular TE tunnel.
â¢Both Interior Gateway Protocol (IGP) and Label Distribution Protocol (LDP) paths are used as the default path for all traffic that belongs to a class that is not configured on the TE tunnels.
â¢According to the quality-of-service (QoS) policy, tunnel selection is based on the outgoing experimental (EXP) value and the remarked EXP value.
â¢IPv6 traffic for both 6VPE and 6PE scenarios are supported.
My understanding is that the feature is not supported on CRS-1
Hope to help
Giuseppe

When do i have to use a gre over ipsec tunnel? i have heard that when i m using a routing protocol and vpn site to site i need a

i have configured a network with ospf and a vpn site to site without gre tunnel and it works very well. I want to know, when do i have to use gre tunnel over ipsec

Hi josedilone19
GRE is used when you need to pass Broadcast or multicast traffic. That's the main function of GRE.
Generic Routing Encapsulation (GRE) is a protocol that encapsulates packets in order to route other protocols over IP networks
However there are some other important aspect to consider:
In contrast to IP-to-IP tunneling, GRE tunneling can transport multicast and IPv6 traffic between networks
GRE tunnels encase multiple protocols over a single-protocol backbone.
GRE tunnels provide workarounds for networks with limited hops.
GRE tunnels connect discontinuous sub-networks.
GRE tunnels allow VPNs across wide area networks (WANs).
-Hope this helps -

I need a device support more than 40000 l2tp tunnels

we have a 7206 act a lns we found 7206 can support 16000 tunnels
Now we want to find a router to support 40000 tunnel
I find just Asr 1k 40g support 64000 tunnels
does asr 9006 support l2tp
I haven't found other device to support more than 40000 l2tp tunnel
Can Asr 1004 esp 40g can replace 7206
Thankyou
Tom

the ASR 9006 supports l2tp and the maximum number of tunnels supported is 131072 that can be configured with the maximum session command you can check the document below
http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r4-2/bng/configuration/guide/b_bng_cg42asr9k.pdf

Unable to select tunnel mode ipv6ip

Hi.
Please, can you explain why I am not able to select tunnel mode "ipv6ip" on my switch. I would like to configure tunnel from Hurricane tunnelbroker.net.
switch-cisco-lab-cor(config-if)#tunnel mode ? aurp AURP TunnelTalk AppleTalk encapsulation cayman Cayman TunnelTalk AppleTalk encapsulation dvmrp DVMRP multicast tunnel eon EON compatible CLNS tunnel gre generic route encapsulation protocol ipip IP over IP encapsulation iptalk Apple IPTalk encapsulation ipv6 Generic packet tunneling in IPv6 nos IP over IP encapsulation (KA9Q/NOS compatible)switch-cisco-lab-core#show running-config interface tunnel 0Building configuration...Current configuration : 203 bytes!interface Tunnel0 description Hurricane Electric IPv6 Tunnel no ip address shutdown ipv6 address 2001:xxx:xxxx::2/48 ipv6 enable tunnel source 172.16.1.1 tunnel destination xxx.xxx.xxx.xxxendSwitch Ports Model SW Version SW Image ------ ----- ----- ---------- ---------- * 1 52 WS-C3560G-48TS 12.2(53)SE C3560-IPSERVICESK9-M

Hi,
You need Advanced IP services feature set for IPv6 in IPv4 tunneling feature support.
HTH
Laurent.

GRE device L3 device L2 integration

Hi everyone.
I have one question about the GRE tunnelling.
I have two devices that need to connect the GRE tunnel. One supports IP over GRE (which is L3), and the other supports Ethernet over GRE (Protocol No. 0x2f/Protocol 0x6558). So far we have tried to connect it with GRE tunnel (this is one of two options for integration, other one is ethernet over IP) but no success yet.-Is this an unresolve problem because these tunnels is one L3 and L2 second over GRE? Is there any solution how to connect it?
Now my further question is whether I can put between them eg L2/L3 switch or a router that will the traffic from the first device which supports IP over GRE with L3, landed on L2 (Ethernet over GRE-Protocol No. 0x2F / Protocol 0x6558) and passed on to second device that this is Ethernet over GRE?
Waitting for your replay,
thanks in advance,
regards,
adnan

Duplicate post, please add any answers into the other thread -
https://supportforums.cisco.com/discussion/12471861/subnet-vs-vlan-l2-broadcast-and-l3-broadcast
Jon

