GRE over EasyVPN
I have a PIX 501 connecting to a VPN Concentrator via EasyVPN. That connection works fine, now I want to add a router running GRE.
I cannot get my GRE tunnels to come up. I have added the fixup pptp command and a static translation, translating the Easy VPN obtain address to the router's inside address however nothing seems to be working⦠Any suggestions can any one confirm that you can run GRE over Easy VPN?
I think if you are doing NEM mode then you should be able to do GRE over Ipsec.
But when EasyVPn is "client mode" , all networks from remote site gets PAT'ed before they are sent through IPsec.Therefore it may not work.
GRE tunnel destination should be reachable for GRE tunnel to work , therefore , in client mode the PAT can hide the tunnel source address of remote site .
Check what mode of EasyVPN is ?
HTH
Saju
Pls rate helpful posts
Similar Messages
-
i have configured a network with ospf and a vpn site to site without gre tunnel and it works very well. I want to know, when do i have to use gre tunnel over ipsec
Jose,
It sounds like you currently have an IPsec Virtual Tunnel Interface (VTI) configured. By this, I mean that you have a Tunnel interface running in "tunnel mode ipsec ipv4" rather than having a crypto map applied to a physical interface. In the days before VTIs, it was necessary to configure GRE over IPsec in order to pass certain types of traffic across an encrypted channel. When using pure IPsec with crypto maps, you cannot pass multicast traffic without implementing GRE over IPsec. Today, IPsec VTIs and GRE over IPsec accomplish what is effectively the same thing with a few exceptions. For example, by using GRE over IPsec, you can configure multiple tunnels between two peers by means of tunnels keys, pass many more types of traffic rather than IP unicast and multicast (such as NHRP as utilized by DMVPN), and you can also configure multipoint GRE tunnels whereas VTIs are point to point.
Here's a document which discusses VTIs in more depth: http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-3s/sec-sec-for-vpns-w-ipsec-xe-3s-book/sec-ipsec-virt-tunnl.html#GUID-A568DA9D-56CF-47C4-A866-B605804179E1
HTH,
Frank -
DMVPN GRE over IPSEC Packet loss
I have a hub and spoke DMVPN GRE over IPSec topology. We have many sites, over 10, and have a problem on one particular site, just one. First off I want to say that I have replaced the Router and I get the same exact errors. By monitoring the Terminal, I regularly get these messages
%VPN_HW-1-PACKET_ERROR: slot: 0 Packet Encryption/Decryption error, Output Authentication error:srcadr=10.X.X.X,dstadr=10.X.X.X,size=616,handle=0x581A
%CRYPTO-4-RECVD_PKT_MAC_ERR: decrypt: mac verify failed for connection id=1
The tunnel is up, passes data, and always stays up. This router is a Spoke router. The routing protocol being used is EIGRP. When I do a
Show Crypto isakmp sa, it shows the state as being "QM_IDLE" which means it is up.
When I use the "Show Crypto Engine accelerator stat" this is what I get (Attached File)
You can see that there are ppq rx errors, authentication errors, invalid packets, and packets dropped. I know this is not due to mis-configuration because the config is the same exact as other sites that I have which never have any problems. Here is the tunnel interface and the tunnel source interface on the Spoke Router
interface Tunnel111
description **DPN VPN**
bandwidth 1000
ip address 172.31.111.107 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1300
ip pim sparse-dense-mode
ip nhrp authentication XXXX
ip nhrp map multicast dynamic
ip nhrp map multicast X.X.X.X
ip nhrp map X.X.X.X X.X.X.X
ip nhrp network-id 100002
ip nhrp holdtime 360
ip nhrp nhs 172.31.111.254
ip route-cache flow
ip tcp adjust-mss 1260
ip summary-address eigrp 100 10.X.X.X 255.255.0.0 5
qos pre-classify
tunnel source GigabitEthernet0/0
tunnel mode gre multipoint
tunnel key XXXX
tunnel protection ipsec profile X.X.X.X
interface GigabitEthernet0/0
description **TO DPNVPN**
ip address 10.X.X.X 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip pim sparse-dense-mode
ip virtual-reassembly
duplex full
speed 100
no snmp trap link-status
no mop enabled
Is there anything that you can think of that may becausing this, do you think this can be a layer one or two issue? Thanks
BrendenHave you try to turn off the hardware encryption (no crypto engine accelerator) just to see if it's better. But be careful, cause your CPU% will run much higher, but you only have 10 spokes sites, so it wont be at 100%.
