static vti and gre tunnels on the same router

[Michalis Michael]

I have a router with two tunnels, one is GRE/IP tunnel (no IPsec) and the other is IPsec VTI tunnel.

The problem is that no traffic is passed between the tunnels.

I checked the routes, acl and everything seems ok.

Can anyone tell me whether the problem may related with the different protocols of the tunnels?

[Karsten Iwen]

That should work. You can route traffic received from Tunnel1 to Tunnel2 also if they have different modes. Share your config to see what's going wrong.


Sent from Cisco Technical Support iPad App

[Michalis Michael]

Thanks for the replay. I am attaching you the configurations.

I can reach Headquarters (192.168.0.202) from either VTI router (10.10.10.1) or GRE router (192.168.1.202).

The problem is that I cannot ping 10.10.10.1 from 192.168.1.202 and opposite.

[Karsten Iwen]

The only real problem I see is the wrong IP on Tunnel0 of the GRE-router (should be .22 instead of .25). And the route to 10.10.10.0 has the wrong mask.

Please post the output of traceroutes between the routers.



Sent from Cisco Technical Support iPad App

[Michalis Michael]

Hi Karsten,

I forgot to tell you that the GRE tunnels is offered from the ISP. So there is another router between HQ and our GRE

router. See attached network diagram. I spoke with the ISP and they configured a route for 10.10.10.0/29 to their router.

See below traceroutes from branch routers. The packets are going to the HQ interfaces but they are not forwarded further.

(I correct the wrong mask of 10.10.10.0 network)

GRE Router#traceroute 10.10.10.1 source 192.168.1.202

Type escape sequence to abort.

Tracing the route to 10.10.10.1

  1 172.16.207.26 24 msec 28 msec 24 msec

  2 172.16.207.21 52 msec 80 msec 124 msec

  3  *  *  *

  4  *  *  *

  5  *  *  *

VTI Router#traceroute 192.168.1.202 source 10.10.10.1

Type escape sequence to abort.

Tracing the route to 192.168.1.202

  1 172.16.50.1 56 msec 48 msec 48 msec

  2  *  *  *

  3  *  *  *

  4  *  *  *

[Karsten Iwen]

Do you need to communicate with a network attached to the ISP-router? If not, build a direct tunnel from GRE-router to Headquarter.


Sent from Cisco Technical Support iPad App