Creation GRE tunnel - Revision history

Yousra: /* Alternative Design */

2026-02-17T18:24:50Z

Alternative Design

← Older revision		Revision as of 18:24, 17 February 2026
Line 61:		Line 61:
	We will then create a GRE tunnel between router-002 and router-003 to test the creation of a GRE tunnel with IPsec.		We will then create a GRE tunnel between router-002 and router-003 to test the creation of a GRE tunnel with IPsec.

	~~And if everything goes well~~, we ~~can automate the configurations with Salt and deploy~~ the ~~code to Windriver~~ and ~~the two routers~~.		The recursion issue will be temporarily set aside and revisited later, once we are confident that the overall configuration is stable and working as expected.

			And if everything goes well, we can automate the configurations with Salt and deploy the code to windriver and the two routers.



	Linked to {{T\|2201}}		Linked to {{T\|2201}}

2026-02-17T18:20:30Z

Recommandations

← Older revision		Revision as of 18:20, 17 February 2026
Line 52:		Line 52:

	== Recommandations ==		== Recommandations ==

	* Do not create GRE-over-GRE in the current infrastructure to avoid recursions.

	* Changes the network is ok while having access to KVM : always have KVM prepared and the VM itself to prevent any long server routage.		* Changes the network is ok while having access to KVM : always have KVM prepared and the VM itself to prevent any long server routage.

2026-02-17T18:19:21Z

← Older revision		Revision as of 18:19, 17 February 2026
Line 59:		Line 59:
	*if restart is needed, always restart natif along with the routing table with one command using "&&"		*if restart is needed, always restart natif along with the routing table with one command using "&&"

	== ~~Sollution~~ ==		== Alternative Design ==

			We will then create a GRE tunnel between router-002 and router-003 to test the creation of a GRE tunnel with IPsec.

			And if everything goes well, we can automate the configurations with Salt and deploy the code to Windriver and the two routers.




	Linked to {{T\|2201}}		Linked to {{T\|2201}}

2026-02-17T14:41:58Z

2026-02-17T14:20:50Z

← Older revision		Revision as of 14:20, 17 February 2026
Line 60:		Line 60:

	== Sollution ==		== Sollution ==

	~~We will make a GRE tunnel between router-002 and router-003~~

	~~The question now is whether this approach will be efficient for the IPsec configuration we plan to implement. It seems suitable for CARP, but what about IPsec?~~

2026-02-17T13:37:16Z

← Older revision		Revision as of 13:37, 17 February 2026
Line 58:		Line 58:

	*if restart is needed, always restart natif along with the routing table with one command using "&&"		*if restart is needed, always restart natif along with the routing table with one command using "&&"

			== Sollution ==

			We will make a GRE tunnel between router-002 and router-003

			The question now is whether this approach will be efficient for the IPsec configuration we plan to implement. It seems suitable for CARP, but what about IPsec?

2026-02-17T13:29:18Z

Recommandations

← Older revision		Revision as of 13:29, 17 February 2026
Line 53:		Line 53:
	== Recommandations ==		== Recommandations ==

	*~~avoid stacking~~ GRE ~~tunnels on top of existing ones,~~ to avoid ~~overcomplicating the configuration~~.		* Do not create GRE-over-GRE in the current infrastructure to avoid recursions.
	*~~test changes~~ while having access to KVM.
			* Changes the network is ok while having access to KVM : always have KVM prepared and the VM itself to prevent any long server routage.

	*if restart is needed, always restart natif along with the routing table with one command using "&&"		*if restart is needed, always restart natif along with the routing table with one command using "&&"

2026-02-17T13:24:37Z

Incidents

← Older revision		Revision as of 13:24, 17 February 2026
Line 22:		Line 22:
	* Accessed the server via KVM to restore the routing table.		* Accessed the server via KVM to restore the routing table.
	* Performed a controlled network interface restart.		* Performed a controlled network interface restart.
	* Established a rule: do not create GRE-over-GRE in the current infrastructure to avoid recursion and routages, if mandatory, always have KVM prepared and the VM itself to prevent any long server outage.

	Technical analysis:
			'''Okey but, how about the link between router-001 and windriver that was broken ?'''

			Technical analysis on windriver:

	dmesg showed the following error:		dmesg showed the following error:
Line 30:		Line 32:
	this error comes from the FreeBSD kernel file sys/net/if.c, in the function if_tunnel_check_nesting().		this error comes from the FreeBSD kernel file sys/net/if.c, in the function if_tunnel_check_nesting().

	* The problem is that the traffic from the new tunnel was used to pass through the existing tunnel ==> loop

	~~Where the loop happens ?~~

	Step by step:		Step by step:

2026-02-17T13:11:01Z

Incidents

← Older revision		Revision as of 13:11, 17 February 2026
Line 17:		Line 17:
	As a result, the server windriver did not restart properly, and network services were unavailable.		As a result, the server windriver did not restart properly, and network services were unavailable.

	~~Access via KVM was required to correct the routing table directly on the remote machine.~~

	Actions taken:		Actions taken:

2026-02-17T13:09:03Z

Incidents

← Older revision		Revision as of 13:09, 17 February 2026
Line 12:		Line 12:
	What happened:		What happened:

	* Creating a GRE tunnel on top of an existing GRE tunnel caused a cut connection between router-001 and windriver and direct access to the router was unavailable,		* Creating a GRE tunnel on top of an existing GRE tunnel caused a cut connection between router-001 and windriver, and direct access to the router was unavailable,
	* The network interface (natif) in windriver was restarted without restoring the routing table.		* The network interface (natif) in windriver was restarted without restoring the routing table.