1

Two routers R1 and R2 have a tunnel built between them in the 103.103.103.0/24 network. The end point of the tunnel are 75.75.75.2(on R1) and 76.76.76.2(on R2). Can anyone explain why does the Tunnel protocol/transport says GRE/IP on R1 and IPSEC/IP on Router2. Below are the outputs of sh int tunnel10 on R1 and R2

Router1 output

Tunnel10 is up, line protocol is up
  Hardware is Tunnel
  Internet address is 103.103.103.1/24
  MTU 9914 bytes, BW 100 Kbit/sec, DLY 50000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation TUNNEL, loopback not set
  Keepalive not set
  Tunnel linestate evaluation up
  Tunnel source 75.75.75.2, destination 76.76.76.2
  Tunnel protocol/transport GRE/IP
    Key disabled, sequencing disabled
    Checksumming of packets disabled
  Tunnel TTL 255, Fast tunneling enabled
  Tunnel transport MTU 1414 bytes
  Tunnel transmit bandwidth 8000 (kbps)
  Tunnel receive bandwidth 8000 (kbps)
  Tunnel protection via IPSec (profile "VTI_PRO")
  Last input never, output never, output hang never
  Last clearing of "show interface" counters 4d23h
  Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/0 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     251 packets output, 29852 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out

Router2 Output

Tunnel10 is up, line protocol is up
  Hardware is Tunnel
Internet address is 103.103.103.2/24
MTU 9938 bytes, BW 100 Kbit/sec, DLY 50000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel linestate evaluation up
Tunnel source 76.76.76.2, destination 75.75.75.2
Tunnel protocol/transport IPSEC/IP
Tunnel TTL 255
Tunnel transport MTU 1438 bytes
Tunnel transmit bandwidth 8000 (kbps)
Tunnel receive bandwidth 8000 (kbps)
Tunnel protection via IPSec (profile "VTI_PRO")
Last input never, output never, output hang never
Last clearing of "show interface" counters 4d23h
Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
   235 packets input, 28228 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     118 packets output, 11800 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 unknown protocol drops
     0 output buffer failures, 0 output buffers swapped out

Router1 running-config

Current configuration : 4283 bytes
!
! Last configuration change at 04:56:53 UTC Thu Feb 14 2019 by cisco
!
version 16.6
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
platform console virtual
!
hostname ROUTER1
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$QssS$FkqsF3P/9Q5JIvteiWJr8/
!
aaa new-model
!
!
!
!
!
!
!
aaa session-id common
!
!
!
!
!
!
!
ip domain name ROUTER1
!
!
!
!
!
!
!
!
!
!
subscriber templating
!
!
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
crypto pki trustpoint TP-self-signed-3087339968
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-3087339968
 revocation-check none
 rsakeypair TP-self-signed-3087339968
!
!
crypto pki certificate chain TP-self-signed-3087339968
 certificate self-signed 01
  30820330 30820218 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 33303837 33333939 3638301E 170D3139 30323132 31313532
