NEW INFO_7-12-21
R1#sho ipv6 rout 2001:db8:B2:200::2:2
Routing entry for 2001:db8:B2:200::2:2/128
Known via "static", distance 1, metric 0
Route count is 1/1, share count 0
Routing paths:
2001:db8:B2:38B2::2:201, TenGigabitEthernet1/0/1.200
Last updated 3d23h ago
R2#sho ipv6 route 2001:db8:B2:3800::2:2
Routing entry for 2001:db8:B2:3800::2:2/128
Known via "static", distance 1, metric 0
Route count is 1/1, share count 0
Routing paths:
2001:db8:B2:2B1::2:201, TenGigabitEthernet0/1/1.200
Last updated 1w5d ago
R1
show ipv6 ospf interface
Tunnel200 is up, line protocol is up
Link Local Address FE80::2E4F:52FF:FE8B:FC00, Interface ID 28
Area 0, Process ID 200, Instance ID 0, Router ID 70.25.200.21
Network Type POINT_TO_POINT, Cost: 200
AES-CBC-128 encryption SHA-1 auth (Area) SPI 2000, secure socket UP (errors: 0)
Transmit Delay is 1 sec, State POINT_TO_POINT, BFD enabled
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Hello due in 00:00:03
Graceful restart helper support enabled
Index 1/2/2, flood queue length 0
Next 0x0(0)/0x0(0)/0x0(0)
Last flood scan length is 1, maximum is 3
Last flood scan time is 0 msec, maximum is 1 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 7.5.200.21
Suppress hello for 0 neighbor(s)
R2
sho ipv6 ospf interface
Tunnel200 is up, line protocol is up
Link Local Address FE80::7ABC:1AFF:FE45:D00, Interface ID 30
Area 0, Process ID 200, Instance ID 0, Router ID 7.5.200.21
Network Type POINT_TO_POINT, Cost: 200
AES-CBC-128 encryption SHA-1 auth (Area) SPI 2000, secure socket UP (errors: 0)
Transmit Delay is 1 sec, State POINT_TO_POINT, BFD enabled
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Hello due in 00:00:09
Graceful restart helper support enabled
Index 1/2/2, flood queue length 0
Next 0x0(0)/0x0(0)/0x0(0)
Last flood scan length is 1, maximum is 2
Last flood scan time is 0 msec, maximum is 1 msec
Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 70.25.200.21
Suppress hello for 0 neighbor(s)
NEW INFO_7-9-21 I've updated the topology with a little more detail. Today I was able to log in to R2 while I brought the tunnel up so that I could see if anything was happening differently on it. It showed similar behavior though. OSPFv3 adj formed to Full and the Tunnel appeared to be Up, but pings and traces that would go across the tunnel failed. I tried modifying the Tu200 interfaces on both routers to have ipv6 MTU1400 and ipv6 tcp adjust-mss 1360. No dice there. I also checked the routing in the two firewalls. Each firewall has 2 static routes. FW1 has a route to get to 2001:db8:b2:200::2:2 using int20.200, next hop 2001:db8:b2:3802::4:201. The second route is to get to 2001:db8:b2:3800::2:2 using int13.200 next hop 2001:db8:b2:38b2::2:200. FW2's routes are dest-2001:db8:b2:3800::2:2 int20.200 NH 2001:db8:b2:3802::4:200 and dest-2001:db8:b2:200::2:2 int13.200 NH 2001:db8:b2:2b1::2:200. Let me know if there is anything else I can add to help. I'm trying to build a lab myself using NetSIM right now to figure this out. Thanks everyone.
