cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4736
Views
0
Helpful
47
Replies

Easy VPN GRE

jack samuel
Level 1
Level 1

Hi folks,

My routers at two  different sites are connected through GRE tunnels. I want to configure  IPSec over it, but throug easy vpn server and client setup. Is it  possible???? Apparently the most reasonable configuration for the mentioned  scenario is site-to-site vpn, but I want to configure it through easy  vpn. I would also appreciate if some one can refer to any configuration  example of such kind of setup.The GRE tunnel is up and pings are successful but the traffic which passess through is not encryted.

Thanks

47 Replies 47

"means the async interface and internal LAN???"

To create a proof of concept, you can remove stub-zone EIGRP proccess ID for now.

adversties local inside network segment and loopback0 from both side.

thanks

hi,

I tried this nothing happen when a directly connected interface (async) does'nt becomes neighbor how the routes will exchnage.

I hope you copied the these lines as well.

ip route 192.168.255.4 255.255.255.252 Dialer0 track 123

ip route 192.168.255.4 255.255.255.252 Async1 250

As per above two lines, the neighbor will com up, only when ASDL fails.

As you can see, tunnel source is being pushed to Dialer0 interface instead.

Yes rizwan,

The async came up when the tracking default route went down still but there is no neighbor relationship,

Please post the config from both HO and branch router.

along with

debug eigrp packets query reply.

thanks

Rizwan,

There are no eigrp packets seen in the debugs. Also there is a problem in tracking the default route because the router is not installing a default route once we add the track command to the ip route.

The tracking is the culprit this is the reason dialup was initiating everytime. if have a look the adsl interface receive public IP but the tracking route is no t failling back to the routing table once the ADSL comes up.

TEST(config)#do sh ip route

Gateway of last resort is not set

     101.0.0.0/24 is subnetted, 1 subnets

C       101.127.98.0 is directly connected, Vlan1

     192.168.10.0/30 is subnetted, 1 subnets

C       192.168.10.0 is directly connected, Loopback0

     92.0.0.0/32 is subnetted, 2 subnets

C       92.178.232.1 is directly connected, Dialer0

C       92.178.239.92 is directly connected, Dialer0

Please tell me do i shld advertise the async interface in eigrp

Thanks

router eigrp 10

network 101.127.98.1 0.0.0.0

network 192.168.10.1 0.0.0.0

no auto-summary

eigrp router-id 192.168.10.1

interface Tunnel0

ip address 172.17.1.2 255.255.255.0

delay 16000000

tunnel source Loopback0

tunnel destination 192.168.10.5

end

TEST#sh ip eigrp neighbors

IP-EIGRP neighbors for process 10

###############################################

HO

nterface Tunnel0

ip address 172.17.1.1 255.255.255.0

delay 16000000

tunnel source Loopback1

tunnel destination 192.168.10.1

end

router eigrp 10

network 10.1.1.26 0.0.0.0

network 192.168.10.5 0.0.0.0

no auto-summary

eigrp router-id 192.168.10.5

ip route 192.168.10.4 255.255.255.252 Dialer0 track 123

ip route 0.0.0.0 0.0.0.0 Dialer0 track 123

ip route 0.0.0.0 0.0.0.0 Async1 250

ip route 192.168.10.4 255.255.255.252 Async1 250

"Please tell me do i shld advertise the async interface in eigrp" Answer is no.

However, you should adverties tunnel interface's ip segment in the EIGRP, that makes the peering.

I do not see, from neither side, the tunnel's ip segment is being adverties, which you should.

----------------------------------------------------------------------

I assume based your input that this config from HO.

HO

nterface Tunnel0

ip address 172.17.1.1 255.255.255.0

delay 16000000

tunnel source Loopback1

tunnel destination 192.168.10.1

end

router eigrp 10

network 10.1.1.26 0.0.0.0

network 192.168.10.5 0.0.0.0

no auto-summary

eigrp router-id 192.168.10.5

ip route 192.168.10.4 255.255.255.252 Dialer0 track 123

ip route 0.0.0.0 0.0.0.0 Dialer0 track 123

ip route 0.0.0.0 0.0.0.0 Async1 250

ip route 192.168.10.4 255.255.255.252 Async1 250

You do not need IP-SLA from HO side but rather from branch side only.

