Tunnel protection, tunnel status changes to reset , urgent pls !

meezanbank · ‎07-28-2009

Dear all. I have deployed DMVPN in my one region successfully. Now its time for the second region. Currently i have p2p gre tunnels with TUNNEL PROTECTION APPLIED. Everything is working fine. Now i created a DMVPN mgre tunnel on hub like this

ip address 172.27.0.1 255.255.192.0

no ip redirects

ip flow ingress

ip nhrp authentication cisco

ip nhrp map multicast dynamic

ip nhrp network-id 200

ip ospf network point-to-multipoint

ip ospf cost 1110

ip ospf hello-interval 10

ip ospf mtu-ignore

tunnel source 192.168.13.118

tunnel mode gre multipoint

tunnel key 5

Now i created spoke tunnel on spoke1, it registered, ospf adjacency formed, everything went smooth. Now as soon as i add tunnel protection to tunnel 222 see what happens

%LINK-5-CHANGED: Interface Tunnel222, changed state to reset

%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel222, changed state to down

Why is this so ? i have been searching all google and cisco site but couldnt get a single explanation of what is meant by status "reset".

Can some pls help me out in this

slmansfield · ‎07-29-2009

Perhaps this document is of help to you.

http://www.cisco.com/en/US/docs/ios/security/configuration/guide/share_ipsec_w_tun_protect.pdf

illusion_rox · ‎07-29-2009

Dear Sir, i have observed something strange. Tunnel 222 is getting in reset mode if i make Fa2/1 its tunnel source (whether ip of fa2/1 or int itself). As soon as i change the source ip or source interface and shut no shut it gets up and remains up. I have checked Fa2/1 but that interface is working perfectly and all fiber branches are falling on this interface. I have also checked for errors but none found. I am using same router 3845 with 12.4(20)T in our other region with exact same config and its working fine there so what is probably the issue here ?

Pls help me out in this

slmansfield · ‎07-30-2009

I thought initially that you needed the "share" parameter, but I don't think that's the problem.

I'm wondering how you're applying tunnel protection.

It looks like a safer bet to use an interface as the tunnel source instead of the IP address.

Also, are you using the same tunnel keys on the hub and remote tunnel interfaces? They all have to match.

I think this URL provides an example of what you are trying to do. I hope it will be of help to you in determining the cause of the problem.

http://www.cisco.com/application/pdf/paws/29240/dcmvpn.pdf

HTH

illusion_rox · ‎07-31-2009

I figured it out !! It was this BUG

CSCsz56382

Any how its solved now, thanks alot for the feedback .