ORIGINAL POST I'm having trouble with a GRE tunnel. As you can see in the basic topology I added, I have a GRE tunnel between two Cisco routers. R1 is an ASR1006-X and R2 is an ASR1002-HX. R1 is connected directly to a Palo Alto 3260 (FW1). R2 to another PA3260 (FW2). Each of the firewalls has a connection to an Aviat Microwave unit which communicate to each other. The GRE tunnel is built on this microwave connection. I do have another path to R2 not depicted in the topology, so I am able to get to it when the tunnel is not up. The problem I am seeing is that when I bring the tunnel up, I lose my connection to R2 instantly. OSPFv3 comes up and changes the path to R2 to be through the tunnel (this is what is desired). Unfortunately, we are losing our ability to manage anything behind R2. I would note that the ospf adj stays full, so I know ospf is being Tx/Rx via the tunnel. I just don't understand why all other traffic is failing. Any ideas would be greatly appreciated. I can also add any additional information that may be helpful if you think of anything.
Here are some configs:
R1
hostname R1
!
!
vrf definition DATA
ipv6 multicast multitopology
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
address-family ipv6 multicast
exit-address-family
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
interface Loopback0
no ip address
ipv6 address 2001:db8:B2:3800::2:200/128
ipv6 enable
no ipv6 pim
ospfv3 200 ipv6 area 0
!
interface Loopback1
vrf forwarding DATA
no ip address
ipv6 address 2001:db8:B1:3800::2:200/128
ipv6 enable
ipv6 multicast boundary scope 4
ospfv3 100 ipv6 area 0
!
interface Loopback100
vrf forwarding DATA
no ip address
ipv6 address 2001:db8:B1:3800::2:2/128
ipv6 enable
ipv6 multicast boundary scope 4
!
interface Loopback200
no ip address
ipv6 address 2001:db8:B2:3800::2:2/128
ipv6 enable
no ipv6 pim
!
interface Tunnel100
bandwidth 380000
vrf forwarding DATA
no ip address
ipv6 address 2001:db8:B1:3802::A:200/127
ipv6 enable
ipv6 multicast boundary scope 4
qos pre-classify
ospfv3 100 network point-to-point
ospfv3 100 cost 200
ospfv3 100 bfd
ospfv3 100 ipv6 area 0
bfd interval 350 min_rx 350 multiplier 3
tunnel source Loopback100
tunnel mode gre ipv6
tunnel destination 2001:db8:B1:200::2:2
tunnel path-mtu-discovery
tunnel vrf DATA
tunnel bandwidth transmit 380000
tunnel bandwidth receive 380000
!
interface Tunnel200
bandwidth 380000
no ip address
ipv6 address 2001:db8:B2:3802::A:200/127
ipv6 enable
no ipv6 pim
qos pre-classify
ospfv3 200 network point-to-point
ospfv3 200 cost 200
ospfv3 200 ipv6 area 0
ospfv3 200 ipv6 bfd
bfd interval 350 min_rx 350 multiplier 3
tunnel source Loopback200
tunnel mode gre ipv6
tunnel destination 2001:db8:B2:200::2:2
tunnel path-mtu-discovery
tunnel bandwidth transmit 380000
tunnel bandwidth receive 380000
!
interface FortyGigabitEthernet0/0/0
no ip address
no ipv6 pim
!
interface FortyGigabitEthernet0/0/0.100
encapsulation dot1Q 100
vrf forwarding DATA
ipv6 address 2001:db8:C1:3800::2:201/127
ipv6 enable
ipv6 multicast boundary scope 4
ospfv3 100 network point-to-point
ospfv3 100 ipv6 area 0
ospfv3 100 ipv6 cost 2000
ospfv3 100 ipv6 bfd
bfd interval 350 min_rx 350 multiplier 3
!
interface FortyGigabitEthernet0/0/0.200
encapsulation dot1Q 200
ipv6 address 2001:db8:C2:3800::2:201/127
ipv6 enable
no ipv6 pim
ospfv3 200 network point-to-point
ospfv3 200 ipv6 area 0
ospfv3 200 ipv6 cost 2000
ospfv3 200 ipv6 bfd
bfd interval 350 min_rx 350 multiplier 3
!
interface FortyGigabitEthernet0/0/1
no ip address
no ipv6 pim
!
