CCIE Routing & Switching Advanced Technologies Class - GRE Tunneling, GRE Recursive Routing Errors

Transcript

1	Introduction	0h 43m
2	Using the Cisco Documentation	0h 52m
3	Ethernet Overview, Layer 2 Switchports, Trunking, ISL, 802.1q, DTP	0h 47m
4	VTP, VTP Authentication, VTP Pruning	1h 02m
5	VTP Prune Eligible List, VTP Transparent, VTP Troubleshooting, Trunk Allowed List, Extended VLANs	0h 48m
6	VLAN and VTP Review	0h 19m
7	SVIs, Native Routed Interfaces, Router-on-a-Stick	0h 46m
8	Layer 2 EtherChannel, EtherChannel Load Balancing, Layer 3 EtherChannel	0h 57m
9	802.1q Tunneling, Layer 2 Protocol Tunneling, EtherChannel over 802.1q Tunneling	1h 03m
10	STP Root Bridge Election, STP Root Port Election, STP Designated Port Election, STP Priority, STP Cost, STP Port-Priority	1h 46m
11	STP Review	0h 12m
12	STP Timers, STP PortFast	0h 34m
13	STP UplinkFast	0h 11m
14	STP BackboneFast	0h 12m
15	STP BPDU Filter	0h 13m
16	STP BPDU Guard	0h 11m
17	STP Root Guard	0h 11m
18	STP Loop Guard, Unidirectional Link Detection (UDLD)	0h 11m
19	Multiple Spanning-Tree Protocol (MST)	0h 40m
20	Rapid Spanning-Tree Protocol (RSTP), Rapid-PVST	0h 18m
21	MST with Multiple Regions	0h 33m
22	Flex Links	0h 16m
23	Frame Relay	0h 39m
24	Frame Relay Configuration Part 1	0h 34m
25	Frame Relay Configuration Part 2	0h 41m
26	Frame Relay Switching	0h 27m
27	Back-to-Back Frame Relay	0h 08m
28	Frame-Relay End-to-End Keepalives	0h 18m
29	PPP, PPP PAP Authentication, PPP CHAP Authentication	0h 59m
30	PPPoFR, PPPoE	0h 40m
31	Transparent Bridging, IRB	0h 32m
32	Fallback Bridging	0h 14m
33	IP Routing Overview, Switching Paths, Static Routing	0h 42m
34	Static Routing Examples	0h 25m
35	IP Default-Gateway, IP Default-Network	0h 14m
36	On-Demand Routing (ODR)	0h 07m
37	Floating Static Routes	0h 10m
38	Backup Interface	0h 29m
39	Enhanced Object Tracking, IP SLA, Reliable Static Routing	0h 21m
40	Policy Routing	0h 43m
41	GRE Tunneling, GRE Recursive Routing Errors	0h 27m
42	Reliable Backup Interface with GRE	0h 25m
43	RIP Overview, RIP Versions, RIP Auto-Summary	0h 48m
44	RIP Split-Horizon, RIP Timers	0h 22m
45	RIP Broadcast Updates, IP Directed Broadcast, IP Broadcast-Address, Smurf Attacks, Fraggle Attacks	0h 16m
46	RIP Unicast Updates	0h 03m
47	RIP Offset-List	0h 18m
48	RIP Authentication	0h 11m
49	RIP Summarization	0h 10m
50	Prefix-Lists, RIP Distribute-List Filtering, RIP Administrative Distance Filtering	0h 48m
51	RIP Default Routing, RIP Conditional Default Routing	0h 18m
52	RIP Triggered, RIP Validate Update Source,	0h 12m
53	EIGRP Overview	0h 29m
54	EIGRP Auto-Summary	0h 07m
