topic Re: looped chain attempting to stack in Routing and SD-WAN

looped chain attempting to stack

roharris33 — Thu, 21 Feb 2019 22:21:53 GMT

Hey everyone I'm running into an issue with recursive routing and can't seem to figure out how to fix it. I have an IPSEC with GRE runnning OSPF. The tunnel comes up fine but OSPF is flapping. It appears that the route to the destination is via the tunnel itself which is an issue. I inflated the ospf cost of the tunnel interfaces but that didn't help. I also added in a static route to the tunnel destination on each router but that didn't help either. From what I've read in most cases this causes the tunnel to go down but in my case the tunnel stays up on both sides. Configs are attached.

Headend route to branch tunnel IP

Branch route to Headend tunnel IP

Re: looped chain attempting to stack

balaji.bandi — Thu, 21 Feb 2019 23:04:49 GMT

check this document may help you.

https://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/22327-gre-flap.html

Re: looped chain attempting to stack

Deepak Kumar — Fri, 22 Feb 2019 05:06:26 GMT

Hi,

I have noticed there is some miss configuration on the branch router routing. Also, confirm that are you advertising any default route on the OSPF?

Please make below changes in the branch router configuration:

no ip route 10.192.0.254 255.255.255.255 2.2.2.1
ip route 1.1.1.1 255.255.255.255 2.2.2.1

Here, I am assuming that you have changed the IP address in attached configuration or this is a lab (because 1.1.1.1 is known IP). Here 1.1.1.1 is your Head office IP address and 2.2.2.1 is your branch office gateway.

Regards,

Deepak Kumar

Re: looped chain attempting to stack

paul driver — Fri, 22 Feb 2019 13:10:21 GMT

Hello

1) Remove the static routes for each tunel interfaces that are pointing to what looks like a recursive next-hop

Head
no ip route 10.192.0.17 255.255.255.255 198.190.160.1

Spoke
no ip route 10.192.0.254 255.255.255.255 2.2.2.1

2) Check your default routes to make sure their next-hop address are correct as it lookslike you have typo's
Head
ip route 0.0.0.0 0.0.0.0 1.1.1.1 < ?

interface GigabitEthernet0/0/1
description WAN UPLINK
ip address 1.1.1.1 255.255.255.0

3)
router ospf 1
passive interface default

no passive interface tunnel x

Re: looped chain attempting to stack

roharris33 — Fri, 22 Feb 2019 14:16:18 GMT

I made the suggested changes. I fixed the typo's and uploaded new configs. I'm still getting the same error. Also here is a snip of the routing table from the branch router after making the changes. I don't think it should be learning 10.192.0.17 right?

Re: looped chain attempting to stack

Deepak Kumar — Fri, 22 Feb 2019 14:38:41 GMT

Hi,

Also, make below changes in the configuration:

Head Office:

interface Tunnel1

no ip policy route-map VPN-Internal

And Why are you ignoring a Basic OSPF area concept? Why everything in the Area1? It is not making an issue in current network but will make issue while increasing spokes in the network.

Branch Office:

crypto ipsec transform-set trans2 esp-aes esp-md5-hmac
mode transport

Regards,

Deepak Kumar

Re: looped chain attempting to stack

roharris33 — Fri, 22 Feb 2019 15:39:14 GMT

I removed the route map from the headend and made the change on the branch, bounced the tunnel and got the same error message.

This tunnel will act as a backup for WAN sites. All WAN sites are in area 1. Campus area 100 and backbone area 0.

Re: looped chain attempting to stack

Deepak Kumar — Fri, 22 Feb 2019 15:53:43 GMT

Hi,

Again I went through the DMVPN configuration and found that you have enabled Phase3 on the HUB site as below:

interface Tunnel1
ip nhrp redirect

And you didn't enable on the Spoke router. Spoke is still working on Phase2. try below commands:

interface Tunnel1
ip nhrp shortcut

Regards,

Deepak Kumar

Re: looped chain attempting to stack

roharris33 — Fri, 22 Feb 2019 16:31:39 GMT

That command (ip nhrp shortcut) isn't explicitly stated when active on the tunnel interface. But is stated when you enter no ip nhrp shortcut. When I enter the ip nhrp shortcut command it breaks the OSPF adjancy.

Re: looped chain attempting to stack

Deepak Kumar — Fri, 22 Feb 2019 16:43:57 GMT

Hi,

Share OSPF routing and routing output.