It's better to start troubleshooting by layer 1 then layer 2 when it's possible. Have you ask the site's ISP for packet lost on their side ? -
ACC
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008009438e.shtml#diag
this is lab i did, today,and offcouse i am able to understand this lab bus the confusion are
1 . why we use crypto map on both interface (phiycal interface or tunnel interface)
2. when i remove crypto map from tunnel interface i recieve this message
( R2691#*Mar 1 01:12:54.243: ISAKMP:(1002):purging node 2144544879 )
please tell me what is meaning of this message
3.But i can see vpn is working fine. this is cryto sa and crypto isakmp sa
R2691#sh crypto ipsec sa
interface: Serial0/0
Crypto map tag: vpn, local addr 30.1.1.21
protected vrf: (none)
local ident (addr/mask/prot/port): (30.1.1.21/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (10.1.1.1/255.255.255.255/47/0)
current_peer 10.1.1.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 65, #pkts encrypt: 65, #pkts digest: 65
#pkts decaps: 66, #pkts decrypt: 66, #pkts verify: 66
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 2, #recv errors 0
local crypto endpt.: 30.1.1.21, remote crypto endpt.: 10.1.1.1
path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0
current outbound spi: 0xDBF65B0E(3690355470)
inbound esp sas:
spi: 0x44FF512B(1157583147)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 5, flow_id: SW:5, crypto map: vpn
sa timing: remaining key lifetime (k/sec): (4598427/3368)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xDBF65B0E(3690355470)
transform: esp-3des esp-md5-hmac ,
in use settings ={Tunnel, }
conn id: 6, flow_id: SW:6, crypto map: vpn
sa timing: remaining key lifetime (k/sec): (4598427/3368)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
R2691#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
30.1.1.21 10.1.1.1 QM_IDLE 1002 0 ACTIVE
IPv6 Crypto ISAKMP SA.
4 . how do i know it is useing GRE over IPsec.
i am also attach my topology on which i did labMR. Anuj here is my config
R7200#sh ip int b
Interface IP-Address OK? Method Status Protocol
Serial1/0 10.1.1.1 YES NVRAM up up
Loopback1 50.1.1.1 YES NVRAM up up
Loopback2 50.1.2.1 YES NVRAM up up
Tunnel0 40.1.1.2 YES NVRAM up up
Tunnel1 40.1.2.2 YES NVRAM up up
Tunnel2 40.1.3.2 YES NVRAM up up
=========================================================
R7200#sh int tunnel 0
Tunnel0 is up, line protocol is up
Hardware is Tunnel
Internet address is 40.1.1.2/24
MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel source 10.1.1.1 (Serial1/0), destination 30.1.1.1
Tunnel protocol/transport GRE/IP
Key disabled, sequencing disabled
Checksumming of packets disabled
Tunnel TTL 255
Fast tunneling enabled
Tunnel transport MTU 1476 bytes
Tunnel transmit bandwidth 8000 (kbps)
Tunnel receive bandwidth 8000 (kbps)
Last input 00:00:04, output 00:00:04, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 2
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
2229 packets input, 213651 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
2292 packets output, 220520 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
===============================================================
my cryto acl
is
access-list 101 permit gre host 10.1.1.1 host 30.1.1.1 -
DMVPN & GRE over IPsec on the same physical interface
Dear All,
I'm configuring two WAN routers, each wan router has one physical interface connecting to branches and regional office using same provider.
We'll be using GRE over IPsec to connect to regional office and DMVPN + EIGRP to branches.
I would like to know if it's possible to configure tunnels for GRE over IPsec and DMVPN + EIGRP using the same source physical interface.
Kindly reply, it's an urgent request and your response is highly appreciated.
Regards,Hi Savio,
It should work. we can configure dmvpn and gre-over-ipsec on ASA using same physical interface.