interface FortyGigabitEthernet0/0/1.100
encapsulation dot1Q 100
vrf forwarding DATA
ipv6 address 2001:db8:B1:3836::2:200/127
ipv6 enable
ipv6 multicast boundary scope 4
ospfv3 100 network point-to-point
ospfv3 100 ipv6 area 0
ospfv3 100 ipv6 bfd
bfd interval 350 min_rx 350 multiplier 3
!
interface FortyGigabitEthernet0/0/1.200
encapsulation dot1Q 200
ipv6 address 2001:db8:B2:3836::2:200/127
ipv6 enable
no ipv6 pim
ospfv3 200 network point-to-point
ospfv3 200 ipv6 area 0
ospfv3 200 ipv6 bfd
bfd interval 350 min_rx 350 multiplier 3
!
interface TenGigabitEthernet1/0/0
no ip address
no ipv6 pim
!
interface TenGigabitEthernet1/0/0.100
encapsulation dot1Q 100
vrf forwarding DATA
ipv6 address 2001:db8:B1:3813::2:200/64
ipv6 enable
ipv6 verify unicast source reachable-via rx RPF_FAIL_DATA
ipv6 multicast boundary scope 4
ospfv3 100 ipv6 area 0
!
interface TenGigabitEthernet1/0/0.200
encapsulation dot1Q 200
ipv6 address 2001:db8:B2:3813::2:200/64
ipv6 enable
ipv6 verify unicast source reachable-via rx RPF_FAIL_MGMT
no ipv6 pim
ospfv3 200 ipv6 area 0
!
interface TenGigabitEthernet1/0/1
no ip address
ipv6 enable
no ipv6 pim
!
interface TenGigabitEthernet1/0/1.100
encapsulation dot1Q 100
vrf forwarding DATA
ipv6 address 2001:db8:B1:38B2::2:200/127
ipv6 enable
ipv6 multicast boundary scope 4
!
interface TenGigabitEthernet1/0/1.200
encapsulation dot1Q 200
ipv6 address 2001:db8:B2:38B2::2:200/127
ipv6 enable
no ipv6 pim
!
interface TenGigabitEthernet1/0/2
no ip address
no ipv6 pim
!
interface TenGigabitEthernet1/0/2.100
encapsulation dot1Q 100
vrf forwarding DATA
ipv6 address 2001:db8:B1:3811::2:200/64
ipv6 enable
ipv6 verify unicast source reachable-via rx RPF_FAIL_DATA
ipv6 multicast boundary scope 4
ospfv3 100 ipv6 area 0
!
interface TenGigabitEthernet1/0/2.200
encapsulation dot1Q 200
ipv6 address 2001:db8:B2:3811::2:200/64
ipv6 enable
ipv6 verify unicast source reachable-via rx RPF_FAIL_MGMT
no ipv6 pim
ospfv3 200 ipv6 area 0
!
interface TenGigabitEthernet1/0/3
no ip address
no ipv6 pim
!
interface TenGigabitEthernet1/0/3.100
encapsulation dot1Q 100
vrf forwarding DATA
ipv6 address 2001:db8:B1:3814::2:200/64
ipv6 enable
ipv6 verify unicast source reachable-via rx RPF_FAIL_DATA
ipv6 multicast boundary scope 4
ospfv3 100 ipv6 area 0
!
interface TenGigabitEthernet1/0/3.200
encapsulation dot1Q 200
ipv6 address 2001:db8:B2:3814::2:200/64
ipv6 enable
ipv6 verify unicast source reachable-via rx RPF_FAIL_MGMT
no ipv6 pim
ospfv3 200 ipv6 area 0
!
interface TenGigabitEthernet1/0/4
no ip address
no ipv6 pim
!
interface TenGigabitEthernet1/0/4.100
encapsulation dot1Q 100
vrf forwarding DATA
ipv6 address 2001:db8:B1:38B1::2:200/127
ipv6 enable
ipv6 multicast boundary scope 4
ospfv3 100 network point-to-point
ospfv3 100 ipv6 area 0
ospfv3 100 ipv6 cost 2000
ospfv3 100 ipv6 bfd
bfd interval 350 min_rx 350 multiplier 3
!