You say tunnel destination is: "192.168.10.1" from HO side, but your static route for remote-branch's local loopback is different IP.

Network address for this ip: 192.168.10.1, is 192.168.10.0/30

In correct network address in the static-route, beside you do not need IP-SLA on HO side.

"ip route 192.168.10.4 255.255.255.252 Async1 250"

Please adverstie tunnel's ip address on HO router.

router eigrp 10

172.17.1.1 0.0.0.0

----------------------------------------------------------------------

This is for Branch.

router eigrp 10

network 101.127.98.1 0.0.0.0

network 192.168.10.1 0.0.0.0

no auto-summary

eigrp router-id 192.168.10.1

interface Tunnel0

ip address 172.17.1.2 255.255.255.0

delay 16000000

tunnel source Loopback0

tunnel destination 192.168.10.5

end

TEST#sh ip eigrp neighbors

IP-EIGRP neighbors for process 10

Please adverties tunnel's interface on the EIGRP processor.

router eigrp 10

172.17.1.2 0.0.0.0

Here you have to incorprate tunnel destination address into IP SLA

----------------------------------------------------------------------

Let me know.

thanks

Dear Rizwan,

Please find the attached Debug file1 and debug file 2,

Debug File 1 is when the dialer 0 is down,, manualy shutting down becz tracking is not working. Async interface are not advertised in eigrp only tunnel interface are advertised according to ur instruction.

Debug File 2 is when the dialer 0 is up and the async interface are advertised in eigrp, the async interface initiates a backup connection though the dialer is up.

Branch Configuration

int lo0

ip add 192.168.10.1 255.255.255.252

router eigrp 10

network 101.127.98.1 0.0.0.0

network 192.168.10.1 0.0.0.0

network 172.17.1.2 0.0.0.0

no auto-summary

eigrp router-id 192.168.10.1

interface Tunnel0

ip address 172.17.1.2 255.255.255.0

delay 16000000

tunnel source Loopback0

tunnel destination 192.168.10.5

end

############################################

HO Configuration

int lo1

ip add 192.168.10.5 255.255.255.252

interface Tunnel0

ip address 172.17.1.1 255.255.255.0

delay 16000000

tunnel source Loopback1

tunnel destination 192.168.10.1

end

router eigrp 10

network 10.1.1.26 0.0.0.0

network 192.168.10.5 0.0.0.0

network 172.17.1.1 0.0.0.0

no auto-summary

eigrp router-id 192.168.10.5

#####################################################

Route Tracking on Branch routers.

ip route 192.168.10.4 255.255.255.252 Dialer0 track 123

ip route 0.0.0.0 0.0.0.0 Dialer0 track 123

ip route 0.0.0.0 0.0.0.0 Async1 250

ip route 192.168.10.4 255.255.255.252 Async1 250

Hi Jack,

the config looks much better this time but it is still missing a static-route on the HO router.

So, please add a static-route one shown below.

ip route 192.168.10.0 255.255.255.252 Async1

I assume, "Async1" one is where modem connected, please correct according to your config.

let me know.

thanks.

Dear Rizwan,

On Branch

  • Debug logs are attached the tunnel comes up and goes down becz of recursive lookup i just google for this error and found a solution, I tried by decreasing the AD for static route on  async interface to 89 just below to the EIGRP AD and it works fine.

BUT AGAIN I CAME UP WITH NEW ISSUE:

  • when dialer 0 come up again the async routes vanishes from the routing table but still the dial backup remains up and eigrp neighbor remains up.

  • And also i m facing  packet drop issue there is no 100% reacheabiltiy to HO. pls see the attached file the tracking goes up and down up and down ????