Regards,
Naresh -
High cpu consumption with GRE over IPSEC
Hi all,
After applying a gre over ipsec tunnel on one of our branch office, we get high cpu consumption (average 90%).
Tunnel is applied between Cisco 2851 (C2800NM-ADVIPSERVICESK9-M), Version 12.4(24)T2, (fc2) and
Cisco CISCO2921/K9 Version 15.0(1)M3.
Config of the tunnet is as follow :
- authentication pre-share
- encryption aes 256
- hash : sha
- transform set : esp-aes esp-sha-hmac mode transport
Routing process is eigrp.
Could anyone please help me on solving this issue?Cool, good start.
Check "show ip traffic" on both sides, it would be interesting to see what's going on.
BTW the CPU usage of top process doesn't add up to 90%, there's a possibility it's traffic rate/pattern + features (IP input and pool manager would suggest that). -
i have configured a network with ospf and a vpn site to site without gre tunnel and it works very well. I want to know, when do i have to use gre tunnel over ipsec
Hi josedilone19
GRE is used when you need to pass Broadcast or multicast traffic. That's the main function of GRE.
Generic Routing Encapsulation (GRE) is a protocol that encapsulates packets in order to route other protocols over IP networks
However there are some other important aspect to consider:
In contrast to IP-to-IP tunneling, GRE tunneling can transport multicast and IPv6 traffic between networks
GRE tunnels encase multiple protocols over a single-protocol backbone.
GRE tunnels provide workarounds for networks with limited hops.
GRE tunnels connect discontinuous sub-networks.
GRE tunnels allow VPNs across wide area networks (WANs).
-Hope this helps - -
Hello people,
im facing problem trying to establish a GRE tunnel over mpls. The topology goes as follows:
(server) ----CE1(6500)-----PE1(6500)----vrf cloud-----CE2(6500)--FW
-server needs to establish a gre tunnel with FW.
-server receives a default route from CE1 via OSPF.
-CE1 has an default static route pointing to the next hop which is an interface VLAN (in a vrf) on PE1.
- PE1 receives a default route generated by CE2 (via mpbgp).
In this situation the GRE tunnel wouldnt come up.The only way i got the GRE to work was replacing the default static route on CE1 with a more specific static route.
On both cases (default AND specific static routes) the connectivity(ping) from end to end was there.
Has anybody seen anything alike?
thanks,
BrunoYou could be looking at some recursive routing throug the GRE interface, so the second it comes up it will try to put the GRE packets through the GRE tunnel, this creating a loop. Are you using a dynamic routing protocol to get network info over the GRE tunnel or a static route if so, how is it setup ?
-
Is there any free streams based module available which implements
GRE tunneling over IP ?Marcus,
You can bridge non routable protocols like DECnet. My understanding is bridging isn't officially supported on GRE tunnels. What I mean by this is, that the router may accept the bridge commands on the tunnel int and may or mayn't forward bridged traffic across the tunnel but Cisco is obligated to provide a fix if it doesn't work.
HTH,
Sundar -
GRE over DSL with OSPF in an MPLS network
Hi guys,
we run 2 GRE tunnels in our network. The A end is a PE router while the B end are 2 different CPE DSL sites.
Both tunnels at the A end (PE) are using as a source a gig sub inteface which is in the same VRF
interface Tunnel40 (for branch office 1)
ip vrf forwarding example
ip address x.x.x.250 255.255.255.252
ip mtu 1476
ip tcp adjust-mss 1420
ip ospf dead-interval 60
ip ospf mtu-ignore
keepalive 10 6
tunnel source Gig x/x.z
tunnel destination x.x.x.x.
tunnel vrf example
interface Tunnel60 (for branch office 2)
the frame is as above
router ospf 1 vrf example
log-adjacency-changes
capability vrf-lite
passive-interface default
no passive-interface Tunnel40
no passive-interface Tunnel60
network x.x.x.250 0.0.0.0 area x.x.x.x
.network ......
