Traffic sent to GRE Tunnel fails, but GRE Tunnel is up and OSPF adjacencies are formed

Question

NEW INFO_7-12-21

R1#sho ipv6 rout  2001:db8:B2:200::2:2
Routing entry for  2001:db8:B2:200::2:2/128
  Known via "static", distance 1, metric 0
  Route count is 1/1, share count 0
  Routing paths:
     2001:db8:B2:38B2::2:201, TenGigabitEthernet1/0/1.200
      Last updated 3d23h ago



R2#sho ipv6 route  2001:db8:B2:3800::2:2
Routing entry for  2001:db8:B2:3800::2:2/128
  Known via "static", distance 1, metric 0
  Route count is 1/1, share count 0
  Routing paths:
     2001:db8:B2:2B1::2:201, TenGigabitEthernet0/1/1.200
      Last updated 1w5d ago



R1

show ipv6 ospf interface
Tunnel200 is up, line protocol is up
  Link Local Address FE80::2E4F:52FF:FE8B:FC00, Interface ID 28
  Area 0, Process ID 200, Instance ID 0, Router ID 70.25.200.21
  Network Type POINT_TO_POINT, Cost: 200
  AES-CBC-128 encryption SHA-1 auth (Area) SPI 2000, secure socket UP (errors: 0)
  Transmit Delay is 1 sec, State POINT_TO_POINT, BFD enabled
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:03
  Graceful restart helper support enabled
  Index 1/2/2, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 3
  Last flood scan time is 0 msec, maximum is 1 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 7.5.200.21
  Suppress hello for 0 neighbor(s)


R2

sho ipv6 ospf interface
Tunnel200 is up, line protocol is up
  Link Local Address FE80::7ABC:1AFF:FE45:D00, Interface ID 30
  Area 0, Process ID 200, Instance ID 0, Router ID 7.5.200.21
  Network Type POINT_TO_POINT, Cost: 200
  AES-CBC-128 encryption SHA-1 auth (Area) SPI 2000, secure socket UP (errors: 0)
  Transmit Delay is 1 sec, State POINT_TO_POINT, BFD enabled
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:09
  Graceful restart helper support enabled
  Index 1/2/2, flood queue length 0
  Next 0x0(0)/0x0(0)/0x0(0)
  Last flood scan length is 1, maximum is 2
  Last flood scan time is 0 msec, maximum is 1 msec
  Neighbor Count is 1, Adjacent neighbor count is 1
    Adjacent with neighbor 70.25.200.21
  Suppress hello for 0 neighbor(s)

NEW INFO_7-9-21 I've updated the topology with a little more detail. Today I was able to log in to R2 while I brought the tunnel up so that I could see if anything was happening differently on it. It showed similar behavior though. OSPFv3 adj formed to Full and the Tunnel appeared to be Up, but pings and traces that would go across the tunnel failed. I tried modifying the Tu200 interfaces on both routers to have ipv6 MTU1400 and ipv6 tcp adjust-mss 1360. No dice there. I also checked the routing in the two firewalls. Each firewall has 2 static routes. FW1 has a route to get to 2001:db8:b2:200::2:2 using int20.200, next hop 2001:db8:b2:3802::4:201. The second route is to get to 2001:db8:b2:3800::2:2 using int13.200 next hop 2001:db8:b2:38b2::2:200. FW2's routes are dest-2001:db8:b2:3800::2:2 int20.200 NH 2001:db8:b2:3802::4:200 and dest-2001:db8:b2:200::2:2 int13.200 NH 2001:db8:b2:2b1::2:200. Let me know if there is anything else I can add to help. I'm trying to build a lab myself using NetSIM right now to figure this out. Thanks everyone.

ORIGINAL POST I'm having trouble with a GRE tunnel. As you can see in the basic topology I added, I have a GRE tunnel between two Cisco routers. R1 is an ASR1006-X and R2 is an ASR1002-HX. R1 is connected directly to a Palo Alto 3260 (FW1). R2 to another PA3260 (FW2). Each of the firewalls has a connection to an Aviat Microwave unit which communicate to each other. The GRE tunnel is built on this microwave connection. I do have another path to R2 not depicted in the topology, so I am able to get to it when the tunnel is not up. The problem I am seeing is that when I bring the tunnel up, I lose my connection to R2 instantly. OSPFv3 comes up and changes the path to R2 to be through the tunnel (this is what is desired). Unfortunately, we are losing our ability to manage anything behind R2. I would note that the ospf adj stays full, so I know ospf is being Tx/Rx via the tunnel. I just don't understand why all other traffic is failing. Any ideas would be greatly appreciated. I can also add any additional information that may be helpful if you think of anything.