#########################################

ON HO

I have pointed a static route as such :

ip route 192.168.10.0 255.255.255.252 172.16.1.2 ------>Branch is a next-hop 

I dont have below option for next hop

ip route 192.168.10.0 255.255.255.252 group-async 0 -----> i dont have a group-async0 option

interface Group-Async0

ip unnumbered Loopback0

encapsulation ppp

dialer in-band

dialer idle-timeout 300

dialer-group 5

async mode dedicated

no peer default ip address

ppp authentication chap

group-range 0/386 0/396

routing dynamic

Hi Jack,

"when dialer 0 come up again the async routes vanishes from the routing table"

When EIGRP peer is not reachable, routes will be delted from routing table, however it should be able to reache via ADSL connection.

"still the dial backup remains up and eigrp neighbor remains up."

On Dialer0 (i.e. for ADSL) interface please apply this command on branch router and  I assume Async1 interface modem is connectedd.

Interface Dialer0

backup interface tunnel0

backup delay 3 15

Now, on the Async1 interface please apply this two lines.

Interface Async1

  dialer idle-timeout 15

  dialer watch-disable 15

Let me know, how this coming along.

thanks


Hello,

Rizwan ur solution is perfect but i have some issues that i have noticed, I divide this in 2 PART

PART I :----------THERE IS NO PROBLEM WORKS FINE

when command in the running config:

ip route 0.0.0.0 0.0.0.0 Dialer0

ip route 0.0.0.0 0.0.0.0 Async1 89

ip route 192.168.10.4 255.255.255.252 Dialer0

ip route 192.168.10.4 255.255.255.252 Async1 89

If you see above there are no track commands to remove the route so i m removing manualy

no ip route 0.0.0.0 0.0.0.0 Dialer0

no ip route 192.168.10.4 255.255.255.252 Dialer0

It failover to async interface and everything work perfect without any issues,,

PINGS are 100%

Async disconnects as soon as we apply the dialer 0 route back and when the dialer interface comes up.

EVERYTHING IS OK IN ABSENCE OF TRACK COMMAND WITH STATIC ROUTE.

#####################################################################################################################

PART II:----------- EVERYTHING FAILS WITH TRACK COMMANDS

when command in the running config:

ip route 192.168.10.4 255.255.255.252 Dialer0  track 123

ip route 0.0.0.0 0.0.0.0 Dialer0  track 123

ip route 0.0.0.0 0.0.0.0 Async1 89

ip route 192.168.10.4 255.255.255.252 Async1 89

  • when i do show ip route sometimes the track routes are present in the route table and sometimes they are not available.when they are not in the route table then async initiates.
  • Async initiates EIGRP Neighbor comes up and also tunnel comes up ...down ...up....down. as u can see in the attached logs
  • when the dialer comes up again the async route disappears from the routing table but the eigrp neigbor continues to stay. please see the route table below.
  • Please see the packet drop from windows PC which is FROM internal LAN.

sh ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

     101.0.0.0/24 is subnetted, 1 subnets

C       101.127.98.0 is directly connected, Vlan1

     192.168.10.0/30 is subnetted, 2 subnets

C       192.168.10.0 is directly connected, Loopback0

S       192.168.10.4 is directly connected, Dialer0

     172.17.0.0/24 is subnetted, 1 subnets

C       172.17.1.0 is directly connected, Tunnel0

     172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks

C       172.16.1.1/32 is directly connected, Async1

C       172.16.1.0/24 is directly connected, Async1

     10.0.0.0/24 is subnetted, 1 subnets

D       10.1.1.0 [90/4121600256] via 172.17.1.1, 00:01:16, Tunnel0

     92.0.0.0/32 is subnetted, 2 subnets

C       92.61.172.239 is directly connected, Dialer0

C       92.61.160.1 is directly connected, Dialer0

S*   0.0.0.0/0 is directly connected, Dialer0

################################################################################################################

According to ur previous mail instructions:

There is no backup command on dialer interface

.TEST(config)#interface dialer 0

TEST(config-if)#backu?

% Unrecognized command

TEST(config-if)#?   

