Tunnel interfaces

Similar Questions

• IOS Tunnel interface. Size of the NEGATIVE queue?

  When I do a 'show int' on my tunnel interface, I see a NEGATIVE queue size. Is it normal or I see a bug in the IOS?

  Router #sho int tunnel1

  Tunnel1 is up, line protocol is up

  Material is Tunnel

  The Internet address is 172.16.14.2/30

  MTU 1514 bytes, BW 600 Kbit, DLY 500000 usec,

  reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation TUNNEL, loopback not set

  KeepAlive not set

  Source xxx.xx.xxx.xx (FastEthernet4), destination yyy.yyy.yy.yy tunnel

  Tunnel protocol / transport GRE/IP, off key, off sequencing

  TTL 255 tunnel

  Disabled packages, quick tunneling active parity check

  Tunnel of transmission bandwidth 8000 (Kbps)

  Tunnel to receive 8000 (Kbps) bandwidth

  Last entry of 00:00:00, 00:00:00 exit, exit hang never

  Final cleaning of "show interface" counters 00:15:14

  Queue entry :-542544/75/0/0 (size/max/drops/dumps); Total output drops: 0

  Strategy of queues: fifo (pre-ranking QOS)

  Output queue: 0/0 (size/max)

  5 minute input rate 0 bps, 0 packets/s

  5 minute output rate 0 bps, 0 packets/s

  packages of 1499, 148506 bytes, 0 no buffer entry

  Received 0 broadcasts, 0 Runts, 0 Giants 0 shifters

  errors entry 0, 0 CRC, overgrown plot of 0, 0, 0 ignored, 0 abort

  My config tunnel isn't something special...

  Tunnel1 interface

  bandwidth 600

  IP 172.16.14.2 255.255.255.252

  IP 1400 MTU

  IP pim sparse - dense mode

  QoS before filing

  source of tunnel FastEthernet4

  destination yyy.yyy.yy.yyy tunnel

  Looks like a software defect. The closest I could find is Bug ID CSCed86842.

  http://www.Cisco.com/cgi-bin/support/Bugtool/onebug.pl?BugID=CSCed86842&SUBM

  I hope it helps.

  Kind regards

  Arul

• Easy VPN with the Tunnel Interface virtual IPSec dynamic

  Hi all

  I configured easy vpn remote on a cisco 1841 and dynamic server easy vpn with virtual tunnel interface on the server (cisco 7200, 12.4.15T14)

  http://www.Cisco.com/en/us/partner/prod/collateral/iosswrel/ps6537/ps6586/ps6635/prod_white_paper0900aecd803645b5.html

  It works with easy vpn remote to the client mode and mode network-extesión, but it doesn't seem to work when I configure mode plus network on the client of the cpe, or when I try to have TWO inside the ez crypto interfaces. On the customer's site, I see two associations of security, but on the server PE site only security SA!

  Without virtual dynamic tunnel interface, dynamic map configuration is ok... This is a limitation of the virtual tunnnel dynamic interface?

  Federica

  If one side is DVTI and the other uses a dynamic map, it does support only 1 SA. If the two end uses DVTI or the two end uses dynamic card then it supports several SAs.

  Here is the note of documentation for your reference:

  Note: Multiple inside interfaces are supported only when the Cisco Easy VPN server and the Cisco Easy VPN client have the same type of Easy VPN configuration. In other words, both must use a Legacy Easy VPN configuration, or both must use a DVTI configuration.
  
  

  Here's the URL:

  http://www.Cisco.com/en/us/docs/iOS/sec_secure_connectivity/configuration/guide/sec_easy_vpn_rem_ps6441_TSD_Products_Configuration_Guide_Chapter.html#wp1046365

  Hope that answers your question.

• Using the Tunnel interface on router

  Hello world

  I see hew Tunnel interface on the router.

  Router is running OSPF.

  However, there is no cryptographic statements.

  tunnel configuration

  Tunnel1 interface

  10.4.x.x from IP x.x.x.x

  time 7

  source of tunnel Loopback1

  destination 10.4.x.x tunnel

  My question is when we use the interface Tunnel without any cryptographic statements?

