[c-nsp] ip local policy route and tunnels

[Joe Maimon]

Thank you.

Denis V. Schapov wrote:

> Hi,
> 
> look at CSCef95982, CSCef66719, CSCds24740 and a lot of others similar .. 
> 
> CSCef95982: GRE: Cant control which exit interface tunnel packets use
> 
> Release Notes
>  
> Symptom: GRE tunnel packets are getting dropped.
> 
> Condition: When configuring GRE tunnels where there are two output 
> interfaces via two different ISPs _and_ packets going out each 
> interface must use an address from that interface's subnet as the 
> source. You can configure the GRE tunnel to have a tunnel source 
> of one of the outbound interfaces, but the GRE packets with this 
> tunnel source may go out either interface. The GRE packets going 
> out the other interface (wrong source IP address) will get dropped 
> by the ISP.
> 
> Workaround: You must configure the routing so that the 
> tunnel destination address is only
> routed via the correct interface. You cannot use Policy Based
> Routing (PBR). This workaround may hamper configuring primary/backup
> redundancy types of configurations. 
> 
> ----
> Denis V. Schapov
> JSC "DSI"
> Irkutsk, Russia
> dschapov at dsi.ru
> +7 3952 510506
> 
> 
> 
> ----- Original Message ----- 
> From: "Joe Maimon" <jmaimon at ttec.com>
> To: <cisco-nsp at puck.nether.net>
> Sent: Wednesday, May 24, 2006 9:15 AM
> Subject: [c-nsp] ip local policy route and tunnels
> 
> 
> 
>>Anyone see any issues trying to run gre and or ipsec tunnels on a router 
>>through different interfaces by using local policy routing?
>>
>>I can get the tunnels up and ipsec sa are established, but tunnel 
>>packets encapsulating payload traffic do not appear to be properly 
>>policy routed.
>>
>>In the past I have worked around this, but it is starting to get annoying.
>>
>>(yes I have a tac case open)
>>
>>Here is an example
>>
>>crypto keyring spokes
>>   pre-shared-key address 64.xx.xx.212 key <key>
>>!
>>crypto isakmp policy 1
>>  hash md5
>>  authentication pre-share
>>!
>>crypto isakmp policy 2
>>  encr 3des
>>  hash md5
>>  authentication pre-share
>>  group 2
>>!
>>crypto isakmp policy 3
>>  encr 3des
>>  authentication pre-share
>>  group 2
>>
>>!
>>crypto ipsec transform-set stdenc.set ah-md5-hmac esp-3des esp-md5-hmac
>>  mode transport
>>crypto ipsec transform-set stdenc.noah.set esp-3des esp-md5-hmac
>>  mode transport
>>!
>>crypto ipsec profile encrypted-inet-links
>>  set security-association lifetime seconds 120
>>  set transform-set stdenc.noah.set stdenc.set
>>  set pfs group2
>>!
>>!
>>interface Tunnel0
>>  ip address 10.10.36.2 255.255.255.252
>>  ip nat inside
>>  ip virtual-reassembly
>>  keepalive 10 3
>>  tunnel source Dialer1
>>  tunnel destination 64.xx.xx.212
>>!
>>interface Tunnel1
>>  ip address 10.10.37.1 255.255.255.0
>>  no ip redirects
>>  ip mtu 1400
>>  ip nat inside
>>  ip nhrp authentication ulthef
>>  ip nhrp map multicast dynamic
>>  ip nhrp map multicast 64.xx.xx.212
>>  ip nhrp map 10.10.37.2 64.xx.xx.212
>>  ip nhrp map multicast 67.yy.yy.198
>>  ip nhrp network-id 16770544
>>  ip nhrp nhs 10.10.37.2
>>  ip virtual-reassembly
>>  ip tcp adjust-mss 1360
>>  no ip split-horizon eigrp 4535
>>  delay 1000
>>  keepalive 10 3
>>  tunnel source Serial0/2/0
>>  tunnel mode gre multipoint
>>  tunnel key 16770544
>>  tunnel path-mtu-discovery
>>  tunnel protection ipsec profile encrypted-inet-links
>>!
>>interface Serial0/2/0
>>  ip address 67.yy.yy.198 255.255.255.252
>>  no ip redirects
>>  ip nat outside
>>  ip virtual-reassembly
>>  no ip mroute-cache
>>  service-module t1 timeslots 1-12
>>!
>>interface Dialer1
>>  ip address negotiated
>>  ip nat outside
>>  ip virtual-reassembly
>>  encapsulation ppp
>>  ip tcp adjust-mss 1452
>>  dialer pool 1
>>  dialer-group 1
>>  no cdp enable
>>  ppp authentication pap callin
>>  ppp chap hostname user at domain
>>  ppp chap password apassword
>>  ppp pap sent-username user at domain password apassword
>>!
>>ip local policy route-map local-policy-route
>>ip route 0.0.0.0 0.0.0.0 67.yy.yy.197
>>!
>>ip access-list extended pyyyy-exit
>>  permit ip host 67.yy.yy.198 host 64.xx.xx.212
>>!
>>ip access-list extended chl-exit
>>  !this is the static ip bound to the Dialer1 interface by the ISP
>>  permit ip host 64.xx.xx.44 any
>>!
>>route-map local-policy-route permit 20
>>  match ip address pyyyy-exit
>>  set interface Serial0/2/0
>>  set ip next-hop 67.yy.yy.197
>>!
>>route-map local-policy-route permit 30
>>  match ip address cxxxx-exit
>>  set interface Dialer1
>>  set ip next-hop 69.xx.xx.226
>>!
>>route-map local-policy-route permit 200
>>
>>
>>_______________________________________________
>>cisco-nsp mailing list  cisco-nsp at puck.nether.net
>>https://puck.nether.net/mailman/listinfo/cisco-nsp
>>archive at http://puck.nether.net/pipermail/cisco-nsp/
>>
>>
> 
> 
>