CPE example
interface Tunnel1
ip address x.x.x.249 255.255.255.252
ip flow ingress
ip flow egress
ip ospf dead-interval 60
ip ospf mtu-ignore
keepalive 10 6
tunnel source Dialer1
tunnel destination z.z.z.1 ( this is the subinterafce Gig x/x.z on the PE router)
router ospf 1
router-id x.x.x.x
log-adjacency-changes
passive-interface default
no passive-interface Tunnel1
no passive-interface Vlan1
network x.x.x.x 0.0.0.0 area x.x.x.x
network x.x.x.249 0.0.0.0 area x.x.x.x
same is the config for CPE 2 ( just the frame of the commands no the ospf areas , IP s etc)
The problem is that when the tunnel fails for cpe 1 then it fails for CPE 2 exactly the same time.
Any advice.
ThanksHi my friend,
I didnt know about that command and the purpose you use that but I was searching a bit. Do you use that command for
normal GRE tunnels? This is not a point to multipoint topology and every tunnel is a point to point and I run ospf for the point to point link is is differnet area than the other tunnel. Do you beleive that its still could be related to the tunnel key?
Many thanks fo ryour advice. Please reply at your erliest convenience
I know it looks like hub and spoke or point to miltipoint but does it actually dehave like that?
Thank,
Spyros -
GRE over MPLS not working...
Hi
I've a GRE tunnel configured between a CE and a PE.
I guess the problem is on the PE side, this is my config:
interface Loopback99
ip vrf forwarding dar
ip address 99.99.99.99 255.255.255.255
interface Tunnel199
ip vrf forwarding dar
ip address 11.11.11.1 255.255.255.252
ip policy route-map dfbit
tunnel source Loopback99
tunnel destination 88.88.88.88
tunnel path-mtu-discovery
Everything is reachable between PE and CE, but on the tunnel interface I wasn't able to find out the "tunnel vrf dar" command...
I've a Cisco 7206VXR (164 ram and 128 flash) and on the software feature navigator I wasn't able to find out an IOS support it..
Can anybody tell me why ?
Tks
RicRiccardo,
This feature is available starting with 12.3(2)T.
Regards -
Hi, guys
recenctly I switch from ip nat inside to ip nat enable, but when I use ip nat enable my microsft vpn dosent work.
interface GigabitEthernet0/1
ip nat enable
interface GigabitEthernet0/0
ip nat enable
ip nat pool pool-vrf-blue 204.x.x.100 204.x.x.100 netmask 255.255.255.0 add-route
ip nat source list NAT-VRF-BLUE pool pool-vrf-blue vrf blue overload
ip nat source static tcp 10.0.0.2 1723 204.x.x.100 1723 vrf blue extendable
Best regardOk - This is what I currently have:
interface FastEthernet0/0.22
description NAT INT for VRF TEST to ERT02-BNE
encapsulation dot1Q 22
ip address 203.149.77.38 255.255.255.252
ip nat outside <-- Also tried "ip nat inside"
no snmp trap link-status
ip route 203.149.77.44 255.255.255.252 Null0
ip route vrf TEST10 0.0.0.0 0.0.0.0 FastEthernet0/0.22 203.149.77.37 global
ip nat pool NAT 203.149.77.45 203.149.77.46 netmask 255.255.255.252
ip nat source list 1 pool NAT vrf TEST10 overload
access-list 1 permit 10.0.0.0 log
access-list 1 permit 192.168.1.0 0.0.0.255 log
Attempting to get(trace/ping) to any address not within the vrf TEST10 (From device in vrf TEST10) results in timeout at 203.149.77.38 router.
Trace'ing with a source IP of 203.149.77.38 to an Internet address is successful
#sh ip route vrf TEST10
Routing Table: TEST10
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 203.149.77.37 to network 0.0.0.0
10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C 10.0.0.2/32 is directly connected, Virtual-Access7
B 10.0.3.0/24 [200/0] via 203.149.76.248, 3w0d
C 10.0.0.0/24 is directly connected, Loopback10
B 10.0.6.0/24 [200/0] via 203.149.76.250, 1w5d
B 10.0.7.0/24 [200/0] via 203.149.76.247, 1w4d
B 10.0.5.0/24 [200/0] via 203.149.76.249, 3w6d
U 192.168.1.0/24 [1/0] via 10.0.0.2
S* 0.0.0.0/0 [1/0] via 203.149.77.37, FastEthernet0/0.22 -
IPsec over GRE tunnel's line protocol is down but able to ping the tunnel destination
>>both routers are located in different countries and connected with ISP
>>IPsec over GRE tunnel is configured on both the routers
>>tunnel's line protocol is down for both the ends but able to reach the tunnel destination with tunnel source
>>Packet is not receiving on the router_1 and but could see packets are getting encrypting on the Router_2
>>ISP is not finding any issue with their end
>>Please guide me how i can fix this issue and what need to be check on this ????