  Thank you

  MAhesh

  This Tunnel is a plain GRE Tunnel. They are generally used without crypto when:

  (1) traffic is not sent through an untrusted network and cryptographic protection is not necessary.
  (2) the GRE traffic gets encrypted on a separate device if the end point free WILL is not able to do the necessary cryptographic protection.

  Sent by Cisco Support technique iPad App

• Space and some letters does not also teredo tunneling interface and pseduo miniport adapter.

  My.title.Summed.it.up.space.and.certain.Letters.won't.Work.also.Teredo.tunneling.pseduo.interface.and.miniport.adapter.

  Please.Help

  The keyboard screen (Start - All Programs - Accessories - accessibility - on screen keyboard, type osk in Start - Runor Windows key + U) allows you to type with only a mouse. The keys work here?

  You can try the section diagnostic keys shortcut and modifier Key Release to https://skydrive.live.com/redir?resid=E2F0CE17A268A4FA! 121 & authkey =! AAFg7j814-lJtmI.

  Each of the three towers of programs, services, and drivers in increasing amounts. So restrict the possible culprits.

  Clean boot

  Click Start - all programs - Accessories - run and type

   

  msconfig
  

   

  Then go to the Startup tab uncheck everything. Then go to the Services tab check hide all Microsoft Services and uncheck everything that is left.

   

  Reset. If this resolves your wake problem ½ of services / of startup items until you find that one.

  
  Tip clean boot

  If the above does not help.

  Download Autoruns http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

  Start the program by right-clicking and choosing run as administrator and click on the menu Options - Filter Options and check hide Microsoft entries and disable include the empty slots. Uncheck the box just to the left.

  Reset. If this resolves your wake problem half of the items until you find the one that.

  Safe mode

  If the above does not help.

  Click Start - all programs - Accessories - run and type

   

  msconfig
  

   

  Go to the Startup tab, and then click Start. Reset. Come back here and uncheck the box secure start to return to normal mode.

• What is a Teredo Tunneling Interface Pseudso has a disk problem and can I fix it?

  My Windows 7 was freezing after I let it idle for a while. I have to do a hard reboot. Recently, I noticed that I had Dell support help agent and Dell update on my computer but I did not the it. They have been installed at the time my warranty missed. A forum said they had the same problem and the problem stopped after uninstalling them. It did for me too, for about two days but I'm back to freezing.

  Another forum says run diagnostics from the manufacturer. I did and I received two error messages. One was 0F00133C and the other was 0F001332 MAG DRIVE - request BIOCIC interrupt (IRO) has not indicated in time. At this point, the computer froze and wouldn't it be fun to just try again. Once again a forum said it was a sign of a dead hard drive.

  Just now under system and security of the Control Panel, I had Pseudso - Interface Teredo Runneling has a disk problem and hardware problem cannot have been detected.

  This computer can be solved without costing a fortune. They said I should also have other problems with a hard to die, but I did not. Would appreciate any help.

  Hello

  Thank you for giving us the opportunity to help you.

  I suggest you try the step provided by Nithyananda J replied on March 27, 2010 in the thread mentioned below. The steps helped a lot of people facing the issue with Teredo Tunneling Pseudso-Interface. Hope this will help you too.

  Teredo Tunneling Pseudo-Interface this device cannot start. (Code 10)

  Hope it would help. If problem persists always post back with the current state of your computer and the result of the proposed suggestion, we will be happy to help you.

  Kind regards

• Area-based-Firewall: card crypto / tunnel interface / area?

  Hello

  We use a router CISCO1921-SEC. On the side "WAN", we have 1 public IP assigned by DHCP address.

  At present, we use the WAN Interface with a crypto-map as endpoint of some IPSec connections. We have created a zone - fire-with area "WAN" and "LAN". In this configuration, all IPSec parameters are on a single Interface - connection to the 'LAN' box can be managed through rulesets. What about the connections between IPSec connections and the area "self."

  We would like to finish each IPSec connection in a separate area. Is this a good idea?

  How can this be configured?

  Each of them on a "inetface tunnel" with binding "tunnel source...". » ?

  Please give us a clue... Thank you!!