Cryto map no set on tunnel

Good afternon
on router 1941/k9 [c1900-universalk9-mz.SPA.151-4.M2.bin]
and router 2911/k9 [c2900-universalk9-mz.SPA.152-1.T.bin]
I try to set crypto map, I type on tunnel configuration:
router(config-if)#crypto map VPN_AA_SS
% NOTE: crypto map is configured on tunnel interface.
        Currently only GDOI crypto map is supported on tunnel interface.
router displayed above message that crypto map is set on tunnel, but crypto map doesnot apper configurated on tunnel with " show" command
router#sho crypto map
Crypto Map IPv4 "VPN_AA_SS" ipsec-isakmp
        Peer = 192.xx.xx.xx
        Extended IP access list 146
            access-list 146 permit gre host 192.xx.xx.xx host 192.xx.xx.xx
        Security association lifetime: 4608000 kilobytes/3600 seconds
        Responder-Only (Y/N): N
        PFS (Y/N): N
        Transform sets={
                dd_BBBB_RRR: { esp-3des esp-md5-hmac } ,
       Interfaces using crypto map VPN_AA_SS:
any interface has had configurate tunnel
With show access list 146, doesnot appers matches.
I checked with others configurations examples, all steps are configurated.
Thanksfull some help.
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Buenas noches
en router 1941/k9 [c1900-universalk9-mz.SPA.151-4.M2.bin]
y router 2911/k9 [c2900-universalk9-mz.SPA.152-1.T.bin]
se trata de configurar un "crypto map" dentro del tunnel
router(config-if)#crypto map VPN_AA_SS
% NOTE: crypto map is configured on tunnel interface.
        Currently only GDOI crypto map is supported on tunnel interface.
cuando se realiza el proceso de configuración, los routers indican que esta listo configurado, según el mensaje anterior, pero con el comando de "show crypto map" no aparece configurado en la interfaz tunnel:
router#sho crypto map
Crypto Map IPv4 "VPN_AA_SS" ipsec-isakmp
        Peer = 192.xx.xx.xx
        Extended IP access list 146
            access-list 146 permit gre host 192.xx.xx.xx host 192.xx.xx.xx
        Security association lifetime: 4608000 kilobytes/3600 seconds
        Responder-Only (Y/N): N
        PFS (Y/N): N
        Transform sets={
                dd_BBBB_RRR: { esp-3des esp-md5-hmac } ,
        Interfaces using crypto map VPN_AA_SS:
cuando se aplica el "sho acces-list 146, tampoco muestra concordancias con la lista.
revise con otros ejemplos y todo esta configurado.
Se agradece cualqueir ayuda.

The error message is correct. Crypto map on tunnel interface is something we were migrating customers away from for a long, long time.
The last time this was actually needed with in 12.3 mainline (AFAIR).
In newer IOSes this was actually causing problems.
Newer IOS releases will not allow crypto map on tunnel interfaces to be configured.
What are you deploying? GRE over IPsec/VTI configuration can be achieved by using tunnel protection on tunnel interface.
IPsec over GRE ... well consider if you trully want to implement it.

887 ipsec+gre+ospf models and licenses

I'm choosing router for brunch office among this models - 887VA-SEC-K9 or 887VA-K9. I want this router to can IPSEC site-to-site, GRE-tunnels and OSPF. I read the datasheet but I haven't understood several things about this model so I can't choose a right model. The datasheet says that default software is Advanced Security Feature Set for all 887 routers which supports IPSEC and GRE. Then I don't understand what are differences between 887VA-SEC-K9 or 887VA-K9? What does the word "SEC" mean? The second things aren't understood - I want the router to support OSPF. The Advanced IP Services can do it but there is two options too - SL-880-AIS and L-SL-800-SEC-K9. What are differences between them?
What should I choose to implement IPSEC-GRE-OSPF among this models and licenses?

The ASR1004 router we can only send packets with a maximum MTU size of 1438 Bytes over the encrypted tunnel.

Sup32 and mpls over gre

does sup32 on 7600 router support mpls over gre, my uplinks
to the core are connected via sup32?