========================
Router_1#sh run int Tunnel20
Building configuration...
Current configuration : 272 bytes
interface Tunnel20
bandwidth 2048
ip address 3.85.129.141 255.255.255.252
ip mtu 1412
ip flow ingress
delay 1
cdp enable
tunnel source GigabitEthernet0/0/3
tunnel destination 109.224.62.26
end
===================
Router_1#sh int Tunnel20
Tunnel20 is up, line protocol is up>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Keepalive is not set
Hardware is Tunnel
Description: *To CRPrgEIQbaghd01 - 2Mb GRE over Shared ISP Gateway*
Internet address is 3.85.129.141/30
MTU 17916 bytes, BW 2048 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel source 195.27.20.14 (GigabitEthernet0/0/3), destination 109.224.62.26
Tunnel Subblocks:
src-track:
Tunnel20 source tracking subblock associated with GigabitEthernet0/0/3
Set of tunnels with source GigabitEthernet0/0/3, 32 members (includes iterators), on interface <OK>
Tunnel protocol/transport GRE/IP
Key disabled, sequencing disabled
Checksumming of packets disabled
Tunnel TTL 255, Fast tunneling enabled
Tunnel transport MTU 1476 bytes
Tunnel transmit bandwidth 8000 (kbps)
Tunnel receive bandwidth 8000 (kbps)
Last input 1w6d, output 14w4d, output hang never
Last clearing of "show interface" counters 2y5w
Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
1565172427 packets input, 363833090294 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
1778491917 packets output, 1555959948508 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
=============================
Router_1#ping 109.224.62.26 re 100 sou 195.27.20.14
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 109.224.62.26, timeout is 2 seconds:
Packet sent with a source address of 195.27.20.14
Success rate is 92 percent (92/100), round-trip min/avg/max = 139/142/162 ms
Router_1#
============================================
Router_1#sh cry ip sa pe 109.224.62.26 | in caps
#pkts encaps: 831987306, #pkts encrypt: 831987306, #pkts digest: 831987306
#pkts decaps: 736012611, #pkts decrypt: 736012611, #pkts verify: 736012611
Router_1#sh clock
15:09:45.421 UTC Thu Dec 25 2014
Router_1#
===================
Router_1#sh cry ip sa pe 109.224.62.26 | in caps
#pkts encaps: 831987339, #pkts encrypt: 831987339, #pkts digest: 831987339
#pkts decaps: 736012611, #pkts decrypt: 736012611, #pkts verify: 736012611>>>>>>>>>>>>>>>>>>>>Traffic is not receiving from Router 2
Router_1#sh clock
15:11:36.476 UTC Thu Dec 25 2014
Router_1#
===================
Router_2#sh run int Tu1
Building configuration...
