1

I literally have the following topology shown in the figure below. I have 4 VPCs, each VPC has 3 subnets (1 for the VM instance and the other 2 for interfaces). Each VPC hosts a Cisco CSR 1000v in subnet-1.

figure

I configured IPIP tunnel between instances and interfaces with the following configurations. It seems everything is okay. The show run details command is shown below.

R1

Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet1       172.0.1.9       YES DHCP   up                    up  
GigabitEthernet2       172.0.1.28      YES NVRAM  up                    up      
GigabitEthernet3       172.0.1.40      YES NVRAM  up                    up      
Tunnel0                10.10.1.1       YES NVRAM  up                    up      
Tunnel1                10.10.4.2       YES NVRAM  up                    up      
VirtualPortGroup0      192.168.35.101  YES NVRAM  up                    up

The routing protocol

Routing Protocol is "ospf 1"
Router ID 172.0.1.40
Number of areas in this router is 1. 1 normal 0 stub 0 nssa
Maximum path: 4
Routing for Networks:
10.10.1.0 0.0.0.3 area 0
10.10.4.0 0.0.0.3 area 0

R2

Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet1       172.1.1.11      YES DHCP   up                    up
GigabitEthernet2       172.1.1.27      YES NVRAM  up                    up      
GigabitEthernet3       172.1.1.46      YES NVRAM  up                    up      
Tunnel0                10.10.1.2       YES NVRAM  up                    up      
Tunnel1                10.10.2.1       YES NVRAM  up                    up      
VirtualPortGroup0      192.168.35.101  YES NVRAM  up                    up      

The routing protocol

Routing Protocol is "ospf 1"
Router ID 172.1.1.46
Number of areas in this router is 1. 1 normal 0 stub 0 nssa
Maximum path: 4
Routing for Networks:
10.10.1.0 0.0.0.3 area 0
10.10.2.0 0.0.0.3 area 0

R3

Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet1       172.2.1.6       YES DHCP   up                    up      
GigabitEthernet2       172.2.1.28      YES NVRAM  up                    up      
GigabitEthernet3       172.2.1.46      YES NVRAM  up                    up      
Tunnel0                10.10.2.2       YES NVRAM  up                    up      
Tunnel1                10.10.3.1       YES NVRAM  up                    up      
VirtualPortGroup0      192.168.35.101  YES NVRAM  up                    up      

The routing protocol

Routing Protocol is "ospf 1"
Router ID 172.2.1.46
Number of areas in this router is 1. 1 normal 0 stub 0 nssa
Maximum path: 4
Routing for Networks:
10.10.2.0 0.0.0.3 area 0
10.10.3.0 0.0.0.3 area 0

R4

Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet1       172.3.1.8       YES DHCP   up                    up      
GigabitEthernet2       172.3.1.25      YES NVRAM  up                    up      
GigabitEthernet3       172.3.1.38      YES NVRAM  up                    up      
Tunnel0                10.10.3.2       YES NVRAM  up                    up      
Tunnel1                10.10.4.1       YES NVRAM  up                    up      
VirtualPortGroup0      192.168.35.101  YES NVRAM  up                    up  

The routing protocol

Routing Protocol is "ospf 1"
Router ID 172.3.1.38
Number of areas in this router is 1. 1 normal 0 stub 0 nssa
Maximum path: 4
Routing for Networks:
10.10.3.0 0.0.0.3 area 0
10.10.4.0 0.0.0.3 area 0    

The problem I'm facing right now is that, when I do show ip ospf neighbor it shows nothing as well as show ip route ospf where I got Gateway of last resort is 172.0.1.1 to network 0.0.0.0.

All configuration details of the routers are shown below. R1

interface Tunnel0
 ip address 10.10.1.1 255.255.255.252
 keepalive 2 3
 tunnel source GigabitEthernet2
 tunnel mode ipip
 tunnel destination 54.70.35.124
!
interface Tunnel1
 ip address 10.10.4.2 255.255.255.252
 keepalive 2 3
 tunnel source GigabitEthernet3
 tunnel mode ipip
 tunnel destination 54.71.64.23
!
interface VirtualPortGroup0
 vrf forwarding GS
 ip address 192.168.35.101 255.255.255.0
 ip nat inside
 no mop enabled
 no mop sysid
!
interface GigabitEthernet1
 ip address dhcp
 ip nat outside
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet2
 ip address 172.0.1.28 255.255.255.240
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet3
 ip address 172.0.1.40 255.255.255.240
 negotiation auto
 no mop enabled
 no mop sysid
!
router ospf 1
 network 10.10.1.0 0.0.0.3 area 0
 network 10.10.4.0 0.0.0.3 area 0
!
iox
ip nat inside source list GS_NAT_ACL interface GigabitEthernet1 vrf GS overload
ip forward-protocol nd
ip tcp window-size 8192
ip http server
ip http authentication local
ip http secure-server
ip route 0.0.0.0 0.0.0.0 GigabitEthernet1 172.0.1.1
ip route vrf GS 0.0.0.0 0.0.0.0 GigabitEthernet1 172.0.1.1 global
ip ssh rsa keypair-name ssh-key
ip ssh version 2
ip ssh pubkey-chain
  username ec2-user
   key-hash ssh-rsa ****** ec2-user
ip scp server enable