55	EIGRP Split-Horizon	0h 11m
56	EIGRP Update Types, EIGRP Neighbor, EIGRP Passive-Interface	0h 24m
57	EIGRP Hello-Interval, EIGRP Hold-Time	0h 05m
58	EIGRP Authentication	0h 11m
59	EIGRP Time Based Authentication	0h 25m
60	EIGRP Path Selection, EIGRP Metric Weights, EIGRP Traffic Engineering	0h 47m
61	EIGRP Unequal Cost Load Balancing, EIGRP Variance	0h 19m
62	EIGRP QUERY, EIGRP Summarization, EIGRP Leak-Map	0h 28m
63	EIGRP Stub Router Advertisement	0h 22m
64	EIGRP Default Routing	0h 13m
65	EIGRP Route Filtering	0h 11m
66	EIGRP Router-ID	0h 07m
67	Miscellaneous EIGRP Features	0h 02m
68	OSPF Overview	0h 27m
69	Establishing OSPF Adjacencies, Understanding the OSPF Database	0h 43m
70	OSPF Network Type Broadcast, OSPF DR/BDR Election, OSPF over NBMA, OSPF Network Type Non-Broadcast and Point-to-Multipoint	0h 56m
71	OSPF Network Type Point-to-Point, OSPF Network Type Mismatch	0h 13m
72	OSPF Network Type Point-to-Multipoint Non-Broadcast, OSPF Per Neighbor Cost	0h 17m
73	OSPF Network Type Loopback	0h 02m
74	OSPF Path Selection	0h 27m
75	OSPF Convergence Timers	0h 09m
76	OSPF Authentication	0h 12m
77	OSPF Summarization	0h 32m
78	OSPF Stub Areas, OSPF Totally Stubby Areas, OSPF NSSAs, OSPF Totally NSSAs	0h 40m
79	Controlling OSPF NSSA Redistribution	0h 02m
80	OSPF Type 7 to 5 Translator Election, OSPF LSA Type 3 Filter, OSPF Forwarding Address Suppression	0h 24m
81	Route Redistribution Overview	0h 36m
82	Route Redistribution Configuration & Verification, Connected Redistribution	0h 22m
83	OSPF External Path Selection, TCL PING Scripting	0h 33m
84	Routing Loops Overview, EIGRP Route Loop Prevention	0h 55m
85	Metric Based Routing Loops, Route Tagging	0h 46m
86	Administrative Distance Based Routing Loops, Debug IP Routing, IP Route Profile	0h 58m
87	BGP Overview, BGP Peering Types	0h 51m
88	Establishing BGP Peerings, EBGP Multihop, BGP Neighbor Disable Connected Check, BGP TTL Security	0h 49m
89	BGP 4-Byte ASNs	0h 20m
90	BGP Local AS, BGP Peer Groups	0h 30m
91	BGP Next-Hop Self, BGP Next-Hop Processing	0h 30m
92	BGP Route Reflectors	0h 37m
93	Large Scale BGP Route Reflectors with Clusters	0h 34m
94	BGP Confederation	0h 37m
95	BGP NLRI Advertisements, BGP Network Statement, BGP Redistribution	0h 43m
96	BGP Aggregation, BGP Aggregation & Summary-Only, BGP Aggregation & Unsuppress-Map	0h 46m
97	BGP Origin, BGP Aggregation & AS-Set, BGP Aggregation & Advertise-Map	0h 22m
98	BGP Conditional Route Injection	0h 21m
99	BGP Bestpath Selection, BGP Multipath, BGP Weight	0h 53m
100	BGP Local Preference, BGP Local Preference and Communities, BGP AS-Path Prepending,	0h 30m
