cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2090
Views
0
Helpful
8
Replies

OSPF over IPSEC over GRE - OSPF doesn't come up over tunnel

azr.inamdar
Level 1
Level 1

Hello All,

I am running the IPSEC over GRE tunnel. And running OSPF routing protocol over tunnel. But the OSPF doesn't come up.

Tunnel is up and running. Able to reach the other side of the tunnel successfully. 

Ping to the destination of the tunnel is fine. 

Do I need any additional configurations to run OSPF over Tunnel ? there are about 10 hops in between these two ends.

R1#sh run int tun 35
Building configuration...

Current configuration : 264 bytes
!
interface Tunnel35
description Tunnel to XXXX
ip address 35.5.171.10 255.255.255.252
ip tcp adjust-mss 1350
tunnel source GigabitEthernet0/0
tunnel mode ipsec ipv4
tunnel destination 15.166.228.1
tunnel protection ipsec profile XXX_profile
end

R1#ping 15.166.228.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.166.228.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 104/104/108 ms
ult01gwcsdnes01#sh ip int brief
Interface IP-Address OK? Method Status Protocol
Embedded-Service-Engine0/0 unassigned YES NVRAM administratively down down
GigabitEthernet0/0 30.102.128.45 YES NVRAM up up
GigabitEthernet0/1 unassigned YES NVRAM down down
GigabitEthernet0/1.550 15.183.162.2 YES manual down down
GigabitEthernet0/1.551 10.211.211.2 YES manual down down
Serial0/0/0 unassigned YES NVRAM administratively down down
Loopback0 30.5.171.4 YES manual up up
Loopback1 15.166.163.192 YES manual up up
Tunnel35 35.5.171.10 YES manual up up
R1#

2 Accepted Solutions

Accepted Solutions

I assume that it will work but can you verify that ping to 35.5.171.9 is successful?

The parts of the config that you posted look ok. And the fact that the tunnel status is up/up is encouraging. So it is likely something in your config other than the tunnel that causes this issue. Can you post the configuration of OSPF? Also post the output of show ip ospf interface and show ip ospf neighbor?

HTH

Rick

HTH

Rick

View solution in original post

Not sure if this is a typo, but the IP address of your tunnel is 35.5.171.14 255.255.255.252. However, in OSPF, you advertise network 30.5.171.12 0.0.0.3.

It should actually be:

network 35.5.171.12 0.0.0.3 area 0.0.0.0

View solution in original post

8 Replies 8

azr.inamdar
Level 1
Level 1

R1#ping 224.0.0.5
Type escape sequence to abort.
Sending 1, 100-byte ICMP Echos to 224.0.0.5, timeout is 2 seconds:
.
ult01gwcsdnes01#

I assume that it will work but can you verify that ping to 35.5.171.9 is successful?

The parts of the config that you posted look ok. And the fact that the tunnel status is up/up is encouraging. So it is likely something in your config other than the tunnel that causes this issue. Can you post the configuration of OSPF? Also post the output of show ip ospf interface and show ip ospf neighbor?

HTH

Rick

HTH

Rick

Hi Rick,

Thanks for your comments.

On the same lines i have second router configured with Tunnel 36. Tun 36 is up.  i don't have access to R1 now. 

I am able to PING the tunnel destination IP # 15.166.228.2. However, I am unable to PING the other end IP address# 35.5.171.14 of the tunnel .

sh ip ospf inetrafce - doesn't show tunnel 36 participating in OSPF. I have 2 more sub interfaces GigabitEthernet0/1.550 and GigabitEthernet0/1.551 on which I am running OSPF. they are showing up in OSPF. but they are currently down(not connected). when they were connected the OSPF adjacency was formed and it was up with no issues. 

when i execute the sh ip ospf neigh - I don't see any OSPF adjacency on tun 36. no OSPF activity at all on Tun 36. when gig 0/1 was connected. i saw the OSPF adjacency on GigabitEthernet0/1.550 and GigabitEthernet0/1.551. but nothing on tun 36.

below are the details you requested. 

ult01gwcsdnes02#sh ip int br | in 36
Tunnel36 35.5.171.14 YES manual up up
ult01gwcsdnes02#

R2#sh run int tun 36
Building configuration...

Current configuration : 264 bytes
!
interface Tunnel36
ip address 35.5.171.14 255.255.255.252
ip tcp adjust-mss 1350
tunnel source GigabitEthernet0/0
tunnel mode ipsec ipv4
tunnel destination 15.166.228.2
tunnel protection ipsec profile BPO_profile
end

R2#ping 35.5.171.13
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 35.5.171.13, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
ult01gwcsdnes02#ping 15.166.228.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 15.166.228.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 100/101/104 ms
R2#

router ospf 6301
router-id 30.5.171.5
network 10.211.211.0 0.0.0.63 area 0.0.0.0
network 15.183.162.0 0.0.0.255 area 0.0.0.0
network 30.5.171.12 0.0.0.3 area 0.0.0.0

R2#sh ip ospf inter
GigabitEthernet0/1.550 is down, line protocol is down
Internet Address 15.183.162.3/24, Area 0.0.0.0, Attached via Network Statement
Process ID 6301, Router ID 30.5.171.5, Network Type BROADCAST, Cost: 10
Topology-MTID Cost Disabled Shutdown Topology Name
0 10 no no Base
Transmit Delay is 1 sec, State DOWN, Priority 1
No designated router on this network
No backup designated router on this network
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
oob-resync timeout 40
GigabitEthernet0/1.551 is down, line protocol is down
Internet Address 10.211.211.3/26, Area 0.0.0.0, Attached via Network Statement
Process ID 6301, Router ID 30.5.171.5, Network Type BROADCAST, Cost: 10
Topology-MTID Cost Disabled Shutdown Topology Name
0 10 no no Base
Transmit Delay is 1 sec, State DOWN, Priority 1
No designated router on this network
No backup designated router on this network
Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
oob-resync timeout 40
R2#

R2#sh ip ospf ne
R2#

Not sure if this is a typo, but the IP address of your tunnel is 35.5.171.14 255.255.255.252. However, in OSPF, you advertise network 30.5.171.12 0.0.0.3.

It should actually be:

network 35.5.171.12 0.0.0.3 area 0.0.0.0

Hi Gpauwen,

Thank you very much. :)

Yes, there was a typo. The IP addressess were wrongly configured. correctedd them. I didn't observe that. yes, that would have been the first test to check the IP addresses.

So below is the OSPF adjacency that has been formed. and learning the OSPF routes from the neighbour router. Once again thanks. 

Will check the same for tun 35 for R1. and will post the results for it as well once I have access to R1

R2#sh ip ospf ne

Neighbor ID Pri State Dead Time Address Interface
161.14.195.252 0 FULL/ - 00:00:37 30.5.171.13 Tunnel36
ult01gwcsdnes02#

And if you want to avoid mistakes like these in the future, you could change the way you enable OSPF on the interface:

interface Tunnel36
 ip ospf 6301 area 0

azr.inamdar
Level 1
Level 1

Hi Rick,

Thanks for asking the details/outputs. That really helped other member in the community to fix it. 

Though, it was a silly mistake from me. 

You are welcome. I am glad that cooperatively we were able to solve your problem. This is one of the good things about these forums that there are a number of people looking at your problem and potentially offering their advice. One of us may start the discussion and another may complete it.

HTH

Rick

HTH

Rick
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card