nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Tunnel option missing from IP Route command

gmoneyup1

Am I missing something?

ICX-7450 with the IPSEC service module, running 08.0.90f Router Code

I am relatively new to Ruckus and the prior team deployed IPSEC tunnels across untrusted spaces. While setting up a new location I am able to establish an IPSEC tunnel with a remote end.

The issues is when I type: "ip route" ,I am missing the "tunnel" option to route traffic through the tunnel interface. One thing I can think of is that I configured all the IPSEC information before realizing the IPSEC module was missing from the device, but not sure if this is the issues. Looking through documentation the tunnel id is part of the ip route command... thanks for the help

Find more posts tagged with

Accepted answers

gmoneyup1

BenBeck, I finally figured it out, it looks as if the L3 license was never installed on the device (SMH)... this is a lesson well earned.

All comments

BenBeck

Hey @gmoneyup1,

It's hard to say what is happening there. I would advise rolling through the IPsec section in the security guide to make sure everything is configured properly:

https://docs.commscope.com/bundle/fastiron-08090-securityguide/page/GUID-4F5A516C-BB0B-49BE-A5F3-3FECF8B6C40D.html

If you are still having issues, please open a support case (see my signature) and someone from our support team can help.

BenBeck

Also, 'show module' should tell you the status of the module itself. I would recommend rebooting the ICX either way if you installed the module while it was running.

gmoneyup1

Thanks for the reply BenBeck, the strange thing is that if I do show Ike sa, I see the tunnel is active and up. I have restarted the switch a couple times post configuration. This is the sequence for the configuration:

1. Configured the switch for L3 routing with appropriate interfaces

2. configured IPSec tunnel information

3. attempted to route traffic through the tunnel interface, that's when we discovered the "tunnel" option was missing from the "ip route" command.

4. further investigation revealed the IPSec service module was not in the ICX

5. While the switch was up we inserted the service module, we were prompted to reboot the ICX

6. Rebooted the ICX, the Tunnel was active and however the Tunnel option is still missing from the "ip route" command

BenBeck

Interesting. I am not sure what is happening here. Please open a support case so we can properly investigate.

rick_macchio_5d

Is everything in the default-vrf or are you dealing with different vrfs?

Typically, the tunnel interface would be part of an internal vrf (if using multiple vrfs). If your context is the default-vrf for the route, the tunnel interface would not be visible as a next hop option.

If everything is part of the default-vrf, you'll have to keep in mind limitations related to using the same routing protocol (e.g., OSPF) on both the inside and the outside of the tunnel.

va10461

Hi @gmoneyup1,

Can you chck if configuration is correct as per config guide

IPsec Tunnel config as per config guide.

https://docs.commscope.com/bundle/fastiron-08090-securityguide/page/GUID-8585AB78-DE11-4D2C-9DD4-BC6444B32448.html

Router1

Router1(config)# ipsec profile profA
Router1(config-ipsec-profile-profA)# exit

Router1(config)# Interface tunnel 20
Router1(config-tnif-20)# tunnel mode ipsec ipv4
Router1(config-tnif-20)# tunnel protection ipsec profile profA
Router1(config-tnif-20)# tunnel source 10.1.1.1
Router1(config-tnif-20)# tunnel destination 10.1.1.2
Router1(config-tnif-20)# ip address 10.0.0.1 255.255.255.0
Router1(config-tnif-20)# exit

Router2

Router2(config)# ipsec profile profA
Router2(config-ipsec-profile-profA)# exit

Router2(config)# Interface tunnel 20
Router2(config-tnif-20)# tunnel mode ipsec ipv4
Router2(config-tnif-20)# tunnel protection ipsec profile profA
Router2(config-tnif-20)# tunnel source 10.1.1.2
Router2(config-tnif-20)# tunnel destination 10.1.1.1
Router2(config-tnif-20)# ip address 10.0.0.2 255.255.255.0
Router2(config-tnif-20)# exit