101	BGP MED, BGP MED Missing As Worst, BGP Deterministic MED	0h 34m
102	BGP Communites, BGP Regular Expressions	0h 43m
103	BGP Filtering, BGP Convergence Timers, BGP Default Routing, Miscellaneous BGP Features	0h 24m
104	MPLS Overview, MPLS Label Distribution Protocol (LDP)	1h 05m
105	MPLS Tunnels, MPLS Penultimate Hop Popping (PHP)	0h 40m
106	MPLS Layer 3 VPNs Overview, VRF Lite	0h 36m
107	MPLS Layer 3 VPNs and VPNv4 BGP	1h 08m
108	MPLS Layer 3 VPN Verification & Troubleshooting	0h 49m
109	MPLS Layer 3 VPN OSPF PE-CE Routing Overview	0h 06m
110	MPLS Layer 3 VPN OSPF PE-CE Routing Path Selection & Sham-Links	2h 01m
111	MPLS Layer 3 VPN OSPF PE-CE Routing Loop Prevention & Down-Bit, OSPF Capability VRF-Lite	0h 40m
112	IPv6 Overview, IPv6 ICMPv6 ND, IPv6 over NBMA	0h 44m
113	IPv6 Routing Overview, IPv6 Static Routing	0h 28m
114	IPv6 RIPng	0h 20m
115	IPv6 EIGRPv6	0h 09m
116	IPv6 OSPFv3	0h 31m
117	MP-BGP for IPv6	0h 26m
118	IPv6 Tunneling	1h 13m
119	Multicast Overview, IGMP	0h 34m
120	PIM Overview	0h 18m
121	PIM Dense Mode	1h 03m
122	PIM Sparse Mode	0h 30m
123	PIM Sparse Mode Configuration	0h 36m
124	PIM Sparse Mode RPF & RP Troubleshooting	0h 27m
125	Auto-RP, Multicast over GRE Tunnels	0h 53m
126	Bootstrap Router (BSR), Bidirectional PIM, Source Specific Multicast (SSM)	0h 40m
127	MSDP, Anycast RP	0h 27m
128	IPv6 Multicast Routing	0h 24m
129	QoS Overview, IntServ QoS, DiffServ QoS, IP Precedence, DSCP, MQC, HQF	0h 41m
130	MQC Classification	0h 44m
131	FIFO, FQ, WFQ, CBWFQ, HQF	0h 50m
132	LLQ	0h 23m
133	WRED	0h 31m
134	Traffic Shaping, Traffic Policing	0h 40m
135	Frame Relay Traffic Shaping (FRTS)	0h 33m
136	RSVP	0h 07m
137	Catalyst 3560 QoS	1h 00m
138	IOS Security Overview, Access Lists (ACLs)	0h 58m
139	Time Based ACLs, Dynamic ACLs	0h 33m
140	Reflexive ACLs	0h 21m
141	TCP Intercept, Content Based Access Control (CBAC)	0h 34m
142	Zone Based Policy Firewall (ZBPF)	1h 09m
143	AAA, Local Authentication, Local Authorization, Role Based CLI Access	0h 43m
144	Port Security, Static CAM Entries, Storm Control, 802.1X Authentication, PACLs, RACLs, VLAN Access Maps (VACLs)	0h 48m
145	DHCP Snooping, Dynamic ARP Inspection (DAI), IP Source Guard	0h 12m
146	Protected Ports, Private VLANs	0h 25m
147	IP Services Overview, HSRP	1h 10m
148	VRRP, GLBP	0h 28m
149	NAT	0h 42m
150	DHCP, DNS	0h 30m
151	NetFlow	0h 09m
152	WCCP, Miscellaneous IP Services	0h 06m
153	System Management Overview, NTP, NTP Authentication	0h 24m
154	SNMP, RMON	0h 38m
155	Syslog, Telnet, SSH, Banners	0h 21m
156	EEM Scripting, Miscellaneous System Management	0h 26m
Total Duration		81h 59m