Here are some configs:

R1

hostname R1
!

!
vrf definition DATA
 ipv6 multicast multitopology
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
 !
 address-family ipv6 multicast
 exit-address-family
!
vrf definition Mgmt-intf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family

!
interface Loopback0
 no ip address
 ipv6 address  2001:db8:B2:3800::2:200/128
 ipv6 enable
 no ipv6 pim
 ospfv3 200 ipv6 area 0
!
interface Loopback1
 vrf forwarding DATA
 no ip address
 ipv6 address  2001:db8:B1:3800::2:200/128
 ipv6 enable
 ipv6 multicast boundary scope 4
 ospfv3 100 ipv6 area 0
!
interface Loopback100
 vrf forwarding DATA
 no ip address
 ipv6 address  2001:db8:B1:3800::2:2/128
 ipv6 enable
 ipv6 multicast boundary scope 4
!
interface Loopback200
 no ip address
 ipv6 address  2001:db8:B2:3800::2:2/128
 ipv6 enable
 no ipv6 pim
!
interface Tunnel100
 bandwidth 380000
 vrf forwarding DATA
 no ip address
 ipv6 address  2001:db8:B1:3802::A:200/127
 ipv6 enable
 ipv6 multicast boundary scope 4
 qos pre-classify
 ospfv3 100 network point-to-point
 ospfv3 100 cost 200
 ospfv3 100 bfd
 ospfv3 100 ipv6 area 0
 bfd interval 350 min_rx 350 multiplier 3
 tunnel source Loopback100
 tunnel mode gre ipv6
 tunnel destination  2001:db8:B1:200::2:2
 tunnel path-mtu-discovery
 tunnel vrf DATA
 tunnel bandwidth transmit 380000
 tunnel bandwidth receive 380000
!
interface Tunnel200
 bandwidth 380000
 no ip address
 ipv6 address  2001:db8:B2:3802::A:200/127
 ipv6 enable
 no ipv6 pim
 qos pre-classify
 ospfv3 200 network point-to-point
 ospfv3 200 cost 200
 ospfv3 200 ipv6 area 0
 ospfv3 200 ipv6 bfd
 bfd interval 350 min_rx 350 multiplier 3
 tunnel source Loopback200
 tunnel mode gre ipv6
 tunnel destination  2001:db8:B2:200::2:2
 tunnel path-mtu-discovery
 tunnel bandwidth transmit 380000
 tunnel bandwidth receive 380000
!
interface FortyGigabitEthernet0/0/0
 no ip address
 no ipv6 pim
!
interface FortyGigabitEthernet0/0/0.100
 encapsulation dot1Q 100
 vrf forwarding DATA
 ipv6 address  2001:db8:C1:3800::2:201/127
 ipv6 enable
 ipv6 multicast boundary scope 4
 ospfv3 100 network point-to-point
 ospfv3 100 ipv6 area 0
 ospfv3 100 ipv6 cost 2000
 ospfv3 100 ipv6 bfd
 bfd interval 350 min_rx 350 multiplier 3
!
interface FortyGigabitEthernet0/0/0.200
 encapsulation dot1Q 200
 ipv6 address  2001:db8:C2:3800::2:201/127
 ipv6 enable
 no ipv6 pim
 ospfv3 200 network point-to-point
 ospfv3 200 ipv6 area 0
 ospfv3 200 ipv6 cost 2000
 ospfv3 200 ipv6 bfd
 bfd interval 350 min_rx 350 multiplier 3
!
interface FortyGigabitEthernet0/0/1
 no ip address
 no ipv6 pim
!
interface FortyGigabitEthernet0/0/1.100
 encapsulation dot1Q 100
 vrf forwarding DATA
 ipv6 address  2001:db8:B1:3836::2:200/127
 ipv6 enable
 ipv6 multicast boundary scope 4
 ospfv3 100 network point-to-point
 ospfv3 100 ipv6 area 0
 ospfv3 100 ipv6 bfd
 bfd interval 350 min_rx 350 multiplier 3
!
interface FortyGigabitEthernet0/0/1.200
 encapsulation dot1Q 200
 ipv6 address  2001:db8:B2:3836::2:200/127
 ipv6 enable
 no ipv6 pim
 ospfv3 200 network point-to-point
 ospfv3 200 ipv6 area 0
 ospfv3 200 ipv6 bfd
 bfd interval 350 min_rx 350 multiplier 3
!
interface TenGigabitEthernet1/0/0
 no ip address
 no ipv6 pim
!
interface TenGigabitEthernet1/0/0.100
 encapsulation dot1Q 100
 vrf forwarding DATA
 ipv6 address  2001:db8:B1:3813::2:200/64
 ipv6 enable
 ipv6 verify unicast source reachable-via rx RPF_FAIL_DATA
 ipv6 multicast boundary scope 4
 ospfv3 100 ipv6 area 0
!
interface TenGigabitEthernet1/0/0.200
 encapsulation dot1Q 200
 ipv6 address  2001:db8:B2:3813::2:200/64
 ipv6 enable
 ipv6 verify unicast source reachable-via rx RPF_FAIL_MGMT
 no ipv6 pim
 ospfv3 200 ipv6 area 0
!
interface TenGigabitEthernet1/0/1
 no ip address
 ipv6 enable
 no ipv6 pim
!
interface TenGigabitEthernet1/0/1.100
 encapsulation dot1Q 100
 vrf forwarding DATA
 ipv6 address  2001:db8:B1:38B2::2:200/127
 ipv6 enable
 ipv6 multicast boundary scope 4
!
interface TenGigabitEthernet1/0/1.200
 encapsulation dot1Q 200
 ipv6 address  2001:db8:B2:38B2::2:200/127
 ipv6 enable
 no ipv6 pim
!
interface TenGigabitEthernet1/0/2
 no ip address
 no ipv6 pim
!
interface TenGigabitEthernet1/0/2.100
 encapsulation dot1Q 100
 vrf forwarding DATA
 ipv6 address  2001:db8:B1:3811::2:200/64
 ipv6 enable
 ipv6 verify unicast source reachable-via rx RPF_FAIL_DATA
 ipv6 multicast boundary scope 4
 ospfv3 100 ipv6 area 0
!
interface TenGigabitEthernet1/0/2.200
 encapsulation dot1Q 200
 ipv6 address  2001:db8:B2:3811::2:200/64
 ipv6 enable
 ipv6 verify unicast source reachable-via rx RPF_FAIL_MGMT
 no ipv6 pim
 ospfv3 200 ipv6 area 0
!
interface TenGigabitEthernet1/0/3
 no ip address
 no ipv6 pim
!
interface TenGigabitEthernet1/0/3.100
 encapsulation dot1Q 100
 vrf forwarding DATA
 ipv6 address  2001:db8:B1:3814::2:200/64
 ipv6 enable
 ipv6 verify unicast source reachable-via rx RPF_FAIL_DATA
 ipv6 multicast boundary scope 4
 ospfv3 100 ipv6 area 0
!
interface TenGigabitEthernet1/0/3.200
 encapsulation dot1Q 200
 ipv6 address  2001:db8:B2:3814::2:200/64
 ipv6 enable
 ipv6 verify unicast source reachable-via rx RPF_FAIL_MGMT
 no ipv6 pim
 ospfv3 200 ipv6 area 0
!
interface TenGigabitEthernet1/0/4
 no ip address
 no ipv6 pim
!
interface TenGigabitEthernet1/0/4.100
 encapsulation dot1Q 100
 vrf forwarding DATA
 ipv6 address  2001:db8:B1:38B1::2:200/127
 ipv6 enable
 ipv6 multicast boundary scope 4
 ospfv3 100 network point-to-point
 ospfv3 100 ipv6 area 0
 ospfv3 100 ipv6 cost 2000
 ospfv3 100 ipv6 bfd
 bfd interval 350 min_rx 350 multiplier 3
!
interface TenGigabitEthernet1/0/4.200
 encapsulation dot1Q 200
 ipv6 address  2001:db8:B2:38B1::2:200/127
 ipv6 enable
 no ipv6 pim
 ospfv3 200 network point-to-point
 ospfv3 200 ipv6 area 0
 ospfv3 200 ipv6 cost 2000
 ospfv3 200 ipv6 bfd
 bfd interval 350 min_rx 350 multiplier 3

