GRE Tunnel using HSRP addresses

[Enrico]

Hi All, just wanted to know if something has changed regarding the possibility to establish GRE tunnels specifying HSRP addresses as source/destination of the tunnel.
I read several old posts where it was defined as not possible, or people discouraged from doing that.
I have recently simulated such thing and everything works fine. Has anything changed so far? Is there any best practice or recommendation with respect to use or not to use these addresses?
Many thanks,

best regards

[Philip D'Ath]

I'm not aware of any issues with using HSRP as a GRE tunnel source or destination.

If it fits your design better - use it.

[Enrico]

Ok, thank you Philip.

[Joseph W. Doherty]

Have you tried a GRE tunnel with packet sequence checking enabled?

[Enrico]

Not sure about what you mean, can you please point me at an example of what you suggest?

[Joseph W. Doherty]

GRE tunnel interface command: tunnel sequence-datagrams

[Richard Burts]

While the tunnel might come up and things look like they are working I believe that it introduces the possibility of several problems. For starters since the GRE tunnel is a point to point connection and the HSRP destination address might appear on different remote routers you would need to configure a tunnel on each of the remote routers (perhaps we might call them remoteA and remoteB. So our router would connect to either remoteA or remoteB but it does not know which one it is connected to. Is it possible that the route table at remoteA has some things that are different from remoteB? How would our router know which routes to use?

Let us also consider the aspect of which address will be used for the physical packet being sent over the tunnel. The post suggests that our router will be configured with our HSRP address as the source and that remoteA and remoteB will be configured with our HSRP address as the tunnel destination. But when our router sends a packet over the tunnel the packet source address will be the interface IP address and not the HSRP address. Will there be an impact when remoteA receives a GRE packet but the source address is not what it expected?

I suspect that there are some other potential issues but these are what comes easily to mind. I would suggest that you not use HSRP for the GRE source or destination address. Many of us have learned the lesson that while you CAN configure something does not necessarily mean that you SHOULD configure it.

HTH

Rick 

[Philip D'Ath]

There wont be any problems rburts.  When using a GRE tunnel with an HSRP address the tunnel only comes up on the active HSRP router.  All packets are sent using the HSRP address - never the routers own address.  Remote sites will only see the HSRP address and only need to talk to the HSRP address.  It truely looks like a single router to remote sites.

I've used this configuration lots as it is super simple and reliable.

[Matej.Ciso]

Hello Philip,

I´ve got one question regarding the hsrp configuration, how did you configured, lets call them destination tunnels, on those two remote routers? When I tried this configuration while running eigrp on both remote HSRP routers, eigrp neighbourship over tunnels was not established. 

The thing is that, when i configure same tunnel ends on both remote routers (source address is VIP), eigrp routing throught those tunnels does not work... i assume it is because of "dual homed" end of tunnels... 

Do you have any toughts regarding this issue?

THX

Picture attached.....

EDIT 18.6.2018:

Ok so i have found solution, at first i used GLBP insted of HSRP, and that made a quite difference... Did not realize it. And next thing was that i forgot to configure network in eigrp routing to make neighbourship (on one of those two remote routers....).

[Enrico]

Thank you Richard, from what I can see on a test enviroment, it works as Philip described:

 - one tunnel up at a time (with the active HSRP endpoint)

 - GRE packets use HSRP address

It seems to me that it's not offending any rule with respect to establishing a simple tunnel: it is still a point to point connection as the HSRP address is effectively active just on one node at a time.

My goal is to provide tunnel redundancy for a customer without him to perform any change on its side. On my side, both routers are configured exactly the same, no route table differences.