interface TenGigabitEthernet1/0/4.200
encapsulation dot1Q 200
ipv6 address 2001:db8:B2:38B1::2:200/127
ipv6 enable
no ipv6 pim
ospfv3 200 network point-to-point
ospfv3 200 ipv6 area 0
ospfv3 200 ipv6 cost 2000
ospfv3 200 ipv6 bfd
bfd interval 350 min_rx 350 multiplier 3
!
router ospfv3 200
area 0 encryption ipsec spi 2000 esp aes-cbc 128 7 096D6F28382436332A2D250B0A0509121403322637222077787972752F22393778 sha1 7 12382436332A2D250B0A0509121403322637222077787972752F223937787976727374752A7A272679
!
address-family ipv4 unicast
exit-address-family
!
address-family ipv6 unicast
passive-interface TenGigabitEthernet1/0/0.200
passive-interface TenGigabitEthernet1/0/2.200
passive-interface TenGigabitEthernet1/0/3.200
passive-interface Loopback0
router-id 70.25.200.21
bfd all-interfaces
auto-cost reference-bandwidth 200000
exit-address-family
!
router ospfv3 100
area 0 encryption ipsec spi 1000 esp aes-cbc 128 7 0222207F2F222B05686A2D3D2133362F28200E0F000C1711063723322725727D7C sha1 7 013722207F2F222B05686A2D3D2133362F28200E0F000C1711063723322725727D7C77702A273C327D
!
address-family ipv4 unicast
exit-address-family
!
address-family ipv6 unicast
exit-address-family
!
address-family ipv6 unicast vrf DATA
passive-interface TenGigabitEthernet1/0/0.100
passive-interface TenGigabitEthernet1/0/2.100
passive-interface TenGigabitEthernet1/0/3.100
passive-interface Loopback1
router-id 70.25.100.21
bfd all-interfaces
auto-cost reference-bandwidth 200000
capability vrf-lite
exit-address-family
!
R2
hostname R2
!
vrf definition DATA
ipv6 multicast multitopology
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
address-family ipv6 multicast
exit-address-family
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
interface Loopback0
no ip address
ipv6 address 2001:DB8:B2:200::2:200/128
ipv6 enable
no ipv6 pim
ospfv3 200 ipv6 area 0
!
interface Loopback1
vrf forwarding DATA
no ip address
ipv6 address 2001:DB8:B1:200::2:200/128
ipv6 enable
ospfv3 100 ipv6 area 0
!
interface Loopback100
vrf forwarding DATA
no ip address
ipv6 address 2001:DB8:B1:200::2:2/128
ipv6 enable
!
interface Loopback200
no ip address
ipv6 address 2001:DB8:B2:200::2:2/128
ipv6 enable
no ipv6 pim
!
interface Tunnel100
bandwidth 380000
vrf forwarding DATA
no ip address
ipv6 address 2001:DB8:B1:3802::A:201/127
ipv6 enable
ipv6 multicast boundary scope 4
qos pre-classify
ospfv3 100 network point-to-point
ospfv3 100 cost 200
ospfv3 100 bfd
ospfv3 100 ipv6 area 0
bfd interval 350 min_rx 350 multiplier 3
tunnel source Loopback100
tunnel mode gre ipv6
tunnel destination 2001:DB8:B1:3800::2:2
tunnel path-mtu-discovery
tunnel vrf DATA
tunnel bandwidth transmit 380000
tunnel bandwidth receive 380000
!
interface Tunnel200
bandwidth 380000
no ip address
ipv6 address 2001:DB8:B2:3802::A:201/127
ipv6 enable
no ipv6 pim
qos pre-classify
ospfv3 200 network point-to-point
ospfv3 200 cost 200
ospfv3 200 ipv6 area 0
ospfv3 200 ipv6 bfd
bfd interval 350 min_rx 350 multiplier 3
tunnel source Loopback200
tunnel mode gre ipv6
tunnel destination 2001:DB8:B2:3800::2:2
tunnel path-mtu-discovery
tunnel bandwidth transmit 380000
tunnel bandwidth receive 380000
!
