Hi Jeff, Thanks for the suggestion. The tunnel interfaces don't have a MAC address (under "show int tun501"), but I added a different one to each tunnel anyway (and now it. The outcome was no different, still no traffic and packets still being dropped by CEF.
I tried to add a MAC to the loopback interfaces, but it wouldn't let me. So your tunnel from VRF to global routing table works ok ? I have been looking at stuff on packet recirculation, but it all seems to apply to 6500/7600 with no references for anything smaller than this ? I am aware that I could leak routes between VRF's, but I'd prefer to do it this way if it's at all possible. Thanks, Tony. --- On Mon, 10/8/09, Jeff Fitzwater <[email protected]> wrote: > From: Jeff Fitzwater <[email protected]> > Subject: Re: [c-nsp] cross-vrf tunnels > To: "Tony" <[email protected]> > Cc: [email protected] > Date: Monday, 10 August, 2009, 11:24 PM > I believe your problem is that both > ends of the tunnel have the same mac address causing arp to > fail. You can change one end and it should work. > > I had similar problem with VRF path back to global on the > same router, but I had to use the physical interfaces to get > around the "single lookup in cef issue". > > > > Jeff Fitzwater > OIT Network Systems > Princeton University > On Aug 10, 2009, at 8:43 AM, Tony wrote: > > > Hi all, > > > > I want to route traffic from one VRF to another VRF on > the same router. I did some searching and came across a > prior discussion of this very same topic: > > > > http://puck.nether.net/pipermail/cisco-nsp/2009-February/058594.html > > > > So I decided to create a tunnel between two VRF's on > the same box using loopback addresses for the tunnels. > > > > I set it all up and I can ping from the IP of one end > of the tunnel in one VRF to the other end of the tunnel in > the second VRF. > > > > The problem I have is that traffic from other sources > isn't going over the tunnel properly. > > > > The config looks something like this: > > > > ! > > interface Loopback 501 > > ip address 10.1.41.201 255.255.255.255 > > ! > > interface Loopback 502 > > ip address 10.1.41.202 255..255.255.255 > > ! > > interface Tunnel 501 > > ip vrf forwarding vrf1 > > ip address 10.1.41.197 255.255.255.252 > > tunnel source Loopback 501 > > tunnel destination 10.1.41.202 > > ! > > interface Tunnel 502 > > ip vrf forward vrf2 > > ip address 10.1.41.198 255.255.255.252 > > tunnel source Loopback 502 > > tunnel destination 10.1.41.201 > > ! > > > > I setup a test lab with a 2611 router either side of a > 7206 running 12.2(33)SRC (which is doing the VRF crossover). > It's all ethernet, no BGP, just two local VRF's on the 7200, > nothing fancy. > > > > When I attempt to ping the 2611 router on the other > side (via my loopback tunnel crossover connection) I get no > response. > > > > If I look at the stats on the tunnel interface it's as > if the traffic isn't going into the tunnel. The input and > output counters are all staying the same. This contrasts to > when I ping directly from one end of the tunnel to the other > as the counters do increase (and I get responses back). > > > > If I enable some debug, I get the following: > > * Tunnel502: adjacency fixup, > 10.1.41.202->10.1.41.201, tos set to 0x0 > > * CEF-Drop: Packet from 10.1.41.202 (Nu0) to > 10..1.41.201, Unclassified reason > > > > Which shows that my packet across the tunnel is being > dropped, but I don't know why. > > > > When I do the ping direct from one tunnel end IP to > the other, I see the normal sequence of events I would > expect (packet routed via RIB, packet goes into tunnel, GRE > encap, packet from one loopback to other, GRE decap, etc). > > > > Is this supposed to work ? Does anyone else have it > working ? What might I be doing wrong ? > > > > Many thanks, > > Tony. > > > > > > > > > > > > _______________________________________________ > > cisco-nsp mailing list [email protected] > > https://puck.nether.net/mailman/listinfo/cisco-nsp > > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