Slides - Diagrams

Slides - Introduction

Slides - Ethernet Switching

Slides - Advanced Ethernet Switching

Slides - Frame Relay

Slides - PPP

Slides - Transport Bridging

Slides - Redistribution

Slides - IOS Security

Slides - Layer 2 Security

Slides - IP Services

Slides - System Management

0:00:13	In our next section here, we're gonna look at "Generic Routing Encapsulation Tunneling", or GRE tunneling.
0:00:19	And how we can use it to solve some interesting problems in the Layer 3 routing domain.
0:00:26	Now, GRE is an IP protocol.
0:00:29	It has its own transport number. It's IP protocol number 47.
0:00:33	Which means that even though if we're using it for different types of protocol encapsulations,
0:00:38	whether it's be IPv4 over GRE, or IPv6 over GRE.
0:00:43	CLNS over GRE for routing IS-IS over GRE tunnel.
0:00:48	Technically, the transport itself is an IP packet.
0:00:52	Now, there are other variations of type of tunnels.
0:00:55	Some that use IPv4 as transport, some that do not use IPv4 for transport.
0:01:02	But in the case of GRE,
0:01:04	it assumes that we have an IPv4 network between the endpoint that are actually doing the tunneling.
0:01:09	Now, the reason that this is more common to use, the GRE tunnel
0:01:15	is more common to use versus the other encapsulations
0:01:17	is that it is a multi-protocol encap.
0:01:21	So, we can have basically any type of payload.
0:01:23	It could be routed IPv4, it could be routed Ipv6. It could even be bridge traffic.
0:01:30	It could even be frame relay. There's a way to do frame relay switching over GRE tunnels.
0:01:36	But when we compare this to something like an IP in IP tunnel,
0:01:40	or an IPv6 IP tunnel,
0:01:43	those are both IPv4 as the transport,
0:01:46	and either IPv4 or IPv6 exclusively as the payload.
0:01:53	So, for an IPv6 IP tunnel, we would see that we could not run CLNS over it for IS-IS routing.
0:02:00	Or the same with an IP in IP tunnel, because they only support the IPv4 as the payload.
0:02:11	Now, the configuration of the tunneling...
0:02:14	is pretty straightforward. The main thing that we need to...
0:02:20	define is, where is the traffic coming from, and where is the traffic going to?
0:02:24	So, what is the source address of the tunnel? What is the destination address of the tunnel?
0:02:30	Once we actually create the control plane of GRE,
0:02:35	which is defining the tunnel interface where it's coming from and where it's going to on both sides,
0:02:40	then, we could apply the payload that we're tunneling inside of the packets.
0:02:45	So, whether this be the IPv4 address, the IPv6 address.
0:02:50	If we're doing bridging or frame relay switching over the GRE, that's gonna be the payload.
0:02:55	GRE also supports an optional keepalive.
0:03:00	That if we wanna check whether we actually have end-to-end transport over the link,
0:03:05	then, we could do a Layer 3 keepalive over the interface.
0:03:08	So, by default, the keepalive is off.
0:03:13	Now, the one problem...
0:03:15	that we do need to take into account before the defining the tunnel interface
0:03:19	is that we can perform the route recursion
0:03:22	to an interface that is not the tunnel itself
0:03:27	when we are trying to route the tunnel destination.
0:03:31	So, the tunnel destination from router A is the IP address on router B that is accepting the tunnel in.
0:03:41	In certain cases, we can end up in designs where a recursive error happens,
0:03:48	and a recursive failure occurs on the tunnel
0:03:51	if the tunnel destination recurses to the tunnel itself.
0:03:56	So, if we have a configuration that says, "The tunnel destination is 1.2.3.4,
0:04:00	then, we look in the routing table and it says, "To get to 1.2.3.4, use the tunnel."
0:04:06	But then, likewise, to get to the tunnel we need to use that same destination 1.2.3.4,
0:04:10	this would be an example of a recursive loop
0:04:14	where one route points at the other one,
0:04:18	and the other one points right back at the first one.
0:04:21	Now, the router will eventually detect this
0:04:24	when it reaches a threshold of how many recursive steps you can go through...
0:04:30	for the loookup.
0:04:32	And this is where we see the log message. It says, "The tunnel is temporarily disabled due to recursive routing."
0:04:38	Now, when this happens, it means that either based on a static routing configuration,