Hello Atif,
in the following link the datasheet of sup32
http://www.cisco.com/en/US/prod/collateral/modules/ps2797/ps5972/product_data_sheet0900aecd801c5cab_ps368_Products_Data_Sheet.html
table1 contains the following:
Hardware-enabled MPLS-Enables use of VPNs and Layer 2 tunneling while improving traffic engineering for QoS and adding multiprotocol support
• Hardware-enabled IPv6-Expands available IP addresses, enabling better address allocation and address aggregation and supporting greater end-to-end connectivity and services
• Hardware-enabled GRE tunnels for IP traffic
be aware that performances are limited in comparison to sup720 as it is shown in table2.
Hope to help
Giuseppe

Interface bandwith GRE on switch C3750G

Hello,
Can you please tell me how I can know the actual bandwidth on this interface?
I am doing research on the internet and I found, but it does not appear on my switch BBO this information:
Tunnel transmitted bandwidth 8000 (kbps)
Tunnel receive bandwidth 8000 (kbps)
######### Here show a tunnel interface from my switch BBO ##########
Switch#sh interfaces tunnel 1
Tunnel1 is up, line protocol is up
Hardware is Tunnel
Description: Vers_BBO_1
Internet address is 192.168.1.46/30
MTU 1514 bytes, BW 100 Kbit, DLY 50000 usec,
     reliability 255/255, txload 54/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel source x.x.x.x destination x.x.x.x
Tunnel protocol/transport GRE/IP, key disabled, sequencing disabled
Tunnel TTL 255
Checksumming of packets disabled, fast tunneling enabled
Last input 3w2d, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 444000 bits/sec, 185 packets/sec
     47 packets input, 5458 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     120238749 packets output, 36159257307 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out

Hi,
A Tunnel interface is nothing more than just a process of putting another layer of headers onto an existing datagram to protect or hide its internal headers. There is no physical interface related to the operation of a Tunnel interface. Once a tunneled packet is created, it is forwarded through some other physical interface on the device that performs the tunneling.
There are two possible bottlenecks that ultimately define the bandwidth as seen by a Tunnel interface. The first bottleneck is the CPU of the router if the tunneling operations are performed in the operating system and not in specialized hardware. Too many packets to be tunneled can easily overwhelm the CPU and its capabilities. The second bottleneck is the physical inteface itself that will be used to send out the tunneled packet.
On Catalyst 3xxx switches, there is no hardware support for tunneling operations, meaning the GRE tunneling encapsulation and decapsulation is performed in software and must be executed on the CPU. While there is no official benchmark as far as I know, I estimate that with the CPU in a Cat3750G, the throughput of a GRE tunnel is, at most, in orders of Mbps or tens of Mbps in ideal conditions. I do not think anyone will be willing to guarantee this figure, as these devices are not really intended to terminate GRE tunnels.
Apart from that, however, you do not really care about the bandwidth command setting on Tunnel interfaces, as that command has no influence on the real throughput of this interface - it just influences routing protocols like OSPF and EIGRP in their best path selection, and it may impact QoS mechanisms if applied to the Tunnel interface. However, if none of this is of a concern, simply configure the bandwidth command on a Tunnel interface to, say, 1000 (meaning 1Mbps) and you should be fine.
Best regards,
Peter

GRE IPSec between Cisco 2811 and FortiGate 110C

Hello,
Does anybody know if it is possible to configure GRE IPSec tunnel between Cisco 2811 router and FortiGate 110C firewall? I know that FortiGate supports IPSec and GRE tunnels, but maybe somebody succeeded in establishing an IPSec GRE between those routers? Could you also give a link to the appropriate documentation if it is possible?

Hi,
You can configure the GRE tunnel on the 2811.
I'm aware that you can configure sort of a GRE tunnel on the Fortinet as well, but I have not seen a GRE tunnel between a Cisco and other vendor.
I've only seen GRE tunnels between Cisco devices (however I have not tried it to assure you that it will not work :-()
Federico.

Why DMVPN contains GRE ?

I read that tunnel GRE,provides the possibility to use dynamic routing protocol such as EIGRP or OSPF ,because IPsec doesn't support multicast and broadcast which are used by theses protocols,i read about the gre encapsulation,but i don't understand how these encapsulation pemit multicast,
Ipsec don't support multicast because of the fact that the protocol IKE do not expect to negotiate security associations between more than two devices.
please i need some detailed explanations about this,to know how GRE encapsulation allows the multicast
thanks in advance
Abdelilah

Rudy,
Actually, just to be clear, to quote the from the link.
There is really no reason that the ESP in IPSec could not transport multicast. It is just challenging because IPSec is implemented as a policy based VPN as opposed to a route based VPN
Most implmentations (including Cisco) are agnostic to what rides on top as long as it's IP.
The challange is building the right policy. IPsec "supports" multicast, or rather it's not aware whether packet forwarded is mcast or not. With notable exceptions related to some implmentations.
M.

12000 GSR support of tunneling (GRE / IPinIP)

Similar Messages

Maybe you are looking for