Question about creating of GRE tunnels over SDWAN TLOC Extension link

[kay.kang]

Hi,

We're having two SDWAN vEdges and each vEdge has different ISP connection.

They're inter-connected by TLOC Extension link.

Each vEdge has two GRE tunnels(to Zscaler cloud service) through only its directly connected ISP link.

I am wondering if it's possible to create GRE tunnels through TLOC Extension interface.

[Flavio Miranda]

Hi

 If you already have TLOC in place, which means you must have next-hop for this tloc on each vEdge.

The basic configuration for GRE is:

tunnel source fastEthernet X/X
tunnel destination 192.168.1.1 (example)

So, imagine the destination for your tunnel is 192.169.1.1, you need to have a route like:

ip route 192.169.1.1 255.255.255.0  "the other vedge tloc"

Then, when the tunnel try to come up, it will be sent to the other vedge and will be stablished via TLOC extention.

[Dan Frey]

Presumably you have NAT configured on ISP directly connected links?   GRE keepalives do not work through NAT so you would have to have a public IP address space on the TLOC-ext network and not perform NAT on the GRE traffic.    VPN0 interfaces that have SDWAN tunnels configured will not route to other interfaces in vpn0 and you will need to have the SDWAN tunnels terminate to a loopback interface.   When SDWAN is terminated to loopback interface then normal routing can take place between interfaces in VPN0.   

IMHO the easier method when establishing tunnels through tloc-ext interface is to terminate IPSEC to zscaler as IKE keepalives  can go through NAT.

[kay.kang]

Hi Dan,

Thanks for the comment.

We have private IP space on TLOC Extension and we don't run any SDWAN overlay tunnel. vEdges are just run as ordinary WAN router controlled by vmanage.

They don't establish any OMP path between them.

[LeonardoFernandez5618]

Hi,

By my experience GRE tunnels to Zscaler sourcing from TLOC-Extension with private IP space and NAT on the Internet facing connection do not work, IPSEC tunnel works OK.