0:04:43	or some dynamic information,
0:04:46	we have accidentally learned the tunnel destination out the tunnel itself.
0:04:52	We'll see the common reason for this is either based on the routing metric,
0:04:57	or the routing administrative distance
0:04:59	when we are doing dynamic routing
0:05:01	on the tunnel interface, plus on the physical interfaces outside of the tunnel
0:05:06	that is supposed to be for the GRE transport.
0:05:13	So, let's take a look at this...
0:05:16	an example of this on the command line.
0:05:18	And you'll see that not all platforms actually support doing tunnel interfaces.
0:05:24	So, we'll have to see whether some of the switches actually support it or not.
0:05:29	But what I wanna do here...
0:05:31	is create a tunnel. We'll say it's gonna go between router 5 and...
0:05:40	switch 1.
0:05:43	So this is gonna be our GRE tunnel.
0:05:45	And I believe that switch 1 with this version does support the tunnel interfaces.
0:05:51	So, you may want to... You can either try it out on the command line or check the release notes
0:05:56	whether GRE is a supported feature on that particular switch.
0:06:00	For the routers, it's not gonna be an issue.
0:06:03	Pretty much, any platform supports it.
0:06:05	But just like the policy routing on the lower level platforms,
0:06:09	it does not support hardware acceleration.
0:06:13	So, if you're doing GRE on the 6500 or the 7600 or above,
0:06:18	depending on the policy feature card, and the other different hardware options you have,
0:06:24	GRE can be hardware accelerated.
0:06:27	So, it can use CEF switching, it can use hardware switching.
0:06:35	So, on switch 1,
0:06:38	again, we have the EIRGP being used as a transit between the neighbors.
0:06:44	So, if we look at the Show IP Route EIGRP,
0:06:47	we should have routing information about every address that is currently in our topology.
0:06:53	So, to establish the tunnel with router 5,
0:06:56	it would then assume that we have IP reachability to at least some address on router 5.
0:07:02	So, let's say that this is gonna be between our loopbacks.
0:07:05	So, I wanna know before I configure the tunnel.
0:07:08	Can I reach router 5's loopback...
0:07:10	when I am sourcing traffic from my own loopback?
0:07:14	Which I can.
0:07:16	These addresses then are gonna be used for the source and the destination addresses of the tunnel respectively.
0:07:23	So, router 5 is gonna source traffic from here, destined to here.
0:07:28	For switch 1 will be the other way around. Traffic is coming from 150.10.7.7
0:07:33	going to 150.10.5.5.
0:07:38	So, our next step is to create the tunnel interface. We'll say Interface Tunnel...
0:07:42	Give it a number. Interface Tunnel 0.
0:07:46	If we now look at the Do Show Interface Tunnel 0,
0:07:52	it says that the tunnel protocol and transport is GRE and IP.
0:08:01	This means that we're using the default mode of Generic Routing Encapsulation,
0:08:05	and this is the IPv4 version of GRE.
0:08:11	Depending what particular version we're using,
0:08:15	let's say on router 4 who has a more recent version, this is 12.4(24)T Advanced Enterprise Services.
0:08:23	If we were to go to a tunnel interface and say Tunnel Mode,
0:08:28	we could see these are al different types of tunnels.
0:08:32	The default mode is Tunnel Mode GRE.
0:08:35	We could also say that this is an IPv6 GRE tunnel,
0:08:42	which in that case, IPv6 would be the transport,
0:08:46	and some other protocol would be the payload.
0:08:50	So, down the road, 10, 20 years from now when IPv4 is the minority of implementations,
0:08:57	and IPv6 is used exclusively in the transit path,
0:09:01	we'll have the opposite model we do now,
0:09:04	or eventually, we'll have to tunnel IPv4 over IPv6.
0:09:11	So, we can see, the default tunnel mode is GRE IP. This means this is a point-to-point...
0:09:17	IP-based GRE tunnel.
0:09:23	So next on switch 1, we define what is the tunnel source.
0:09:28	I could either say, "My loopback, loopback 0, or I could give it the address 150.10.7.7."
0:09:34	Okay, it doesn't really matter, both are gonna do the same thing.
0:09:38	Then, I specify what is the tunnel destination? 150.10.5.5.
0:09:44	Okay, that's router 5's address.
0:09:47	Then, well need some sort of...
0:09:49	subnet on the tunnel. Assuming we're trying to route IPv4 packets over this.