  35375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 30383733
  33393936 38308201 22300D06 092A8648 86F70D01 01010500 0382010F 00308201
  0A028201 01009BED A714C7F8 F8DF4A08 D5D5FCC6 E97C969A 836679BD D662C6B4
  DFF32CCD DA3CC2BC 550BDB3C 15E7E219 745D14EF 8C613041 8B6D45C7 5B2F7DAE
  F4482FF8 6A778FA3 36D0E789 B14818E6 2BA420F3 25018420 0649354A 5EBFD4F1
  30912E0F C774901B B8BA5F2D B4957F18 85E50C7A D0F6A678 6F4FBD61 C0A6F87E
  B9F766BF FBBE873A 606E3B34 7BDD0C9F 5B24F11C 087137F2 AD7820D1 803EF1BF
  D1B9E3D9 2D88D9F4 03F789E2 44C1AD85 C13FD356 F107428D CFD9196B D320E20C
  23EF7C76 8A42E521 77917131 4A6E1136 37595DA2 8373FA6F 5D2FCE3E 4115B4EE
  AC20A5FE FA0AEA79 1732C9A7 21E549D4 528CE2BE FF3037C4 1FB1B157 954D892F
  64088556 04170203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF
  301F0603 551D2304 18301680 14C0C3E9 CA9C42C1 FAB77389 8789A45C 40A596AA
  8A301D06 03551D0E 04160414 C0C3E9CA 9C42C1FA B7738987 89A45C40 A596AA8A
  300D0609 2A864886 F70D0101 05050003 82010100 15C2297C 0AB01B91 98B94782
  C47EBDA4 D7EC6F20 070CA4F6 62A32A19 4B3D71CD 00C3FECA F70C0902 96863D2C
  97E5E9DF 5CE3EDF6 B824F94D B771D310 9D1FCC84 FC8EC181 BBC62C68 2FFE361A
  6576512D CEB84CD8 F704EDE2 EA23F753 FA3E13A6 BFED577D 8ABFD961 8A01A927
  186E29C7 07066C3F 7723A4F3 C15ED214 B286D10F 01CF32F4 797AE5AD DD45C1A1
  8DB29BB8 8CFCA16C 76359212 F7110229 0B058E29 B795CCE4 9C94D0E4 13EEE021
  A48136E4 B6CAB851 93C6B84E 3D16EFF6 B20CDED9 1C8B4F1D 6CFCF774 A2305620
  4C2A23AE D1DADFD5 060F2D97 EC084B8A 78E282CC DC1153D1 88B66B2E 5D0EC1E5
  A0CFBE49 AA9923BC C01DC8BC 0AE00F5E 78290F33
        quit
!
!
!
!
!
!
!
!
!
license udi pid CSR1000V sn 9HP6SYS8QUR
diagnostic bootup level minimal
spanning-tree extend system-id
!
!
!
username cisco privilege 15 secret 5 $1$3doI$HAZLTITYVE65p1wfs01PU.
!
redundancy
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 888
 authentication pre-share
crypto isakmp key cisco address 0.0.0.0
!
!
crypto ipsec transform-set TSET_VTI esp-aes esp-sha-hmac
 mode tunnel
!
crypto ipsec profile VTI_PRO
 set transform-set TSET_VTI
 responder-only
!
!
!
!
!
!
!
!
!
!
interface Loopback100
 ip address 89.89.89.1 255.255.255.0
!
interface Tunnel10
 ip address 103.103.103.1 255.255.255.0
 tunnel source 75.75.75.2
 tunnel destination 76.76.76.2
 tunnel protection ipsec profile VTI_PRO
!
interface GigabitEthernet1
 ip address 74.74.74.2 255.255.255.0
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet2
 ip address 75.75.75.2 255.255.255.0
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet3
 ip address dhcp
 negotiation auto
 no mop enabled
 no mop sysid
!
!
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip route 73.73.73.0 255.255.255.0 74.74.74.1
ip route 76.76.76.0 255.255.255.0 75.75.75.1
ip route 77.77.77.0 255.255.255.0 75.75.75.1
ip route 78.78.78.0 255.255.255.0 75.75.75.1
ip route 98.98.98.0 255.255.255.0 Tunnel10
!
!
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
line con 0
 stopbits 1
line vty 0 4
 session-timeout 60
 transport input ssh
!
!
!
!
!
!
end