!
router ospfv3 200
 area 0 encryption ipsec spi 2000 esp aes-cbc 128 7 096D6F28382436332A2D250B0A0509121403322637222077787972752F22393778 sha1 7 12382436332A2D250B0A0509121403322637222077787972752F223937787976727374752A7A272679
 !
 address-family ipv4 unicast
 exit-address-family
 !
 address-family ipv6 unicast
  passive-interface TenGigabitEthernet1/0/0.200
  passive-interface TenGigabitEthernet1/0/2.200
  passive-interface TenGigabitEthernet1/0/3.200
  passive-interface Loopback0
  router-id 70.25.200.21
  bfd all-interfaces
  auto-cost reference-bandwidth 200000
 exit-address-family
!
router ospfv3 100
 area 0 encryption ipsec spi 1000 esp aes-cbc 128 7 0222207F2F222B05686A2D3D2133362F28200E0F000C1711063723322725727D7C sha1 7 013722207F2F222B05686A2D3D2133362F28200E0F000C1711063723322725727D7C77702A273C327D
 !
 address-family ipv4 unicast
 exit-address-family
 !
 address-family ipv6 unicast
 exit-address-family
 !
 address-family ipv6 unicast vrf DATA
  passive-interface TenGigabitEthernet1/0/0.100
  passive-interface TenGigabitEthernet1/0/2.100
  passive-interface TenGigabitEthernet1/0/3.100
  passive-interface Loopback1
  router-id 70.25.100.21
  bfd all-interfaces
  auto-cost reference-bandwidth 200000
  capability vrf-lite
 exit-address-family
!

