Help!?, IP CEF (Dual Wan with OER) Breaks IPSEC VTI Tunnels and EIGRP.
I have a very weird but also very frustrating issue going on right now.
My current home WAN Setup involves a single 1921 with 2x HWIC1-ADSL Cards installed running OER for Wan Balancing. The OER and WAN balancing side of things works very well and doesn't give us the issue that GLBP on 2 Routers that i was running before did, which was breaking sessions by changing the default route without being session aware. (Old Setup was 1921 + 1941 running GLBP with 1x HWIC1-ADSL Each).
This new setup however, has brought along its own problems which are just as much if not more infuriating than what GLBP was doing.
So, as part of a Group Project for my Network Security degree with 3 other friends, we have multiple IPSEC VTI Tunnels between our routers, and we use EIGRP for dynamic routing, each person has 2 tunnels from their wan router to 2x other people for redundancy, and over this our Labs and servers are able to communicate.
My Setup however is a bit different because i have 2x WAN Connections, so i have 2x tunnels per WAN Connection and here is where the trouble starts.
When i cold start the router i will typically only get 2 out of 4 tunnels to come up, either one to each Peer (HUB A, and HUB B) each on 1 WAN line, or 2 tunnels out one line and none out the other, and its totally random, sometimes 3 will come up. Now here comes the interesting bit...... If i turn off IP CEF, they ALL COME UP and Form EIGRP Adjacency normally, and if i turn IP CEF back on, then over 5 - 10 minutes a couple will fail and drop.
It should be noted that when a tunnel refuses to come up, the Peer router CAN NOT be Pinged from the respective wan interface (but often can on the other wan interface).
Tunnel 9004 goes to HUB A, from WAN A (Dialer 0) Tunnel 9006 goes to HUB B, from WAN A (Dialer 0) Tunnel 92004 goes to HUB A, from WAN B (Dialer 1) Tunnel 92006 goes to HUB B, from WAN B (Dialer 1)
on a Cold boot, tunnels 9004 and 92006 Come up but 92004 and 9006 do not.
With the above being the case:
HUB A CAN be Pinged from WAN A, But NOT from WAN B HUB B CAN Be Pinged from WAN B, But NOT from WAN A
Sometimes as is the case right as im typing this, two tunnels come up, but only one will form EIGRP Adjacency and pass traffic both ways, with the other in a constant New Adjacency / timeout loop leaving me on just 1 working tunnel.
Turning off IP CEF results in Either HUB being Pingable from Either WAN Interface and all tunnels coming up.
I cant however leave IP CEF Disabled because its Required by the OER Load Balancing running on the router, and turning CEF off results in MASSIVE (often 50% or more) Packet drops.
Does anyone know why turning CEF OFF causes ALL the tunnels to come up, and turning it back on (or booting up with it enabled) means that half the tunnels just dont work?
I have attached a sanitised router config as an attachment. IOS Version is:
Inviting all network professionals in operations! We'd like to understand what would be valuable for you in a mobile application. Your response will help Cisco improve a product feature that could benefit you. Thanks!
Click here to take the sur...
Cisco’s software-defined wide area network (SD-WAN) solution allows user to quickly and seamlessly establish an overlay fabric to connect an enterprise’s data centers, branch and campus locations, as well as colocation facilities in order to imp...
1. Log into CLI of DNAC:
ssh maglev@< DNAC appliance IP> -p 2222
2. Run this curl command to get token to get member id:
curl -X POST -u admin:<admin user password> -H -V https://<CLUSTER-IP>/api/system/v1/identitymgmt/token
Enterprise Switching Business Unit is glad to announce Beta release 16.12.2 for all Catalyst 9200/9300/9400/9500/9600 and Catalyst 3650/3850 Platforms. This release is made available to allow users to test, evaluate and share fee...
Purpose of the document
This document describes the general recommendations or best practices when designing and deploying the Cisco SD-Access technology. The document assumes that the reader has a general overview of Cisco's SD-Access for Distributed C...