Current configuration : 269 bytes
interface Tunnel1
bandwidth 2000
ip address 3.85.129.142 255.255.255.252
ip mtu 1412
ip flow ingress
load-interval 30
keepalive 10 3
cdp enable
tunnel source GigabitEthernet0/0
tunnel destination 195.27.20.14
end
Router_2#
=======================
Router_2#sh run | sec cry
crypto isakmp policy 10
authentication pre-share
crypto isakmp key Router_2 address 195.27.20.14
crypto isakmp key Router_2 address 194.9.241.8
crypto ipsec transform-set ge3vpn esp-3des esp-sha-hmac
mode transport
crypto map <Deleted> 10 ipsec-isakmp
set peer 195.27.20.14
set transform-set ge3vpn
match address Router_2
crypto map <Deleted> 20 ipsec-isakmp
set peer 194.9.241.8
set transform-set ge3vpn
match address Router_1
crypto map <Deleted>
Router_2#
====================================
Router_2#sh cry ip sa pe 195.27.20.14 | in caps
#pkts encaps: 737092521, #pkts encrypt: 737092521, #pkts digest: 737092521
#pkts decaps: 828154572, #pkts decrypt: 828154572, #pkts verify: 828154572>>>>>>>>>>>>Traffic is getting encrypting from router 2
Router_2#sh clock
.15:10:33.296 UTC Thu Dec 25 2014
Router_2#
========================
Router_2#sh int Tu1
Tunnel1 is up, line protocol is down>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Down
Hardware is Tunnel
Internet address is 3.85.129.142/30
MTU 17916 bytes, BW 2000 Kbit/sec, DLY 50000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive set (10 sec), retries 3
Tunnel source 109.224.62.26 (GigabitEthernet0/0), destination 195.27.20.14
Tunnel Subblocks:
src-track:
Tunnel1 source tracking subblock associated with GigabitEthernet0/0
Set of tunnels with source GigabitEthernet0/0, 2 members (includes iterators), on interface <OK>
Tunnel protocol/transport GRE/IP
Key disabled, sequencing disabled
Checksumming of packets disabled
Tunnel TTL 255, Fast tunneling enabled
Tunnel transport MTU 1476 bytes
Tunnel transmit bandwidth 8000 (kbps)
Tunnel receive bandwidth 8000 (kbps)
Last input 1w6d, output 00:00:02, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 14843
Queueing strategy: fifo
Output queue: 0/0 (size/max)
30 second input rate 0 bits/sec, 0 packets/sec
30 second output rate 0 bits/sec, 0 packets/sec
1881547260 packets input, 956465296 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
1705198723 packets output, 2654132592 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 unknown protocol drops
0 output buffer failures, 0 output buffers swapped out
=============================
Router_2#ping 195.27.20.14 re 100 sou 109.224.62.26
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 195.27.20.14, timeout is 2 seconds:
Packet sent with a source address of 109.224.62.26
Success rate is 94 percent (94/100), round-trip min/avg/max = 136/143/164 ms
Router_2#
=========================Hello.
First of all, try to reset IPSec (clear crypto isakmp sa ..., clear crypto session ...).
Configure inbound ACL on the router to match esp protocol and check if the packets arrive.
Please provide full output "show crypto ipsec sa"
from both sides. -
QOS over multiple GREs with different BW's from core perspective
We use gre over ipsec, to connect multiple sites to our core. Many of the site have different BW based on remote site carrier limitations. The BW of some are symetrical, some are DSL.
I have started deploying VOIP at some of these sites, and have begun playing with QOS. I only want to insure voice traffic, and control are passed accordingly, all other traffic can fall into default queue during times of high link usage.
For the remote sites, I have settled on the below config:
class-map match-any AutoQoS-VoIP-RTP-Trust
match ip dscp ef
class-map match-any AutoQoS-VoIP-Control-Trust
match ip dscp cs3
match ip dscp af31
policy-map AutoQoS-Policy-Trust
class AutoQoS-VoIP-RTP-Trust
priority percent 70
class AutoQoS-VoIP-Control-Trust
bandwidth percent 5
class class-default
fair-queue
interface Tunnel17
bandwidth 5000
ip address 192.168.1.66 255.255.255.252
ip mtu 1500
ip tcp adjust-mss 1436
qos pre-classify
keepalive 10 3
tunnel source x.x.x.x
tunnel destination x.x.x.x
interface GigabitEthernet0/0
bandwidth 5000
ip address x.x.x.x 255.255.255.240
service-policy output AutoQoS-Policy-Trust
(only the part of the config related to QOS is included to protect the innocent!)
My question is, how do I apply a similiar config at the core end, where I have multiple GRE interfaces, with different corresponding bandwidths? I tried to apply the service-policy to the tunnel interface, but it does not accept the command because of the queuing type.