Interface configuration commands:

  access-expression       Build a bridge boolean access expression

  arp                     Set arp type (arpa, probe, snap) or timeout or log options

  ase                     Configure ASE on an interface

  autodetect              Autodetect Encapsulations on Serial interface

  bandwidth               Set bandwidth informational parameter

  bgp-policy              Apply policy propagated by bgp community string

  bridge-group            Transparent bridging interface parameters

  carrier-delay           Specify delay for interface transitions

  cdp                     CDP interface subcommands

  clock                   Configure serial interface clock

############################################################################

And Also there is no dialer watch-disable 15 command under async interface

##########################################################################

"EVERYTHING IS OK IN ABSENCE OF TRACK COMMAND WITH STATIC ROUTE."

Try with different IOS on the branch router, I am not sure whether this particular IOS on your branch router has a bug related IP-SLA and tracking.

If that does not help, you have to go back to ISDN-style DDR (Demand Dial Routing), which you can use "watch-list" basically a way of tracking.

http://www.cisco.com/en/US/tech/tk801/tk379/technologies_configuration_example09186a0080094143.shtml

---------------------------------------------------------------

dialer map ip xxx.xxx.xxx.xx HeadOffic broadcast 5555555555
dialer map ip 0.0.0.0 HeadOffic broadcast 5555555555

dialer watch-list 100 ip 0.0.0.0 0.0.0.0

access-list 101 deny EIGRP any any
access-list 101 permit any any


dialer-list 1 protocol ip list 101


Interface Async1
dialer idle-timeout 30
dialer watch-disable 15
dialer map ip xxx.xxx.xxx.xxx HeadOffic broadcast 5555555555
dialer map ip 0.0.0.0 HeadOffic broadcast 5555555555
dialer watch-group 100
dialer-group 1

-------------------------------

In this setup you have to keep the each IP-SLA tracking for each remote-branch office on HO router, you would not need a dynamic-routing protocol.

Look forward to hear from you.

thanks

Message was edited by: Rizwan Mohamed

Rizwan

In this setup you have to keep the each IP-SLA tracking for each  remote-branch office on HO router, you would not need a dynamic-routing  protocol.

What i understand by above line is below.Please correct me if i m wrong.

Int BVI

descriotion to ISP ***** link 8 MB**********

ip add 1.1.1.1. 255.255.255.255.252 ------fixed public ip

ip route 0.0.0.0 0.0.0.0 BVI0

ip route 10.10.0.0 255.255.0.0 BVI0 track 123

ip route 10.10.0.0 255.255.0.0 172.16.1.2  250 -------> to async interface of branch router.

ip sla monitor 1---for branch A

type echo protocol ipIcmpEcho 10.10.10.1---this will be for branch A

timeout 1000

frequency 3

threshold 2

track 123 rtr 1 reacheability

The above configuration what i wrote will not work becz if u remember in previous thread i told you about RRI routes which are not deleted from the routing table though the client has disconnected from the EASY VPN SERVER connection.

For example:

suppose branch ADSL fails and the branch async comes up the branch ASYNC will send traffic ,,but the return traffic from HO will hit to BVI becz the RRI  route is still present in routing table and the AD is also less,,so all traffic will drop.

Thanks

Hi Jack,

Administrative Distance can be change and you can force to delete security-association idle-time to the least value of 60 seconds from both location HO and branch, when security-assocation is deleted, there is nothing left.

crypto ipsec security-association idle-time

set reverse-route distance

set reverse-route distance 90

--------------------------------------------

When you creat IP-SLA on HO router for each branch office, please use exact network and mask what is set at branch office.

ip route 0.0.0.0 0.0.0.0 BVI0

ip route 10.10.10.0 255.255.255.0 BVI0 track 123

ip route 10.10.10.0 255.255.255.0 172.16.1.2  20

when route fails for branch "A" at HO router, only the IP-SLA for branch "A" must failover to dial interface.

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094823.shtml

Please update.

thanks

Review Cisco Networking products for a $25 gift card