R2

hostname R2
!
vrf definition DATA
 ipv6 multicast multitopology
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
 !
 address-family ipv6 multicast
 exit-address-family
!
vrf definition Mgmt-intf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family

interface Loopback0
 no ip address
 ipv6 address 2001:DB8:B2:200::2:200/128
 ipv6 enable
 no ipv6 pim
 ospfv3 200 ipv6 area 0
!
interface Loopback1
 vrf forwarding DATA
 no ip address
 ipv6 address 2001:DB8:B1:200::2:200/128
 ipv6 enable
 ospfv3 100 ipv6 area 0
!
interface Loopback100
 vrf forwarding DATA
 no ip address
 ipv6 address 2001:DB8:B1:200::2:2/128
 ipv6 enable
!
interface Loopback200
 no ip address
 ipv6 address 2001:DB8:B2:200::2:2/128
 ipv6 enable
 no ipv6 pim
!
interface Tunnel100
 bandwidth 380000
 vrf forwarding DATA
 no ip address
 ipv6 address 2001:DB8:B1:3802::A:201/127
 ipv6 enable
 ipv6 multicast boundary scope 4
 qos pre-classify
 ospfv3 100 network point-to-point
 ospfv3 100 cost 200
 ospfv3 100 bfd
 ospfv3 100 ipv6 area 0
 bfd interval 350 min_rx 350 multiplier 3
 tunnel source Loopback100
 tunnel mode gre ipv6
 tunnel destination 2001:DB8:B1:3800::2:2
 tunnel path-mtu-discovery
 tunnel vrf DATA
 tunnel bandwidth transmit 380000
 tunnel bandwidth receive 380000
!
interface Tunnel200
 bandwidth 380000
 no ip address
 ipv6 address 2001:DB8:B2:3802::A:201/127
 ipv6 enable
 no ipv6 pim
 qos pre-classify
 ospfv3 200 network point-to-point
 ospfv3 200 cost 200
 ospfv3 200 ipv6 area 0
 ospfv3 200 ipv6 bfd
 bfd interval 350 min_rx 350 multiplier 3
 tunnel source Loopback200
 tunnel mode gre ipv6
 tunnel destination 2001:DB8:B2:3800::2:2
 tunnel path-mtu-discovery
 tunnel bandwidth transmit 380000
 tunnel bandwidth receive 380000
!
interface TenGigabitEthernet0/1/0
 no ip address
 no ipv6 pim
!
interface TenGigabitEthernet0/1/0.100
 encapsulation dot1Q 100
 vrf forwarding DATA
 ipv6 address 2001:DB8:B1:211::2:200/64
 ipv6 enable
 ipv6 verify unicast source reachable-via rx RPF_FAIL_DATA
 ipv6 multicast boundary scope 4
 ospfv3 100 ipv6 area 0
!
interface TenGigabitEthernet0/1/0.200
 encapsulation dot1Q 200
 ipv6 address 2001:DB8:B2:211::2:200/64
 ipv6 enable
 ipv6 verify unicast source reachable-via rx RPF_FAIL_MGMT
 no ipv6 pim
 ospfv3 200 ipv6 area 0
!
interface TenGigabitEthernet0/1/1
 no ip address
 ipv6 enable
 no ipv6 pim
!
interface TenGigabitEthernet0/1/1.100
 encapsulation dot1Q 100
 vrf forwarding DATA
 ipv6 address 2001:DB8:B1:2B1::2:200/127
 ipv6 enable
 ipv6 multicast boundary scope 4
!
interface TenGigabitEthernet0/1/1.200
 encapsulation dot1Q 200
 ipv6 address 2001:DB8:B2:2B1::2:200/127
 ipv6 enable
 no ipv6 pim
!
interface TenGigabitEthernet0/1/2
 no ip address
 no ipv6 pim
!
interface TenGigabitEthernet0/1/2.100
 encapsulation dot1Q 100
 vrf forwarding DATA
 ipv6 address 2001:DB8:C1:200::2:201/127
 ipv6 enable
 ipv6 multicast boundary scope 4
 ospfv3 100 network point-to-point
 ospfv3 100 cost 2000
 ospfv3 100 ipv6 area 0
 ospfv3 100 ipv6 bfd
 bfd interval 350 min_rx 350 multiplier 3
!
interface TenGigabitEthernet0/1/2.200
 encapsulation dot1Q 200
 ipv6 address 2001:DB8:C2:200::2:201/127
 ipv6 enable
 no ipv6 pim
 ospfv3 200 network point-to-point
 ospfv3 200 cost 2000
 ospfv3 200 ipv6 area 0
 ospfv3 200 ipv6 bfd
 bfd interval 350 min_rx 350 multiplier 3
!
router ospfv3 200
 area 0 encryption ipsec spi 2000 esp aes-cbc 128 7 15332A2D250B0A0509121403322637222077787972752F22393778797672737475 sha1 7 106F28382436332A2D250B0A0509121403322637222077787972752F223937787976727374752A7A27
 !
 address-family ipv4 unicast
 exit-address-family
 !
 address-family ipv6 unicast
  passive-interface TenGigabitEthernet0/1/0.200
  passive-interface Loopback0
  router-id 7.5.200.21
  bfd all-interfaces
  auto-cost reference-bandwidth 200000
 exit-address-family
!
router ospfv3 100
 area 0 encryption ipsec spi 1000 esp aes-cbc 128 7 047F2F222B05686A2D3D2133362F28200E0F000C1711063723322725727D7C7770 sha1 7 072B05686A2D3D2133362F28200E0F000C1711063723322725727D7C77702A273C327D7C7377767170
 !
 address-family ipv4 unicast
 exit-address-family
 !
 address-family ipv6 unicast vrf DATA
  passive-interface TenGigabitEthernet0/1/0.100
  passive-interface Loopback1
  router-id 7.5.100.21
  bfd all-interfaces
  auto-cost reference-bandwidth 200000
  capability vrf-lite
 exit-address-family
!