Show ip route ospf

Sho ip route

Sho ip nhre brief

show Dmvpn

Regards,

Deepak Kumar

Re: looped chain attempting to stack

roharris33 — Fri, 22 Feb 2019 17:37:32 GMT

Show commands are attached. The DMVPM results is interesting (at least I think). I ran the command a few times and had different results. You will notice that the state changed from NHRP to UP in the photo below. But I think the issue is NRHP the next hop and target network are the same.

Re: looped chain attempting to stack

grabonlee — Fri, 22 Feb 2019 18:37:54 GMT

I believe you have made the changes the others suggested. However, I noticed that both your Hub and Spoke are configured with same OSPF priority.

ip ospf priority 2

The Hub should always be the DR, hence set it with the highest priority or make the Spokes 0 priority.

Re: looped chain attempting to stack

roharris33 — Fri, 22 Feb 2019 18:49:35 GMT

I made that change on the branch and I'm still seeing the same looped chain message. Here is the sh ip NHRP result.

Router#sh ip nhrp
10.192.0.254/32 via 10.192.0.254 - I think this is the problem.
Tunnel1 created 00:02:56, never expire
Type: static, Flags:
NBMA address: 1.1.1.237

Re: looped chain attempting to stack

grabonlee — Fri, 22 Feb 2019 19:31:34 GMT

There is nothing wrong with the output of Sh ip nhrp. That is the correct output, as you should see only the Hub address mapped to the NBMA. This is not recursive routing. You can ping any address behind the Hub from the Spoke, with the tunnel IP as the source and see if it goes through the tunnel or not

If you're worried about recursive routing in the future, then put the WAN interface in a VRF and also reference the VRF in the Tunnel interface (Tunnel vrf command) and static default route.

If I may ask, why is your NBMA 1.1.1.237, while the Hub config file shows 1.1.1.2. Was that a typo?

Re: looped chain attempting to stack

roharris33 — Fri, 22 Feb 2019 19:43:54 GMT

Configure the WAN in a VRF on the spoke? I can ping the tunnel IP but nothing else. There is a typo in the config file....trying to mask the public IP.

Re: looped chain attempting to stack

grabonlee — Fri, 22 Feb 2019 21:27:25 GMT

On the Hub, could you remove the static route ip route 1.1.1.2 255.255.255.255 2.2.2.1. There's no use for this. You only need a static default pointing to your ISP IP.

For the VRF, if you're close to your Spoke site, then configure VRF locally. This is because you will loose IP configuration and connectivity as soon as you apply the VRF forwarding command on the WAN interface. If no chance of going to the Branch, then do the VRF at the Hub.

You would need to do the following:

1. Create a VRF with the vrf definition command and specify ipv4 unicast and multicast (I saw PIM configuration in your configs)

2. Remove the Crypto keyring and reapply with crypto keyring name vrf name

3. Reconfigure WAN interface with vrf forwarding command and reapply IP address

4. Configure static default with ip route vrf name 0.0.0.0 0.0.0.0 next_hop

5. Under the Tunnel interface configure tunnel vrf name

Also remove PBRs that you have at the Hub and Spoke. You can reapply when you're sure everything is working.

When done, do following:

1. Check ospf neighbors and route table

2. Ping from the Hub to the LAN gateway IP on the Spoke, which is I think is VLAN 2000. Use Hub tunnel as Source. This should pass.

2. Do same ping as 1 above, but this time use ping vrf. This should fail.

3. Repeat from the Spoke to the Hub

Re: looped chain attempting to stack

Deepak Kumar — Sat, 23 Feb 2019 06:52:03 GMT

Hi,

I didn't find any issue in shown output but I noticed that NHRE uptime and OSPF routes were learned 2 minutes ago. Is it flapping or administrator had made changes?

Regards,

Deepak Kumar

Re: looped chain attempting to stack

roharris33 — Mon, 25 Feb 2019 12:35:52 GMT

I'll continue working with the VRF but it looks like I will need to change the tunnel configuration also.

Yes the OSPF adjacency is flapping. I can ping the tunnel IP's but nothing else.

Re: looped chain attempting to stack

Deepak Kumar — Mon, 25 Feb 2019 12:43:42 GMT

Hi,
On the spoke router change the OSPF priority to higher.

Regards,
Deepak Kumar

Re: looped chain attempting to stack

roharris33 — Mon, 25 Feb 2019 13:20:23 GMT

That didn't help either. I'm going to open a TAC case. I'll let you guys know the results.