0:09:54	So, we'll say IP Address.
0:09:57	Let's say the 10 network. 10.0.0.7
0:10:03
0:10:10	Then, on router 5, we're gonna need to do the opposite. So, let's say, Show Run Interface Tunnel 0
0:10:14	on switch 1.
0:10:16	We're gonna take this,
0:10:18	and just change what the source and destination is. Swap those two values.
0:10:22	And then, give router 5 a unique address.
0:10:26	So, we'll say, "The...
0:10:29	tunnel...
0:10:32	source is my loopback,
0:10:36	where the tunnel destination...
0:10:40	is switch 1's. And the IP address will be 10.0.0.5/24.
0:10:49	Now, notice that the line protocol of the tunnel comes up,
0:10:52	but by default, this is not a good indication of end-to-end connectivity.
0:10:59	The tunnel's line protocol is simply based on whether we have proper route recursion
0:11:05	to the tunnel destination.
0:11:07	So, as long as I look in the routing table and find the outgoing interface towards the destination,
0:11:15	then, the tunnel is gonna be up.
0:11:17	Doesn't mean that on the other side, the tunnel is actually configured yet.
0:11:21	So, only once we enable bi-directional keepalives
0:11:25	does the tunnel actually track the end-to-end reachability between the neighbors.
0:11:31	Now, at this point, the tunnel should be actually up, because I configure it on both sides.
0:11:35	If I ping 10.0.0.7,
0:11:38	we see that we have connectivity. If we were to trace to this destination 10.0.0.7.
0:11:45	It should look as if it's just one hop away,
0:11:49	because now, these packets are being tunneled over...
0:11:53	the rest of the transit network.
0:11:56	If we look at how we get to the loopback
0:12:01	of switch 1,
0:12:04	it says we'll either go to router 1 or router 2. Those multiple equal cost paths.
0:12:10	This means that the GRE packets...
0:12:13	are going to go...
0:12:17	from 5...
0:12:20	to router 2, from 2 to 3, from 3 to switch 1.
0:12:25	Or from 5 to 1,
0:12:28	from 1 to 3, from 3 to switch 1.
0:12:32	So, this means that if we were to go to router 3,
0:12:37	and at the link level,
0:12:40	so, we'll say, "On our interface...
0:12:46	Fast Ethernet 0/0, No IP Route Cache."
0:12:51	So again, this is disabling CEF.
0:12:53	Then, we said, Do Debug IP Packet Detail.
0:13:01	When I send traffic between 5 and 7 over the tunnel,
0:13:10	we should see that router 3 receives this,
0:13:18	and I need to... Actually, I need to do...
0:13:22	process switching on the other interfaces as well. So, let's say serial 1/3.
0:13:27	No IP Route Cache. And serial 1/2. No IP Route Cache.
0:13:34	Then, we will...
0:13:35	Debug IP Packet Detail.
0:13:40	And then do these pings again.
0:13:42	So, when you're disabling CEF for the purpose of the debugging,
0:13:46	it's gonna be on the incoming interface for the packet you are disabling.
0:13:52	So, in this case, the incoming interface is serial 1/3, that's where I would need to turn CEF off.
0:13:58	But the key point of this, when we look at the result of this debug,
0:14:02	it says "The packet came from the loopback of 5,
0:14:07	and it was going to the loopback of switch 1."
0:14:11	The protocol number is 47.
0:14:15	That's GRE.
0:14:18	So, it means that someone is tunneling over us.
0:14:21	We don't actually know what the final destination is,
0:14:24	because we're not ooking at the GRE header.
0:14:27	We're looking at just the IP header
0:14:29	that is between 5's loopback and switch 1's loopback.
0:14:38	So, pretty straightforward configuration, we just need to define
0:14:43	what the source of the tunnel is, what the destination of the tunnel is,
0:14:46	and whatever payload that we wanna put on top of it.
0:14:50	Now, were we run into issues is that from the control plane point of view,
0:14:56	which is EIGRP in this case,
0:14:59	we are running EIGRP on all of these physical links.
0:15:05	On the point-to-point link to router 4.
0:15:08	On the frame relay.
0:15:10	Then on switch 1, we have all of these Ethernet, it's enabled everywhere.
0:15:16	This means that switch 1's loop back is advertised to router 5 through EIGRP.
0:15:23	Router 5 should be installing this in the routing table as an internal EIGRP route
0:15:28	which has a distance of 90.
0:15:31	And the metric that is based on the inverse minimum bandwidth of the path plus the delay.
0:15:41	It's based on the normal composite metric rules of EIGRP.
