Disappearing tunnel keepalives with tunnel interface in vrf

Question

Dear all
I have an annoying problem with a gre tunnel using keepalives and the tunnel interface on the PE residing in a vrf.
The background for my setup is an ethernet WAN link to our customer where the interface doesn't go down when the link fails.
Therefore I want to use an gre tunnel with keepalive in order to use static routes.
The tunnel setup is as follows:
1. PE, 6509, Sup720, IOS 12.2(18)SXF7
interface FastEthernet8/13
ip address xx.yy.zz.241 255.255.255.252
speed 10
duplex full
no mop enabled
interface Tunnel813
ip vrf forwarding CUSTOMER
ip address 10.0.0.101 255.255.255.252
keepalive 5 3
tunnel source xx.yy.zz.241
tunnel destination xx.yy.zz.242
end
2. CE, 1803, IOS 12.4(15)T8
interface FastEthernet0
bandwidth 5000
ip address xx.yy.zz.242 255.255.255.252
speed 10
full-duplex
interface Tunnel0
ip address 10.0.0.102 255.255.255.252
keepalive 5 3
tunnel source xx.yy.zz.242
tunnel destination xx.yy.zz.241
The problem is PE sends and receives keepalives and brings up the tunnel. CE on the other hand sends but doesn't receive keepalives.
As far as I have learned from former discussions the problem comes from tunnel and physical interface belonging to different routing instances. If I put the tunnel interface on PE into the global routing instance all the keepalives reach their destinations as expected.
I read about a solution involving "tunnel vrf" on th etunnel configuration. This command is not present in my IOS version but AFAIK it is only necessary for having the underlying physical interface in a vrf as well.
Furthermore I read about "mls mpls tunnel-recir" but I am not sure whether this might solve the issue here. And equally important: Can I safely turn on this feature on a running system with quite a lot of vrf customers without any trouble?
Any hint and/or advise is greatly appreciated here.
Thanks a lot in advance,
Grischa

Answer 1

Wow, this is old, but...
While they may or may not be officially supported, GRE tunnels do work with vrf's if you both put the tunnel interface in the VRF AND the physical interface the tunnel runs over, AND use the tunnel vrf command.  Then everything is in the same routing table and it works.  For example:
PE:
vrf definition vrf1
rd 1:1
address-family ipv4
  route-target export 1:1
  route-target import 1:1
exit-address-family
interface Ethernet0/0
vrf forwarding vrf1
ip address 192.168.1.1 255.255.255.0
interface Tunnel1
vrf forwarding vrf1
ip address 1.1.1.1 255.255.255.252
keepalive 1 3
tunnel source Ethernet0/0
tunnel destination 192.168.1.2
tunnel vrf vrf1
router bgp 12345
bgp log-neighbor-changes
address-family vpnv4
! Provider stuff - i.e., route reflector for MPLS network
exit-address-family
address-family ipv4 vrf vrf1
  neighbor 1.1.1.2 remote-as 64512
  neighbor 1.1.1.2 activate
  neighbor 1.1.1.2 default-originate
exit-address-family
CE:
interface Ethernet0/0
ip address 192.168.1.2 255.255.255.0
interface Tunnel1
ip address 1.1.1.2 255.255.255.252
keepalive 1 3
tunnel source Ethernet0/0
tunnel destination 192.168.1.1
router bgp 64512
bgp log-neighbor-changes
! network statements perhaps
! redistribute static perhaps
neighbor 1.1.1.1 remote-as 12345
neighbor 1.1.1.1 update-source Tunnel1
neighbor 1.1.1.1 soft-reconfiguration inbound
Of course you don't need to run BGP, but you can.