GRE TUNNEL ALWAYS UP

ozlecz

hello,

-we are monitoring gre tunnels between cisco vpn spa on a 6500 and 2811 routers

-monitored tunnel is on the 6500 side

FINDINGS

-even if the router on the other end is down, tunnel still shows green and up

-show int tunnel on the core shows up

-show crypto-session on the core shows DOWN-NEGOTIATING

WORKAROUND

-tried monitoring the tunnel on the far end router side but the tunnel stills shows green in an UNKNOWN state.

any suggestion please..

thanks

Find more posts tagged with

false_positive

gre_tunnel

Accepted answers

TreyJ

That is a problem with GRE tunnels. If there is a valid route and IP address, they show up, even if the other end is down. If you put keepalive statements on both tunnel interfaces, when the link drops, the tunnel will drop also.

Sorry this response is so late. Just now found the post.

All comments

achrich

I`ve had a simliar issue with this kind of setup and I don`t believe there is any easy solution.

I`ve looked into using EEM which can manually disable the interface via the use of IP SLA ICMP checks ( pinging tunnel end points ) however you need a certain IOS version to the correct EEM package ( from what I remember 2.1 and above is required ).

If its just alerting you require I believe IPSEC will supply tunnel stop start traps which could be alerted on via a rule.

TreyJ

Sorry this response is so late. Just now found the post.

ErikInHell

Thanks, this was a big help.