0:15:45	Now, if we configure the tunnel, between these two neighbors to also run EIGRP
0:15:54	we run the risk of advertising the tunnel destination out the tunnel itself.
0:16:02	So, if we now go to router 5 and switch 1,
0:16:07	and we look at the Show IP EIGRP interfaces,
0:16:15	we can see that EIGRP is enabled on the tunnel.
0:16:20	The reason why is that when I did out the EIGRP configuration before
0:16:25	I said, "Just run it on every single interface."
0:16:30	If we look at the Show IP EIGRP neighbors,
0:16:35	we now have an adjacency over the tunnel.
0:16:39	If we look at the routing table, and look for anything that is out the tunnel,
0:16:47	right now, there's nothing being learned.
0:16:50	Okay, the only thing that shows out the tunnel is just the tunnel as a connected interface.
0:16:56	The reason why is if we look at the Show Interface Tunnel 0,
0:17:03	the bandwidth value is very, very low and the delay is very, very high.
0:17:11	This is a default protection mechanism that the router does to try to not use the tunnel
0:17:20	for dynamically learned destinations.
0:17:23	So it means that if you have the option to route out a physical link versus thte tunnel,
0:17:28	you would normally prefer the physical link as a opposed to the tunnel.
0:17:33	This would be true for OSPF or EIGRP because OSPF is gonna use the bandwidth for the cost.
0:17:40	EIGRP is gonna use the bandwidth plus the delay.
0:17:43	From RIP's perspective, it's just gonna see it as one hop,
0:17:47	so we could run into issues with that.
0:17:50	Now, if we go to the interface here, the tunnel,
0:17:53	and we'll set the bandwidth to be, let's say whatever the maximum value is.
0:18:01	And we could set the delay to some low value.
0:18:08	If we Show IP Route Include Tunnel,
0:18:13	then we'll clear EIGRP neighbors.
0:18:32	We see the message that have the recursive error.
0:18:36	Now, we can see this if we look at the debug IP routing.
0:18:42	Then I will shut the tunnel down manually
0:18:48	and then bring the tunnel back up.
0:18:59	We should see that once establish the EIGRP adjacency,
0:19:04	that the tunnel destination, which is 150.10.7.0/24 is learned in the tunnel
0:19:13	and it's preferred based on the routing metrics.
0:19:20	If we Show IP EIGRP neighbors,
0:19:29	we should see, let's see, did switch 1 disabled the tunnel as well?
0:19:37	No, there's the new adjacency.
0:19:52	So, it's kinda hard to see in this output because there's so many routes that are being added
0:19:56	and leaving quickly.
0:19:58	But if we look at what happened here, it says that
0:20:07	we learned, let's see, where is it?
0:20:21	This very top one here.
0:20:22	It says that previously, I had two equal cost paths to reach 155.
0:20:29	Not 155, it'd be 150.
0:20:32	But the output should look the same here.
0:20:41	Let's see, 155...150, there it is.
0:20:44	Okay, so we had two equal cost paths to 150.10.7.
0:20:51	and let me undebug.
0:20:56	Or let's do this. Let's say, "No Logging Console."
0:21:01	So we'll see if we look at the logs, this is gonna happen over and over again.
0:21:06	That the tunnels gonna try to re-enable itself and the realize that it cannot.
0:21:12	And it's gonna go down.
0:21:19	So, it says, we have two paths that previously were from router 2 and router 1.
0:21:25	There metrics were somewhere in the order of 2.8 million.
0:21:31	I then learned the same prefix via the tunnel interface
0:21:36	with the lower metric. The metric now is 128,000.
0:21:39	So, it means I have to delete the routes out of the table,
0:21:42	and then enter the new one back in.
0:21:46	Once I do this, if we were to look at the logic of what router 5's table says,
0:21:53	it says, "To get to...
0:22:00	150.7.10.10, we need to go to 10.0.0.7"
0:22:12	Then likewise, it says, "To get to...
0:22:15	10.0.0.7, we need to go to 150.7.10.10"
0:22:26	So, one route points at the second one, the second one points right back.
0:22:31	If we were to look at the Debug IP Packet,
0:22:34	then we actually sent traffic out the tunnel while it was temporarily enabled.
0:22:39	We would see that the recursive look up fails
0:22:42	and the router tries to look up the route over and over and over.
0:22:47	But from the debug, we can see router 5 tries to prevent that.
0:22:52	It says that recursive routing occur, so now we're going to disable the tunnel.
