Tunnel GRE from two router BGP to Zscaler

[Luca P.]

Hi all,

a premise, I would like to make 4 GRE tunnels starting respectively, two from one router (R1 with "tunnel1primary" and "tunnel2secondary") and two from another router (R2 "tunnel1primary" and "tunnel2secondary").
In front of these two routers I have two other routers (R3 and R4) on which today traffic is balanced through the use of the BGP protocol (R1 and R2 have one IP in HSRP from internal network).
I would also like to be able to balance the traffic of the GRE tunnels that I need to create.
Can I create two GRE tunnels pointing to the same destination public IP address and make sure that the traffic is dynamically balanced on the two routers in front (R3 and R4) or is it better to manage the traffic with static routes where I turn the traffic arriving on R1 towards R3 and the traffic arriving on R2 towards R4?

Available for clarification.

Regards,
Luca.

[Richard Burts]

Luca

There are parts of your post that I do not understand and so can not address. But this part seems clear:

Can I create two GRE tunnels pointing to the same destination public IP address

You do not tell us whether the GRE tunnels would be from the same source address, and that is important. It is not supported to have 2 GRE tunnels from the same source address to the same destination address.

[Luca P.]

Hi Rick,

refer to the exhibit:

How can I forward traffic (that have to pass thorugh the two tunnel gre) on the two R3 and R4?

Is there the possibility to do it dynamically (or other solution) or I have to do some statc route to direct traffic from R1 to R3 and from R2 to R4?

Regards,

Luca.

[Richard Burts]

Luca

Thank you for the additional information, and especially for the diagram. Your original post asked about 4 GRE tunnels but in the diagram I see only 2 GRE tunnels. A GRE tunnel originates on R1 and a second GRE tunnel originates on R2. It is not clear whether the remote end of the GRE tunnel is on R3 and R4 or whether the remote end of both GRE tunnels is on zscaler. Can you clarify?

Your diagram shows an OSPF network running on the 4 routers but does not include zscaler. Is that the case?

You make it clear that you want R1 to go through R3 and R2 to go through R4. It is not clear whether you want to have failover. If there is a problem for R1 to get to zscaler using R3 would you want traffic from R1 to go through the path using R4?

There is an option to control sending traffic from R1 using static routes. There may be an option to control that traffic with a dynamic routing protocol. When we know answers to the questions I have asked we will be in a better position to discuss advantages and disadvantages of each approach.

[Luca P.]

Hi Rick,

below my reply in bold:

Thank you for the additional information, and especially for the diagram. Your original post asked about 4 GRE tunnels but in the diagram I see only 2 GRE tunnels. A GRE tunnel originates on R1 and a second GRE tunnel originates on R2. It is not clear whether the remote end of the GRE tunnel is on R3 and R4 or whether the remote end of both GRE tunnels is on zscaler. Can you clarify?
The remote end of both GRE tunnels is on Zscaler.

Your diagram shows an OSPF network running on the 4 routers but does not include zscaler. Is that the case?
Yes, it does not include Zscaler.

You make it clear that you want R1 to go through R3 and R2 to go through R4. It is not clear whether you want to have failover. If there is a problem for R1 to get to zscaler using R3 would you want traffic from R1 to go through the path using R4?
One note, clients arrive at R1 and R2 respectively using an entry dns and are balanced at the HSRP level. Entry dns is a FQDN that resolves two IP, one (x.x.x.x) goes from R1 and the other (x.x.x.y) goes from R2 (entry example: example-it.test.it IN A x.x.x.x and example-it.test.it IN A x.x.x.y).
If for some reason R1 doesn't manage to turn traffic on R3 I'd like to make it send traffic on R2 and then end up on R4 and then on Zscaler.
Is it more clear now?

There is an option to control sending traffic from R1 using static routes. There may be an option to control that traffic with a dynamic routing protocol. When we know answers to the questions I have asked we will be in a better position to discuss advantages and disadvantages of each approach.
I think that the use of the static route is the solution in this case.

Regards,

Luca.

[Richard Burts · Accepted solution]

Luca

Thank you for the explanations. Based on your responses I agree that controlling the traffic using static routes is the better approach.

[Richard Burts]

Luca

I am glad that my explanations and suggestions have been helpful. Thank you for marking this question as solved. This will help other participants in the community to identify discussions which have helpful information. This community is an excellent place to ask questions and to learn about networking. I hope to see you continue to be active in the community.

[Georg Pauwen]

Hello,

post a schematic drawing of the setup you have in mind.