  Message geändert durch NISITNETC

  When the tunnels are completed on the router, which is the area free, by default, all traffic is allowed, if you want to restrict access, you must create a free zone and add a pair of WAN area to auto.

  Hope this link will help you,

  http://INKLING/?q=node/1305

• VPN tunnel interface causes

  Hello
  Can someone tell me various reasons/causes for the interface of VPN tunnel drops?

  Thahkyou
  Kind regards.
  Aateek singh

  Depends on your type of encapsulation. The most common:

  -GRE: source down, not routable destination, GRE KeepAlive interface has failed.

  -VTI: source interface down, not routable destination, security associations IPsec are not upward.

• ASA "route inside 0 0 192.168.1.1 by tunnel" interface ACL question

  Hello

  Small question around the road inside 0.0.0.0 0.0.0.0 192.168.1.2 in tunnel command.

  Do you need to add a u-turn traffic within the ACL interfaces (for example internet related http traffic) or 'same-security-traffic permit intra-interface' negates the need of this?

  So if my site remote vpn outside is 10.1.1.0/24 should I add entering permitted statements for the 10.1.1.0/24 inside my interface.

  Thank you

  same-security-traffic permit intra-interface allows then-input-output traffic on a single interface

  allowed incoming 10.1.1.0/24 statement in the list ACL allows traffic (output - then-) penetration on a single interface, but you must disable the RPF check

• Teredo tunneling interface properties psrudo

  My computer says that Teredo Tunneling pseudo interface properties is not running.  How can I do and is it really necessary?

  CP

  It is only necessary if you have a printer that uses the Protocol.  This is an IPv4 > IPv6 tunnel and most systems can do without him.

• Diagnostic says teredo tunneling pseudp report - interface. . Failed to start

  Original title: Please help

  I did said diagnosis report with my norton.it my pseudp teredo tunnel - interface. . cannot start (code 10) who do solve this problem?

  Hello

  Don't you worry about this unless you have found errors. If so see these threads.

  http://social.answers.Microsoft.com/forums/en/w7network/thread/754c8f29-3a87-4E77-Babd-a69c8910e17e

  http://social.answers.Microsoft.com/forums/en-us/w7hardware/thread/05a8849e-89c1-4CC9-8004-f6d07a4fdf8b

  http://www.cableforum.co.UK/Board/34932105-post6.html

  ====================================

  A new Microsoft 6to4 map is created unexpectedly after restarting Windows 7 or Windows
  Server 2008 R2
  http://support.Microsoft.com/kb/980486

  How to disable certain Internet Protocol version 6 (IPv6) components in Windows Vista, Windows 7
  and Windows Server 2008
  http://support.Microsoft.com/kb/929852/en-us

  Response of Lionel Chen
  http://social.technet.Microsoft.com/forums/en-us/itprovistahardware/thread/3a503cdb-e61c-44BC-97c4-0b38b0e5f929/

  I hope this helps.

  Rob Brown - Microsoft MVP<- profile="" -="" windows="" expert="" -="" consumer="" :="" bicycle="" -="" mark="" twain="" said="" it="">

• An interface of multipoint GRE tunnel on two physical interfaces?

  Hi all

  I use DMVPN double single cloud VPN network of hubs.

  Our shelves (C831 SRI) are connected to the dynamic DHCP ISP and dynamic PPPoE ISP.  I want to install a temporary kit that fits anywhere.  Here is the configuration of my my ISP PPPoE tunnel:

  interface Tunnel0
  bandwidth 1000
  IP 172.23.2.254 255.255.252.0
  no ip redirection
  IP mtu 1436
  property intellectual PNDH authentication xxxxxx
  map of PNDH 172.16.0.1 IP 230.2.2.1

  map of PNDH IP multicast 230.2.2.1
  map of PNDH 172.16.0.2 IP 230.2.2.2
  map of PNDH IP multicast 230.2.2.1
  PNDH id network IP-900001
  property intellectual PNDH holdtime 300
  property intellectual PNDH nhs 172.16.0.1
  property intellectual PNDH nhs 172.16.0.2
  delay of 1000
  source of Dialer1 tunnel
  multipoint gre tunnel mode
  tunnel key xxxxxx
  Tunnel MyIPSecProf ipsec protection profile

  For my ISP DHCP, I only change the Ethernet1 tunnel source.

