Help!?, IP CEF (Dual Wan with OER) Breaks IPSEC VTI Tunnels and EIGRP.
I have a very weird but also very frustrating issue going on right now.
My current home WAN Setup involves a single 1921 with 2x HWIC1-ADSL Cards installed running OER for Wan Balancing. The OER and WAN balancing side of things works very well and doesn't give us the issue that GLBP on 2 Routers that i was running before did, which was breaking sessions by changing the default route without being session aware. (Old Setup was 1921 + 1941 running GLBP with 1x HWIC1-ADSL Each).
This new setup however, has brought along its own problems which are just as much if not more infuriating than what GLBP was doing.
So, as part of a Group Project for my Network Security degree with 3 other friends, we have multiple IPSEC VTI Tunnels between our routers, and we use EIGRP for dynamic routing, each person has 2 tunnels from their wan router to 2x other people for redundancy, and over this our Labs and servers are able to communicate.
My Setup however is a bit different because i have 2x WAN Connections, so i have 2x tunnels per WAN Connection and here is where the trouble starts.
When i cold start the router i will typically only get 2 out of 4 tunnels to come up, either one to each Peer (HUB A, and HUB B) each on 1 WAN line, or 2 tunnels out one line and none out the other, and its totally random, sometimes 3 will come up. Now here comes the interesting bit...... If i turn off IP CEF, they ALL COME UP and Form EIGRP Adjacency normally, and if i turn IP CEF back on, then over 5 - 10 minutes a couple will fail and drop.
It should be noted that when a tunnel refuses to come up, the Peer router CAN NOT be Pinged from the respective wan interface (but often can on the other wan interface).
Tunnel 9004 goes to HUB A, from WAN A (Dialer 0) Tunnel 9006 goes to HUB B, from WAN A (Dialer 0) Tunnel 92004 goes to HUB A, from WAN B (Dialer 1) Tunnel 92006 goes to HUB B, from WAN B (Dialer 1)
on a Cold boot, tunnels 9004 and 92006 Come up but 92004 and 9006 do not.
With the above being the case:
HUB A CAN be Pinged from WAN A, But NOT from WAN B HUB B CAN Be Pinged from WAN B, But NOT from WAN A
Sometimes as is the case right as im typing this, two tunnels come up, but only one will form EIGRP Adjacency and pass traffic both ways, with the other in a constant New Adjacency / timeout loop leaving me on just 1 working tunnel.
Turning off IP CEF results in Either HUB being Pingable from Either WAN Interface and all tunnels coming up.
I cant however leave IP CEF Disabled because its Required by the OER Load Balancing running on the router, and turning CEF off results in MASSIVE (often 50% or more) Packet drops.
Does anyone know why turning CEF OFF causes ALL the tunnels to come up, and turning it back on (or booting up with it enabled) means that half the tunnels just dont work?
I have attached a sanitised router config as an attachment. IOS Version is:
In the last year, we’ve seen substantial changes in how enterprises conduct business. When the pandemic hit, it exposed gaps in business continuity plans, and it showcased the need to quickly deploy and remotely manage secure connections.
On 18th December 2020, Cisco announced the latest IOS XE release - Cisco IOS XE Bengaluru 17.4.1a
The first one in the Cisco IOS XE Bengaluru release series, IOS XE 17.4.1a unlocks various routing features and enhancements comprehensively c...
Exploring business options for a SD-WAN managed serviceLogicalis UK offers a rapid, cost effective deployment with ngenaAdvantages that make a differenceSummary of benefits:Looking forwardResources
This event had place on Tuesday 19th, January 2021 at 10...
(view in My Videos)
Community Live- May the SD-WAN Force Be With You
This event took place on Tuesday 19th, January 2021 at 10:00hrs PDT
In this session attendees received an introduction to Software Defined-WAN (SD-WAN) and the importance of ...
Cisco Champion Radio · S8|E3 The Cisco DNA Center Machine Reasoning Engine
Machine Reasoning is a new category of AI/ML that you will soon hear a lot about. It saves your IT team time by automating complex and tedious networking tasks. It can also...