0:23:00	Which means that the tunnel is to be removed from the routing table,
0:23:03	and then all of the networks learned via that interface have to be withdrawn.
0:23:11	Now, the solution to this problem is really straightforward,
0:23:15	as long as you know that the design problem is there to begin with,
0:23:18	it's very eaasy to solve.
0:23:20	The issue is, that there is never a valid circumstance
0:23:26	where we should be advertising the tunnel destination out the tunnel itself.
0:23:32	So, from router 5's perspective,
0:23:33	there's nothing wrong with it having the routes learned over the tunnel
0:23:40	from switch 1.
0:23:43	The problem is switch 1 should never advertise the loopback.
0:23:48	It's okay for the loopback to go that way, out the physical links.
0:23:52	But it should never go out the tunnel.
0:23:54	The same with router 5, the tunnel source should never be advertised out the tunnel.
0:24:01	With RIP and EIGRP, we can simply stop this by doing a distribute list.
0:24:07	So, on router 5, we would say,
0:24:11	we're going to create a prefix list, IP prefix list EIGRP filter
0:24:20	that denies our local prefix 150.10.5.0/24 and then permits everything else.
0:24:33	0.0.0.0/0 le 32.
0:24:38	So, that's everything from the prefix-list.
0:24:41	Then under the EIGRP process, router EIGRP 1
0:24:46	distribute-list, prefix-list, EIGRP filter should go out to tunnel 0.
0:24:57	Then on switch 1, we would do the same thing
0:25:00	or we could do this inbound on router 5.
0:25:04	So, you could do both filters on the same device or you could do one on each.
0:25:11	So, on switch 1, we'll say, IP prefix-list EIGRP filter
0:25:20	deny my loopback, 150.10.7.0/24, permit everything else.
0:25:27	So, the key here is the route, not the actual address.
0:25:32	So, the route is the /24.
0:25:37	Then under EIGRP, distribute-list, prefix-list,
0:25:43	name as EIGRP filter, that's gonna go out tunnel 0.
0:25:53	So now, from router 5's perspective, since the tunnel is the preferred path,
0:25:59	but switch 1 is filtering its loopback, when we look in the routing table,
0:26:05	any destination we want can be routed out the tunnel
0:26:10	with the exception of this.
0:26:14	As long as this destination's still points at a non-tunnel 0 interface,
0:26:18	that's all that we really care about.
0:26:22	If we say "Show IP Route include tunnel..."
0:26:27	Okay, I must have the tunnel shut down now.
0:26:35	So, let's say "shut down and then no shut down."
0:27:05	So the tunnel interface is up, we see now, we have the adjacency
0:27:14	from router 5 to switch 1. If we Show IP route and look for the tunnel,
0:27:22	we could see now, there's tons of destinations learned out there, which is fine
0:27:26	as long as when I do a trace to 150.10.7.7, this needs to route not out the tunnel.
0:27:35	For anything else, if I trace to 1's loopback,
0:27:42	that's fine, that can go out the tunnel.
0:27:45	Because this doesn't cause a recursive error, as long as I can actually build the Layer 3 packet.
0:27:52	So, when the recursion error is there, the router doesn't know how to build the Layer 3 packet,
0:27:56	because it doesn't know what physical interface the packet is eventually gonna route out.
0:28:09	Now, there is a good write-up on this on Cisco's website.
0:28:13	If you search for tunnel recursive routing or recursive error,
0:28:22	it says, "what is this message mean?"
0:28:31	It says, " It's a misconfigure that causes the router to try to route the tunnel destination address
0:28:35	using the tunnel interface itself which is recursive routing."
0:28:38	So, the router fixes this automatically just by disabling the interface.

Now Viewing

CCIE Routing & Switching Advanced Technologies Class
Title:	CCIE Routing & Switching Advanced Technologies Class
Duration:	81h 59m
The CCIE Routing & Switching Advanced Technologies Class is the first step in understanding CCIE level technologies and is a companion to the Advanced Technologies Lab Workbook. Each technology you need to know for the CCIE Routing & Switching lab will be described in detail using an instructor led hands on demonstration. The class consists of over 80 hours of in depth explanations and examples.
Get instant access to our entire library!
$159/month	Add to Cart
Download this Course
$299.00	Add to Cart

GRE Tunneling, GRE Recursive Routing Errors

Create Bookmark