interface TenGigabitEthernet0/1/0
no ip address
no ipv6 pim
!
interface TenGigabitEthernet0/1/0.100
encapsulation dot1Q 100
vrf forwarding DATA
ipv6 address 2001:DB8:B1:211::2:200/64
ipv6 enable
ipv6 verify unicast source reachable-via rx RPF_FAIL_DATA
ipv6 multicast boundary scope 4
ospfv3 100 ipv6 area 0
!
interface TenGigabitEthernet0/1/0.200
encapsulation dot1Q 200
ipv6 address 2001:DB8:B2:211::2:200/64
ipv6 enable
ipv6 verify unicast source reachable-via rx RPF_FAIL_MGMT
no ipv6 pim
ospfv3 200 ipv6 area 0
!
interface TenGigabitEthernet0/1/1
no ip address
ipv6 enable
no ipv6 pim
!
interface TenGigabitEthernet0/1/1.100
encapsulation dot1Q 100
vrf forwarding DATA
ipv6 address 2001:DB8:B1:2B1::2:200/127
ipv6 enable
ipv6 multicast boundary scope 4
!
interface TenGigabitEthernet0/1/1.200
encapsulation dot1Q 200
ipv6 address 2001:DB8:B2:2B1::2:200/127
ipv6 enable
no ipv6 pim
!
interface TenGigabitEthernet0/1/2
no ip address
no ipv6 pim
!
interface TenGigabitEthernet0/1/2.100
encapsulation dot1Q 100
vrf forwarding DATA
ipv6 address 2001:DB8:C1:200::2:201/127
ipv6 enable
ipv6 multicast boundary scope 4
ospfv3 100 network point-to-point
ospfv3 100 cost 2000
ospfv3 100 ipv6 area 0
ospfv3 100 ipv6 bfd
bfd interval 350 min_rx 350 multiplier 3
!
interface TenGigabitEthernet0/1/2.200
encapsulation dot1Q 200
ipv6 address 2001:DB8:C2:200::2:201/127
ipv6 enable
no ipv6 pim
ospfv3 200 network point-to-point
ospfv3 200 cost 2000
ospfv3 200 ipv6 area 0
ospfv3 200 ipv6 bfd
bfd interval 350 min_rx 350 multiplier 3
!
router ospfv3 200
area 0 encryption ipsec spi 2000 esp aes-cbc 128 7 15332A2D250B0A0509121403322637222077787972752F22393778797672737475 sha1 7 106F28382436332A2D250B0A0509121403322637222077787972752F223937787976727374752A7A27
!
address-family ipv4 unicast
exit-address-family
!
address-family ipv6 unicast
passive-interface TenGigabitEthernet0/1/0.200
passive-interface Loopback0
router-id 7.5.200.21
bfd all-interfaces
auto-cost reference-bandwidth 200000
exit-address-family
!
router ospfv3 100
area 0 encryption ipsec spi 1000 esp aes-cbc 128 7 047F2F222B05686A2D3D2133362F28200E0F000C1711063723322725727D7C7770 sha1 7 072B05686A2D3D2133362F28200E0F000C1711063723322725727D7C77702A273C327D7C7377767170
!
address-family ipv4 unicast
exit-address-family
!
address-family ipv6 unicast vrf DATA
passive-interface TenGigabitEthernet0/1/0.100
passive-interface Loopback1
router-id 7.5.100.21
bfd all-interfaces
auto-cost reference-bandwidth 200000
capability vrf-lite
exit-address-family
!
show ip route 2001:DB8:B2:200::2:2
andshow ip route 2001:DB8:B2:3800::2:2
to your question? Maybe bringing up the OSPF adj across the GRE tunnel is affecting routes to the tunnel endpoints themselves.