GRE over GRE over IPSec

[patrick-m-hogan]

I have an ASR 1006 (16.12.8) connecting to a C8500L (17.09.04a). We put a crypto map on the circuit to encrypt everything between devices. I then have a GRE tunnel using the circuit IPs as the tunnels source and destination IP's. The tunnels is using loopbacks as the tunnel IP's (ip unnumbered). This GRE tunnel is working fine and OSPF comes up no problem. Then I have a GRE in a VRF using the same loopbacks that the tunnel is using as its tunnel source and destination (ip unnumbered again) and that tunnel wont come up. One side (ASR 1006) gets stuck in INIT and the other side has nothing for a neighbor (8500). I have another router (ASR 1006) with the same configuration connecting to the same ASR 1006 and this same configuration works great with no problems. 1 more thing is this is a new install and it worked fine until I put the crypto map on the circuit and that is when the VRF tunnel went down. I tested this by removing crypto and it came right back up and when I applied crypto again it went down again. I have tried everything I can think of and a few other Eng. have tried as well and I can't find any way to make it work. The GRE tunnel is UP UP but still not working.

 

[M02@rt37]

Hello @patrick-m-hogan 

If you can, switch to IPSEC profiles with vti instead of crypto maps. VTI handles VRF and IPSEC cleanly.

If you must use crpto map, assign IP addresses directly (not unumbered) to simplify resolution...

[patrick-m-hogan]

Thanks, I will look into it. I hope the old IOS on the ASR will support it.

[Joseph W. Doherty]

I hope the old IOS on the ASR will support it.

Good chance your ASR IOS may support VTI.

BTW, I recall another advantage of VTI, less bandwidth overhead.

Oh, and also on the subject of overhead, for these kinds of tunnels, don't overlook fragmentation avoidence.

[paul driver]

Hello
Just to clarify- you have ipsec on the transit between the rtrs then you run GRE/ISPEC over that encrypted transit correct?
Where does the vrf fit into this, as I would expect the vrf not to be able to see anything from the global rib table by default ?

Maybe share your cfg if applicable ?

[patrick-m-hogan]

I only have IPSec on the circuit. The GRE tunnel does not have IPSec on it. I do not have a tunnel protection IPsec profile on the tunnel just a crypto map on the circuit interface.

[MHM Cisco World]

Tunnel protection command not available' if Yes then try add crypto map under tunnel source interface.

MHM