ip access-list standard GS_NAT_ACL
 permit 192.168.35.0 0.0.0.255

control-plane

line con 0
 stopbits 1
line vty 0 4
 login local
 transport input ssh

app-hosting appid guestshell
 app-vnic gateway1 virtualportgroup 0 guest-interface 0
  guest-ipaddress 192.168.35.102 netmask 255.255.255.0
 app-default-gateway 192.168.35.101 guest-interface 0
 name-server0 8.8.8.8

R2

interface Tunnel0
 ip address 10.10.1.2 255.255.255.252
 keepalive 2 3
 tunnel source GigabitEthernet2
 tunnel mode ipip
 tunnel destination 34.211.24.85
!
interface Tunnel1
 ip address 10.10.2.1 255.255.255.252
 keepalive 2 3
 tunnel source GigabitEthernet3
 tunnel mode ipip
 tunnel destination 52.89.60.204
!
interface VirtualPortGroup0
 vrf forwarding GS
 ip address 192.168.35.101 255.255.255.0
 ip nat inside
 no mop enabled
 no mop sysid
!
interface GigabitEthernet1
 ip address dhcp
 ip nat outside
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet2
 ip address 172.1.1.27 255.255.255.240
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet3
 ip address 172.1.1.46 255.255.255.240
 negotiation auto
 no mop enabled
 no mop sysid
!
router ospf 1
 network 10.10.1.0 0.0.0.3 area 0
 network 10.10.2.0 0.0.0.3 area 0
!
iox
ip nat inside source list GS_NAT_ACL interface GigabitEthernet1 vrf GS overload
ip forward-protocol nd
ip tcp window-size 8192
ip http server
ip http authentication local
ip http secure-server
ip route 0.0.0.0 0.0.0.0 GigabitEthernet1 172.1.1.1
ip route vrf GS 0.0.0.0 0.0.0.0 GigabitEthernet1 172.1.1.1 global
!
ip ssh rsa keypair-name ssh-key
ip ssh version 2
ip ssh pubkey-chain
  username ec2-user
   key-hash ssh-rsa ****** ec2-user
ip scp server enable
!
ip access-list standard GS_NAT_ACL
 permit 192.168.35.0 0.0.0.255
!

control-plane

!
line con 0
 stopbits 1
line vty 0 4
 login local
 transport input ssh

app-hosting appid guestshell
 app-vnic gateway1 virtualportgroup 0 guest-interface 0
  guest-ipaddress 192.168.35.102 netmask 255.255.255.0
 app-default-gateway 192.168.35.101 guest-interface 0
 name-server0 8.8.8.8
end

R3

interface Tunnel0
 ip address 10.10.2.2 255.255.255.252
 keepalive 2 3
 tunnel source GigabitEthernet2
 tunnel mode ipip
 tunnel destination 52.13.239.188
!
interface Tunnel1
 ip address 10.10.3.1 255.255.255.252
 keepalive 2 3
 tunnel source GigabitEthernet3
 tunnel mode ipip
 tunnel destination 54.148.168.63
!
interface VirtualPortGroup0
 vrf forwarding GS
 ip address 192.168.35.101 255.255.255.0
 ip nat inside
 no mop enabled
 no mop sysid
!
interface GigabitEthernet1
 ip address dhcp
 ip nat outside
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet2
 ip address 172.2.1.28 255.255.255.240
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet3
 ip address 172.2.1.46 255.255.255.240
 negotiation auto
 no mop enabled
 no mop sysid
!
router ospf 1
 network 10.10.2.0 0.0.0.3 area 0
 network 10.10.3.0 0.0.0.3 area 0
!
iox
ip nat inside source list GS_NAT_ACL interface GigabitEthernet1 vrf GS overload
ip forward-protocol nd
ip tcp window-size 8192
ip http server
ip http authentication local
ip http secure-server
ip route 0.0.0.0 0.0.0.0 GigabitEthernet1 172.2.1.1
ip route vrf GS 0.0.0.0 0.0.0.0 GigabitEthernet1 172.2.1.1 global
!
ip ssh rsa keypair-name ssh-key
ip ssh version 2
ip ssh pubkey-chain
  username ec2-user
   key-hash ssh-rsa ******** ec2-user
ip scp server enable
!
ip access-list standard GS_NAT_ACL
 permit 192.168.35.0 0.0.0.255
!