Could the firewall(s) be dropping traffic? Asymmetric flows? — Ron Trunk, Jul 8 at 1:54
Can you show fib table? Are all routes installed? and is the adjacency via the tunnel resolved? — manish ma, Jul 8 at 5:50
Could you add your OSPF configuration, and the output of show ip route 2001:DB8:B2:200::2:2 and show ip route 2001:DB8:B2:3800::2:2 to your question? Maybe bringing up the OSPF adj across the GRE tunnel is affecting routes to the tunnel endpoints themselves. — Jeff Wheeler, Jul 9 at 1:50
You give us the OSPF configuration on the tunnel interfaces, but not the LAN interfaces. It is possible to form a full adjacency without advertising the local networks. You really need to include the full router configurations because we cannot simply guess. — Ron Maupin, Jul 9 at 1:56

Ben · Accepted Answer · 2021-07-14 13:45:15Z

It turns out the Palo Alto tunnel inspection policy was the root of the issue. Once I disabled the policy in each firewall, I was able to ping through the tunnel. I used traceroute to verify from multiple networks that they were taking the GRE tunnel in R1 to reach R2 and its networks. I'll have to revisit the inspection policy at some point to get it working properly, but for the time being, the GRE tunnel is functioning as it should. Thank you all for the help.

Stack Exchange Network

current community

your communities

more stack exchange communities

Traffic sent to GRE Tunnel fails, but GRE Tunnel is up and OSPF adjacencies are formed

1 Answer 1

Your Answer

Not the answer you're looking for? Browse other questions tagged cisco ipv6 ospf gre palo-alto or ask your own question.

Hot Network Questions

Traffic sent to GRE Tunnel fails, but GRE Tunnel is up and OSPF adjacencies are formed

1 Answer 1

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged cisco ipv6 ospf gre palo-alto or ask your own question.

Related

Hot Network Questions