Router2 running-config

! Last configuration change at 04:42:29 UTC Thu Feb 14 2019 by cisco
!
version 16.6
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
platform console virtual
!
hostname ROUTER2
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$HR.A$qOb6yCfA.VmgvINYKlcjS.
!
aaa new-model
!
!
!
!
!
!
!
aaa session-id common
!
!
!
!
!
!
!
ip domain name ROUTER2
!
!
!
!
!
!
!
!
!
!
subscriber templating
!
!
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
crypto pki trustpoint TP-self-signed-4191503331
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-4191503331
 revocation-check none
 rsakeypair TP-self-signed-4191503331
!
!
crypto pki certificate chain TP-self-signed-4191503331
 certificate self-signed 01
  30820330 30820218 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 34313931 35303333 3331301E 170D3139 30323132 31323336
  35325A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D34 31393135
  30333333 31308201 22300D06 092A8648 86F70D01 01010500 0382010F 00308201
  0A028201 0100A2F9 0B96AD20 0B1B3510 3ADE2E21 BBA95904 D0C0A22A FB22F8B3
  62ED059E 74C2CC6A EADE27C6 682AF809 F88AE8C6 802FA3AE 75214100 F7552A39
  5EEC4311 7F7DE6FF 284EC071 2583B7E1 F615CF7A 20B05102 B99EA0A3 8D2D3AED
  9C1473C4 8582307F 6CC3A9A4 3AE404AC 72242D53 663ABD35 8ABE1A58 A1E21BE6
  B5FC54F4 1D04BE42 9241C733 0F2C208B 65FDD96A A079A83D DC515BC7 F12530D6
  C7E22D46 CA4ECAEA 024A3EA9 E393C3E3 BB9219DD 17FB2AFE 9D3D8C49 5BD9887E
  B71CDE20 4DD35A9E C3DA5FE5 0CB896EB 87B92F25 EBC94150 C2E5E557 C9AE42B1
  55652FA7 E0E1B027 5CDF727F ABF043AB 616ADD91 787A7755 EECCA52C F9B42B93
  E2E64E08 6E910203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF
  301F0603 551D2304 18301680 14F78300 75AF8D79 F402DD73 ED426377 AD6D9EF8
  5E301D06 03551D0E 04160414 F7830075 AF8D79F4 02DD73ED 426377AD 6D9EF85E
  300D0609 2A864886 F70D0101 05050003 82010100 647C4F7F 5E53CB0E C97E2997
  E21C1810 8A91555B 9576AB35 726D3E86 EAC8CA1E 1E7AB883 DD2B8E62 0FA8A3A8
  5E2520A5 BB56586A 884183D1 C5F6157F 42D6E125 3E924946 2DD18F38 5A997C36
  D7C87D94 ABB53092 6C44B2DD AFB52A31 700B00CE 68A524D2 4EC715FB 4D7F2F43
  1AEEEF63 B74BCE9F 205AABBF 2D846221 F169B35F BC7FA42C 6D83FC8C C3C1C50C
  303A58F1 36F18A0A 78ABE50F 816D179D 37AD821C C630CD2B 28894789 40AFA46A
  FBB28AE1 8E654471 6A5A2283 965053E6 1D15B141 7C477260 BF9A8B89 9BEA6681
  9AA23363 6A7B2144 4A19817B CAA1861B 39D71BF2 ECF9BC5E 1918D6C8 4786BED2
  51E5D9B0 804868C8 AC8C728F 7D925591 FE6E4D3B
        quit
!
!
!
!
!
!
!
!
!
license udi pid CSR1000V sn 9931AERN75Q
diagnostic bootup level minimal
spanning-tree extend system-id
!
!
!
username cisco privilege 15 secret 5 $1$EZLZ$M1bokGM81irxO4MO36iLr.
!
redundancy
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 666
 encr aes
 authentication pre-share
 group 2
!
crypto isakmp policy 888
 authentication pre-share
crypto isakmp key cisco123 address 76.76.76.1
crypto isakmp key cisco address 0.0.0.0
!
!
crypto ipsec transform-set TSET esp-aes esp-sha-hmac
 mode tunnel
crypto ipsec transform-set TSET_VTI esp-aes esp-sha-hmac
 mode tunnel
!
crypto ipsec profile VTI_PRO
 set transform-set TSET_VTI
!
!
!
crypto map MY_CRYPTOMAP 666 ipsec-isakmp
 set peer 76.76.76.1
 set transform-set TSET
 match address VPN_ACL
!
!
!
!
!
!
!
!
interface Loopback100
 ip address 98.98.98.1 255.255.255.0
!
interface Tunnel10
 ip address 103.103.103.2 255.255.255.0
 tunnel source 76.76.76.2
 tunnel mode ipsec ipv4
 tunnel destination 75.75.75.2
 tunnel protection ipsec profile VTI_PRO
!
interface GigabitEthernet1
 ip address 76.76.76.2 255.255.255.0
 negotiation auto
 no mop enabled
 no mop sysid
 crypto map MY_CRYPTOMAP
!
interface GigabitEthernet2
 ip address 77.77.77.2 255.255.255.0
 negotiation auto
 no mop enabled
 no mop sysid
!
interface GigabitEthernet3
 ip address dhcp
 negotiation auto
 no mop enabled
 no mop sysid
!
!
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http client source-interface GigabitEthernet1
ip tftp source-interface GigabitEthernet1
ip route 73.73.73.0 255.255.255.0 76.76.76.1
ip route 74.74.74.0 255.255.255.0 76.76.76.1
ip route 75.75.75.0 255.255.255.0 76.76.76.1
ip route 78.78.78.0 255.255.255.0 77.77.77.1
ip route 89.89.89.0 255.255.255.0 Tunnel10
!
!
!
ip access-list extended VPN_ACL
 permit ip 77.77.77.0 0.0.0.255 73.73.73.0 0.0.0.255
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
line con 0
 stopbits 1
line vty 0 4
 session-timeout 60
 transport input ssh
!
!
!
!
!
!
end
  • Did you actually try to send traffic across the tunnels? What ate the router models and full configurations? Where are the tunnel destination statements? – Ron Maupin Feb 18 at 2:30
  • @Ron Maupin : I did try sending the packets. From R1 ping packets directed to loop interface of R2 are reaching R2( ESP encrypted ), but R2 isn't issuing any echo replies. Also R2 can't ping R1. A packet capture on R2 interface shows that only quick mode message 1 is sent. The models are Cisco CSR 1000V Cloud Services Router running IOS-XE 16.6.5. – P_K Feb 18 at 2:41
  • We need to see the full router configurations. – Ron Maupin Feb 18 at 2:46
  • @RonMaupin I've added the running configs of both routers – P_K Feb 18 at 4:06
  • 1
    You have "tunnel mode ipsec ipv4" for router2, so it is ipsec tunnel. And you don't have any mode for tunnel on router1, so it is default - GRE. – Konstantin Goncharenko Feb 18 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.