I Can't ping two sides of GRE tunnel

[ditleporc]

I'm using 2 cisco 2621 B-) with one eth on my corporate lan (private adressing shema) and the other on the internet. The two routers can see each other perfectly. I created a GRE tunnel between the two router to have a virtual leased line between my two sites. I follow an exemple on the cisco site, it works! BUT, there is a big but, each lan on the two side can "see" the other execpt the router itself !
From one router i can't ping any of the remote ip adresse %-( exept the one on the internet. In the exemple (on the cisco.com site) they tell to ping the remote side of the tunnel, for them it works, not for me...

My network works well, my link is OK, my users are happy but i can't manage the remote router (execpt by the net)

HELP! >:O>

interface Tunnel1
ip address 10.1.1.1 255.255.255.252
ip mtu 1440
tunnel source FastEthernet0/1
tunnel destination 206.158.168.38
crypto map GRE

simple like cisco exemple.>:O>

 

[jeter]

type in ( show interfaces tunnel 0 )the make sure of your
source and destination. It would also appear that
you need to setup a ( ip route ) to configure traffic from the remote office network through the tunnel.
Jeter@LasVegas.com
J.Fisher CCNA

 

[ditleporc]

Thank you for your help, the traffic is routed normaly, it's just i can't ping the remote interface of the tunnel.
The route is Local (10.1.1.0/30 10.1.1.1 and 10.1.1.2 only).

 

[sobak]

I am assuming that you want to ping the 10.1.1.1 tunnel interface? If this is correct, have you looked at your IP Routes (sho ip route)? Does the ip network address of the interface you are attempting to connect to show in the table? If not it may be a routing issue in that the router does not know what network the GRE tunnel is sitting on. I have five tunnels configured and ran into the same problem and didn't know where to start. In the process of my network updates I enabled EIGRP and noticed the network for my GRE tunnels was being replicated out. Once the routers had knowledge of the GRE network addresses I could ping all interfaces.

If this is not the issue, check out your ACL's if you are running them. At the end of your ACL list type in

deny ip any any log

Although all ACL's imply this it will allow you to log traffic that has been denied. This will allow you to open up the correct IP Addresses through the ACL's. I use this a lot as well.

Don't know if any of this applies to your case, just items I ran across when I was setting up my tunnels....

david e
*end users are just like computers, some you can work with...others just need a simple reBOOTing to fix their problems.*

 

[pmkincaid]

What exactly are you trying to ping and from where?

If you are trying to ping the remote router's physical interface from the LAN, you are not going to be able to - the tunnel will prevent you from pinging that.

But you should be able to ping the tunnel interface (10.1.1.1 or 10.1.1.2 in your case I believe).

One way around this - if you are wanting to configure the remote router from your desktop - telnet/ssh into the local router, then telnet/ssh into the remote router from your local router. This is probably the only way to do it if the tunnel goes down.

Hope this helps,
Paul

 

[ditleporc]

Hello All,

I think it's not a routing issue, I use OSPF and 10.1.1.0/30 is known on all my routers.
I perfectly ping the physical adresses on the internet Eth0/0 on each side.
I can't do what i you should do :"be able to ping the tunnel interfaces", I ping only the local one from any IP of this side of the network including the router, but not the remote.
May be it's related to ARP, there no entry for the "sho arp tunnel0", do you think it's usefull to setup manualy a mac address on both sides ?