Thanks in advance.Another update, I have applied the follwoing config to my core ipsec router, on which 2 of the 19 gre tunnels have a VOIP solution at the far end. I am not seeing matches to the associated access lists, should I only see matches when the limit hits the shaper figure in the policy map?
class-map match-all hmh-class
match access-group name hmh-qos
class-map match-all hampwellness-class
match access-group name hampwellness-qos
class-map match-any AutoQoS-VoIP-RTP-Trust
match ip dscp ef
class-map match-any AutoQoS-VoIP-Control-Trust
match ip dscp cs3
match ip dscp af31
policy-map AutoQoS-Policy-Trust
class AutoQoS-VoIP-RTP-Trust
priority percent 70
class AutoQoS-VoIP-Control-Trust
bandwidth percent 5
class class-default
fair-queue
policy-map qos-shaper
class hmh-class
shape average 4000000
service-policy AutoQoS-Policy-Trust
class hampwellness-class
shape average 4000000
service-policy AutoQoS-Policy-Trust
interface GigabitEthernet0/1
service-policy output qos-shaper
ip access-list extended hampwellness-qos
permit gre host 192.168.1.69 host 192.168.1.70
ip access-list extended hmh-qos
permit gre host 192.168.1.65 host 192.168.1.66
interface Tunnel10
description GRE to Hampshire Wellness Center
bandwidth 5000
ip address 192.168.1.69 255.255.255.252
ip mtu 1500
ip tcp adjust-mss 1436
load-interval 30
qos pre-classify
keepalive 10 3
tunnel source x.x.x.x
tunnel destination x.x.x.x
interface Tunnel17
description GRE to Hampshire Memorial
bandwidth 5000
ip address 192.168.1.65 255.255.255.252
ip mtu 1500
ip tcp adjust-mss 1436
load-interval 30
qos pre-classify
keepalive 10 3
tunnel source x.x.x.x
tunnel destination x.x.x.x -
MPLS over GRE Support (Platform)
Hello,
I am looking to run MPLS over GRE (over the Public Internet) probably with IPSec for obvious reasons. CFN seems to suggest only the Cat6k with SUP-VS-2T or the Catalyst 6800 is capable of MPLS over GRE functionality...
I currently have 2 x Cisco 7200 VXR platforms (7204 & 7206) with the NPE-G2 processing engine and was wondering if we added the VSA encryption module (C7200-VSA=) would be enough to get a reliable MPLS over GRE tunnel functionality.
The tunnel with Encryption would ideally support up to 500Mbps.
My other alternative is to upgrade/replace the VXRs with ASRs (1002 or similar) but again CFN is unclear if the ASR100x platform is capable of delivering MPLS over GRE + IPSec.
Thanks,MPLS over GRE is not supported in Hardware for sup720. This is a PFC3 hardware limitation. Your options would be to use SPA-400 or Enhanced FlexWan.
Maybe you are looking for
-
HT5500 How can i delete all contacts on both iphone 4 and ipad mini 2
How can I delete all contacts on an iphone 4 or ipad mini 2
-
Is it possible to rollback patch 9206876 - UNABLE TO IMPORT INTERCOMPANY AP
Hi All, DB:11.1.0.7 Oracle Apps: 12.1.1 OS:Linux 86x64 Red Hat Is it possible to rollback patch 9206876 - UNABLE TO IMPORT INTERCOMPANY AP INVOICES. What are the patches those can be rolled back in EBS R12? Thanks for your time! Regards,
-
Airport Express Ethernet Port Question (Please);
Hello, Senario: If using an Airport Express to extend the wireless internet capabilities in a given area ( Internet is provided wirelessly from a pimary Airport Base Station to this Airport Express). Is this airport express able to also share interne
-
ICal repeating events become invisible if using Exchange 2010
I recently upgraded from Exchange 2007 server to Exchange 2010. I had PREVIOUSLY been impressed by well iCal under Snow Leopard worked with Exchange Server. Everything was great. But, after upgrading to Exch 2010, many of my repeating calendar items
-
Hi, I would like to know how to compare between 2 dates. for example if I have 1 employee working from 01-01-2005 to 31-03-2005 I want to know how many days is that so that can also view how many working staff in 1 shop per day... cos I'm thinking to