control-plane
!

line con 0
 stopbits 1
line vty 0 4
 login local
 transport input ssh
!

app-hosting appid guestshell
 app-vnic gateway1 virtualportgroup 0 guest-interface 0
  guest-ipaddress 192.168.35.102 netmask 255.255.255.0
 app-default-gateway 192.168.35.101 guest-interface 0
 name-server0 8.8.8.8
end

R4

interface Tunnel0
 ip address 10.10.3.2 255.255.255.252
 keepalive 2 3
 tunnel source GigabitEthernet2
 tunnel mode ipip
 tunnel destination 52.34.186.234
!
interface Tunnel1
 ip address 10.10.4.1 255.255.255.252
 keepalive 2 3
 tunnel source GigabitEthernet3
 tunnel mode ipip
 tunnel destination 34.212.97.47
!
interface VirtualPortGroup0
 vrf forwarding GS
 ip address 192.168.35.101 255.255.255.0
 ip nat inside
 no mop enabled
 no mop sysid
!
interface GigabitEthernet1
 ip address dhcp
 ip nat outside
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet2
 ip address 172.3.1.25 255.255.255.240
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet3
 ip address 172.3.1.38 255.255.255.240
 negotiation auto
 no mop enabled
 no mop sysid
!
router ospf 1
 network 10.10.3.0 0.0.0.3 area 0
 network 10.10.4.0 0.0.0.3 area 0
!
iox
ip nat inside source list GS_NAT_ACL interface GigabitEthernet1 vrf GS overload
ip forward-protocol nd
ip tcp window-size 8192
ip http server
ip http authentication local
ip http secure-server
ip route 0.0.0.0 0.0.0.0 GigabitEthernet1 172.3.1.1
ip route vrf GS 0.0.0.0 0.0.0.0 GigabitEthernet1 172.3.1.1 global
!
ip ssh rsa keypair-name ssh-key
ip ssh version 2
ip ssh pubkey-chain
  username ec2-user
   key-hash ssh-rsa ****** ec2-user
ip scp server enable
!

ip access-list standard GS_NAT_ACL
 permit 192.168.35.0 0.0.0.255
!
control-plane
!
line con 0
 stopbits 1
line vty 0 4
 login local
 transport input ssh
!
app-hosting appid guestshell
 app-vnic gateway1 virtualportgroup 0 guest-interface 0
  guest-ipaddress 192.168.35.102 netmask 255.255.255.0
 app-default-gateway 192.168.35.101 guest-interface 0
 name-server0 8.8.8.8
end

Note that all the interfaces have been given a public address which is assigned as a destination for each IPIP tunnel configuration.

20
  • Can you ping across the tunnels? – Ron Trunk Dec 11 '18 at 18:04
  • @RonTrunk I could ping only the router's public address from any instance (GigabitEthernet1) of each CSR in the topology but the public addresses of tunnels are not reachable. – Khalil Mebarkia Dec 11 '18 at 19:16
  • 1
    So, I do not see any interfaces with the tunnel destination addresses. Also, none of the tunnel endpoints are on the same network. The tunnel sources must be the public addresses in the router of the tunnel, and the tunnel destinations must be the public addresses of the router on the other end. The tunnel interface addresses must be in the same network on each end of the tunnel because a tunnel is just like a point-to-point connection. – Ron Maupin Dec 11 '18 at 19:21
  • In addition to @ronmaupin 's comment above, have you considered using VPC-link? You could eliminate your routers altogether. – Ron Trunk Dec 11 '18 at 19:25
  • I'm not sure if tunnel mode ipip supports link-local multicast, and I'm having some difficulty in finding documentation about it. Multicast is is needed for protocols like OSPF and EIGRP for the discovery and hello mechanisms (unless explicitely configured for unicast). Most documentation about using OSPF or GRE across tunnels is about GRE or IPsec VTI ('tunnel mode ipsec ipv4'). – Marc 'netztier' Luethi Dec 11 '18 at 23:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.