GRE tunnel auto down

[Sudqi]

please note that I confgure VTI and keep alive but the tunnel doesn't go down automaticly, 

interface Tunnel29
ip mtu 1400
keepalive 10 3
tunnel mode ipsec ipv4

tunnel protection ipsec profile TNB-BKP_Prof

any advise!

thanks

[MHM Cisco World]

Did you config tunnel source and destiantion?

[Sudqi]

yes sure, below is all conf

interface Tunnel29
ip address 10.10.10.1 255.255.255.252
ip mtu 1400
ip access-group NEW-ACL_BK in
ntp disable
keepalive 10 3
tunnel source 192.168.1.1
tunnel destination 192.168.1.2
end

[MHM Cisco World]

I check keepalive work for GRE tunnel, here you run mode IPsec so it not work 

[Sudqi]

yes it will work, but what is solution if I want mode IPsec, is there any other method to detect the tunnel?

[MHM Cisco World]

Hmm'

solution is using track ip sla and eem' the eem check track status down and action will be shut the tunnel.

Also isakmp already have keepalive whcih I think it also effect tunnel status.(this if you want i can check by lab)

[Sudqi]

I want to keep the ip sla solution last choice, so I am searching how to use the keepalive feature

I found deep detiction feature under the crypto ikev2 profile, but also did not work, 

thank you MHM, appreciated

[MHM Cisco World]

Friend you are so so welcome 

Have a nice summer 

MHM

[Joseph W. Doherty]

BTW, I recall @MHM Cisco World is correct.  I.e. interface keep-alive works on ordinary GRE tunnel, but not on some/all others.

[M02@rt37]

hello @Sudqi,

is that the full GRE tunnel config ?

https://study-ccnp.com/site-to-site-virtual-tunnel-interface-vti-over-ipsec/

[Sudqi]

no, below is the full:

interface Tunnel29
ip address 10.10.10.1 255.255.255.252
ip mtu 1400
ip access-group NEW-ACL_BK in
ntp disable
keepalive 10 3
tunnel source 192.168.1.1
tunnel destination 192.168.1.2
end

[Sudqi]

Hi,

the VTI configuration was successful, but the idea here is that I want the GRE to become auto-down when the peer is dead, unfortunately, keepalive does not work,

[paul driver]

Hello
My understanding using  keepalives on a ipse/gre tunnel at both ends  wont work due to the way the the keepalives are still encrypted as they reach the physical interface and forwarded on to the tunnel interface, using an additional monitoring feature such IPSA would be an alternative for establishing the state of the tunnels.

review here

[Sudqi]

Thanks Paul,

yes, it doesn't work, I will do IP SLA