  Is it possible to configure tunnel interfaces different related 2 on 2 physical interfaces (like: 1 Ethernet1 and 1 in Dialer1).  The challenge is that I can not change the configuration of hubs at all.  So I can't put the ip address of the tunnel in 2 different subnet.  There is only 1 tunnel on the hub interface

  Someone has an idea?

  Thank you very much

  Yes, I see it now. Unnumbered IP will provide the interface to the MTR and tunnel interface you have is point-to-multipoint. I'm afraid that there is no good solution to your needs.

  Kind regards

  Lei Tian

• How a GRE tunnel is applied to a physical interface?

  Within the tunnel configuration, we use the controls, the source and destination for the tunnel, but the physical interface does he know how to use the tunnel? The source code of the tunnel parameters replace the physical interface? If we don't configure a tunnel with the right source this interface would then send all information encapsulated in the GRE?

  If we also configure IPSec on the interface, and specify a card encryption to encrypt only the corresponding traffic this corresponding traffic would not use the GREtunnel or information without worrying if it was encrypted IPSec is also be encapsulated in the GRE?

  Also, I read here: https://supportforums.cisco.com/docs/DOC-3067

  'Bind the card crypto to Physics (outside) interface if you are using the version of Cisco IOS 12.2.15 software or later. If not, then the card encryption should be applied to the tunnel as well as the physical interface interface. »

  Why was it necessary to apply the crypto map to both physical and tunnel interfaces, and why is it not necessary with versions of IOS?

  Thanks for any help!  -Mark

  Hi Mark,

  When you set the source of the tunnel in the tunnel interface, the router adds the IP address of the specific interface (loopback or physical) to the GRE packet generated by the tunnel interface.

  This is useful when you need to deliver a tunnel through the Internet WILL, but the tunnel interface has an IP of priivate, if you use the interface external (with a public IP address) as the source of the tunnel.

  When remote endpoint WILL receive the packet, search interface tunnel there as destination of the tunnel and decaps the packets, and then he gets the GRE packet and forwards it to the specific tunnel interface.

  Since 12.4 you simply apply the crypto map to the interface defined as the' tunnel', usually the one connected to the Internet, where all VPN tunnels are landed. The reason for this is the endpoint VPN termination being the physical and not the tunnel interface interface.

  The reason why you need to add the encryption card for both is not clear for me, since I did not support older versions of code.

  Do not forget that when configuring a GRE/IPsec tunnel in ACL Cryptography you set the source and tunnel destination IPs.

  Hoping to help.

  Portu.

  Please note all useful posts

  Post edited by: Javier Portuguez

• With regard to Taredo tunnel

  Yes, I called my network provider, Time Warner Cable and the tech said that they are constantly changing IP address in constand mode.  My linksys router which is connected to the cable Modem Time Warner is the material which is assigned the 192... IP xxx.  I have no problems connecting to the internet.  It's my security system Norton that I check every day which appear in the historical section of the IP address of 169.xxxxx as a pseudo WARNING tunneling interface.  Time Warner said that as you responded to me that Windows problems the 169... XXXX IP address when comes into conflict with the IP address of the router.

  Everything goes well without any problems of internet connection.  Thanks for your reply.

  Everything goes well without any problems of internet connection.  Thanks for your reply.

  Do not worry.  Be happy.

  You'd be happier if you dumped your Norton Security software.  (If you do, be sure to use the Norton removal tool).

  You can stop reading here, but if you want more details, read on.

  Your ISP - Time Warner - properly explained that it assigns you a "dynamic" IP address  This means that the IP address can change from session to session (assigned external IP address will always remain the same until you disconnect from your ISP).

  Because you are using a router, however, you can never see the IP address Time Warner assigned to you unless you have to look at the page 'Status' of the utility of configuration of the Linksys router or (b) go to a Web site such as http://www.whatismyip.com/

  I guess it's possible that Norton can access this address and report it, but for most people that would be superfluous.  Unless you're running a web server or otherwise need to know how to reach your computer over the Internet (for example, to access your computer at home during a trip) there is no need to know your external IP address.

