topic Re: Tunnel option missing from IP Route command in ICX Switches

Tunnel option missing from IP Route command

gmoneyup1 — Sat, 17 Sep 2022 10:02:42 GMT

Am I missing something?

ICX-7450 with the IPSEC service module, running 08.0.90f Router Code

I am relatively new to Ruckus and the prior team deployed IPSEC tunnels across untrusted spaces. While setting up a new location I am able to establish an IPSEC tunnel with a remote end.

The issues is when I type: "ip route" ,I am missing the "tunnel" option to route traffic through the tunnel interface. One thing I can think of is that I configured all the IPSEC information before realizing the IPSEC module was missing from the device, but not sure if this is the issues. Looking through documentation the tunnel id is part of the ip route command... thanks for the help

Re: Tunnel option missing from IP Route command

BenBeck — Mon, 19 Sep 2022 13:28:36 GMT

Hey @gmoneyup1,

It's hard to say what is happening there. I would advise rolling through the IPsec section in the security guide to make sure everything is configured properly:

https://docs.commscope.com/bundle/fastiron-08090-securityguide/page/GUID-4F5A516C-BB0B-49BE-A5F3-3FECF8B6C40D.html

If you are still having issues, please open a support case (see my signature) and someone from our support team can help.

Re: Tunnel option missing from IP Route command

BenBeck — Mon, 19 Sep 2022 13:31:58 GMT

Also, 'show module' should tell you the status of the module itself. I would recommend rebooting the ICX either way if you installed the module while it was running.

Re: Tunnel option missing from IP Route command

gmoneyup1 — Tue, 20 Sep 2022 11:12:29 GMT

Thanks for the reply BenBeck, the strange thing is that if I do show Ike sa, I see the tunnel is active and up. I have restarted the switch a couple times post configuration. This is the sequence for the configuration:

1. Configured the switch for L3 routing with appropriate interfaces

2. configured IPSec tunnel information

3. attempted to route traffic through the tunnel interface, that's when we discovered the "tunnel" option was missing from the "ip route" command.

4. further investigation revealed the IPSec service module was not in the ICX

5. While the switch was up we inserted the service module, we were prompted to reboot the ICX

6. Rebooted the ICX, the Tunnel was active and however the Tunnel option is still missing from the "ip route" command

Re: Tunnel option missing from IP Route command

BenBeck — Tue, 20 Sep 2022 13:06:33 GMT

Interesting. I am not sure what is happening here. Please open a support case so we can properly investigate.

Re: Tunnel option missing from IP Route command

rick_macchio_5d — Tue, 20 Sep 2022 13:16:14 GMT

Is everything in the default-vrf or are you dealing with different vrfs?

Typically, the tunnel interface would be part of an internal vrf (if using multiple vrfs). If your context is the default-vrf for the route, the tunnel interface would not be visible as a next hop option.

If everything is part of the default-vrf, you'll have to keep in mind limitations related to using the same routing protocol (e.g., OSPF) on both the inside and the outside of the tunnel.

Re: Tunnel option missing from IP Route command

gmoneyup1 — Thu, 22 Sep 2022 08:36:43 GMT

BenBeck, I finally figured it out, it looks as if the L3 license was never installed on the device (SMH)... this is a lesson well earned.

Re: Tunnel option missing from IP Route command

va10461 — Mon, 16 Oct 2023 03:03:39 GMT

Hi @gmoneyup1,

Can you chck if configuration is correct as per config guide

IPsec Tunnel config as per config guide.

https://docs.commscope.com/bundle/fastiron-08090-securityguide/page/GUID-8585AB78-DE11-4D2C-9DD4-BC6444B32448.html

Router1

Router1(config)# ipsec profile profA
Router1(config-ipsec-profile-profA)# exit

Router1(config)# Interface tunnel 20
Router1(config-tnif-20)# tunnel mode ipsec ipv4
Router1(config-tnif-20)# tunnel protection ipsec profile profA
Router1(config-tnif-20)# tunnel source 10.1.1.1
Router1(config-tnif-20)# tunnel destination 10.1.1.2
Router1(config-tnif-20)# ip address 10.0.0.1 255.255.255.0
Router1(config-tnif-20)# exit

Router2

Router2(config)# ipsec profile profA
Router2(config-ipsec-profile-profA)# exit

Router2(config)# Interface tunnel 20
Router2(config-tnif-20)# tunnel mode ipsec ipv4
Router2(config-tnif-20)# tunnel protection ipsec profile profA
Router2(config-tnif-20)# tunnel source 10.1.1.2
Router2(config-tnif-20)# tunnel destination 10.1.1.1
Router2(config-tnif-20)# ip address 10.0.0.2 255.255.255.0
Router2(config-tnif-20)# exit