Well, my idea is to connect to 4 CSR 1000v routers in different VPC (without VPC peering). I've basically finished with everything with the pre-configuration creating VPCs, subnets IGW, modifying Route Tables ... etc. Then, using IPsec over GRE tunnels, the 4 instances can see each other. (Thanks to @MLu for suggesting this idea How to do routing between the instances in AWS using Route Table? ).

After having 4 instances and each of them their Primary Network Interfaces is associated with public IP addresses ( is for CSR1 and is for CSR2). I saw this video where I almost have the same configuration YouTube Video link. I started to configure the tunnel between 2 CSRs 1000v routers, where I created an interface inside the router called Tunnel 0 with its source interface which is here GigabitEthernet 1 so my configuration is the following:

CSR1(config)#interface tunnel 0
CSR1(config-if)#tunnel source GigabitEthernet 1
CSR1(config-if)#tunnel destination

CSR2(config)#interface tunnel 0
CSR2(config-if)#tunnel source GigabitEthernet 1
CSR2(config-if)#tunnel destination

Then I configured the IP addresses of these both tunnels' interfaces as it shows in the figure below.

CSR1(config)#int tun 0
CSR1(config-if)#ip address

CSR2(config)#int tun 0
CSR2(config-if)#ip address

enter image description here

My problem now is that the status of these tunnels' interfaces are down as it shows show ip int br:

Interface              IP-Address      OK? Method Status           Protocol
GigabitEthernet1      YES DHCP   up                  up
Tunnel0             YES manual up                 down    
VirtualPortGroup0  YES NVRAM  up                  up      

I realized that I have to create a subnet for the tunnel which I did at the end then I created other interfaces in all instances.

My idea is to attach those new interfaces with a generated public IP address then I will get a new interface which is GigabitEthernet 2 obviously, and I continue the configuration using this new interface GigabitEthernet 2 instead of Tunnel 0. Can I do the same configuration for tunnels in GigabitEthernet interfaces? I'm not sure if I am on the right track.

  • you have to make sure your tunnel sources have ip reachibilty to each other. can you ping from ? you also might need to configure the default route to your GW if you have not done it yet.
    – NANIS
    Dec 9, 2018 at 6:45
  • @NANIS the ping is successful, the tunnel is down. Dec 10, 2018 at 13:26

1 Answer 1


I sort the problem out. When setting up the public for the interface source, GRE tunneling is mixing up with the NAT. Therefore, I used IPIP mode, and the problem is solved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.