  If you open a command prompt window (start > run > cmd > OK) and type
  ipconfig/all
  You can see - among others - the local IP address that is assigned to your computer by your Linksys router.  The output will look much like this:

  Ethernet connection to the Local network card:

  The connection-specific DNS suffix. :
  ... Description: Intel(r) PRO/100 Network Connection
  Physical address.... : 00-07-E9-ED-0C-47
  DHCP active...: Yes
  Autoconfiguration enabled...: Yes
  ... The IP address: 192.168.1.100
  ... Subnet mask: 255.255.255.0.
  ... Default gateway. : 192.168.1.1.
  DHCP server...: 192.168.1.1.
  DNS servers...: 4.2.2.3.
  205.171.3.65
  Lease obtained...: Wednesday, December 14, 2011 17:26:06
  End of the lease...: Thursday, December 15, 2011 17:26:06

  If you see an IP between 169.254.0.1 and 169.254.255.254, which is called a (APIPA) automatic private IP address and is assigned by Windows for the network card in your computer when the NETWORK adapter is configured to obtain an IP address automatically (default) and (b) the NETWORK card fails to reach the server DHCP (usually in your router) which is supposed to automatically assign this address.  It is almost always an indication of password bad wireless encryption.  This has nothing to do with a conflict with the IP address of the router.

  If you see something on 'Teredo Tunneling Interface' you are most likely using Vista or Windows 7 rather than XP, but what version of Windows you have, the "Teredo Tunneling" Interface relates to IPv6 and you don't need and almost certainly not using it.  What follows is not my mother tongue, but it is accurate:

  To make a long story short, this means that you have IPv6 is installed as part of your network components. Check the following;

  Go to control panel and double-click on network connections. Right-click on the icon for your connection to the Local network and select properties from the menu.

  On the general page of the property sheet, there is a box which should contain an entry for Microsoft TCP/IP version 6.

  I won't bore you with the details, but the main thing is that most people have no need at the moment for IPv6. That said, it will not cause problems if leave you it installed on your computer. That said, uninstall IPv6 will not cause you to lose your internet connection. The entry see you for the Internet (TCP/IP) protocol is important.

  If you are curious about IPv6, here is a website with more information.

  IPv6 for Microsoft Windows: frequently asked Questions http://www.microsoft.com/technet/network/ipv6/ipv6faq.mspx

• FlexVPN and QoS on tunnels

  There is a simple topology: a hub and spoke. FlexVPN is woking together with psk, BGP, and no RADIUS.

  Now I want QoS on the hub and the spokes. The Center has an ISP connection, let's say 100 MB and some rays have 10 MB, some 5 MB and so on.

  Each ray has a tunnel interface and a virtual-template interface. I can apply "service-policy output" on these interfaces, no problem. (Should I apply "service-policy output" on the tunnel or on the interface virtual-template interface or both of them, I'm still not sure, but this isn't a big problem)

  What should I do with the hub that does that one tunnel interface and a virtual for all model the rays?

  If I had 100 spokes hub would still have only a single tunnel interface and a virtual model for all the rays. The hub also has virtual-access interfaces for each Department, they sort of dynamics, I do not create them, they appear by themselves and I am not able to configure. When I try to configure the Cisco says: % Please use virtual model to configure your virtual access.

  Where and how I can apply 'service-policy output' on the hub so I want unique QoS for each Department?

  Given that you use no RADIUS, you can apply config dynamically with AAA attribute lists.

  I described the similar config (including a very basic policy) in this document http://www.cisco.com/c/en/us/support/docs/security/flexvpn/116032-flexvp...

  To answer your questions, you always apply the config to go through the model.

  (In this case) Attributes are added to the don't go to STM, you use VT as a basis for what you need, followed by additional dynamic attributes for SAV.

  For interfaces tunnel (on the shelves), it is quite easy to enable QoS, but what you could look on the wall policy on the physical interface and not the tunnel interface (do not forget that the DSCP values are copied on to external header). After all, you want to manage the bandwidth to ISP not to cloud VPN, most of the time.