本產品的文件集力求使用無偏見用語。針對本文件集的目的,無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言,或引用第三方產品的語言,因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。
思科已使用電腦和人工技術翻譯本文件,讓全世界的使用者能夠以自己的語言理解支援內容。請注意,即使是最佳機器翻譯,也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責,並建議一律查看原始英文文件(提供連結)。
本文檔介紹在配置或檢查與SD-WAN動態按需隧道相關問題時可以使用的故障排除命令。
本檔案是根據以下組態參考、軟體和硬體版本撰寫的:
本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除(預設)的組態來啟動。如果您的網路運作中,請確保您瞭解任何指令可能造成的影響。
註:有關動態按需隧道配置,請參閱本文檔。
Cisco SD-WAN支援任意兩個Cisco SD-WAN分支裝置之間的動態按需隧道。僅當兩台裝置之間存在流量最佳化頻寬使用和裝置效能時,才會觸發這些隧道的設定。
在正常運行方案中,按需隧道觸發條件包括:
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 2:13:14:35 6
Spoke 1#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes inactive -
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 C,I,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 I,U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 I,U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 I,U,IA installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 U,IA installed 10.10.10.2 private2 ipsec - None None -
Spoke 2#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.2 10.100.100.1 12366 ipsec 7 1000 0:11:10:01 1
Spoke 2#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
1 10.10.10.1 yes inactive -
Spoke 1#ping vrf 10 10.2.2.2 re 20
Type escape sequence to abort.
Sending 20, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (20/20), round-trip min/avg/max = 1/3/31 ms
Spoke 1#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes active 56
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 0:11:14:51 1
10.10.10.2 2 up default default 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:00:53 1----> BFD session established due of interest traffic and on-demand configuration
10.10.10.2 2 up blue blue 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:00:52 1
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 C,I,R installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 C,I,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 C,I,R installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 C,R installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 C,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 C,R installed 10.10.10.2 private2 ipsec - None None -
Spoke 2#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
1 10.10.10.1 yes active 53
Spoke 2#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.2 10.100.100.1 12366 ipsec 7 1000 0:11:14:56 1
10.10.10.1 2 up default default 10.10.10.2 10.11.11.1 12366 ipsec 7 1000 0:00:00:53 1----> BFD session established due of interest traffic and on-demand configuration
10.10.10.1 2 up blue blue 10.10.10.2 10.11.11.1 12366 ipsec 7 1000 0:00:00:52
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 0:11:19:11 1
Spoke 1#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes inactive -
Spoke 2#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.2 10.100.100.1 12366 ipsec 7 1000 0:11:19:11 1
Spoke 2#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
1 10.10.10.1 yes inactive -
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 U,IA installed 10.10.10.2 private1ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 U,IA installed 10.10.10.2 private2ipsec - None None -
192.168.0.2 71 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 U,IA installed 10.10.10.2 private1ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 U,IA installed 10.10.10.2 private2ipsec - None None -
Hub#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR. SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.2 2 up blue blue 10.10.10.100 10.12.12.2 12366 ipsec 7 1000 1:23:58:15 2
10.10.10.1 1 up default default 10.10.10.100 10.11.11.1 12366 ipsec 7 1000 1:23:59:12 6
Spoke 1#show sdwan system on-demand
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-CFG(min)
-------------------------------------------------------------------------
1 10.10.10.1 yes active 10
Spoke 2#show sdwan system on-demand
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-CFG(min)
-------------------------------------------------------------------------
2 10.10.10.2 yes active 10
hub#show sdwan run | inc TE
!
hub#config-trans
hub(config)# sdwan
hub(config-vrf-global)# service TE vrf global
hub(config-vrf-global)# commit
Before interest traffic
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 C,I,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 I,U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 I,U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 I,U,IA installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 U,IA installed 10.10.10.2 private2 ipsec - None None -
While interest traffic
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 C,I,R installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 C,I,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 C,I,R installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 C,R installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 C,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 C,R installed 10.10.10.2 private2 ipsec - None None -
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 1:23:58:15 2
10.10.10.2 2 up default default 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:01:50 2----> BFD session established due of on-demand tunnel configuration.
10.10.10.2 2 up blue blue 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:01:52 2
Spoke 1#show sdwan system on-demand remote-system system-ip 10.10.10.2
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes active 41 ------>on-demand tunnel established to spoke 2 10.10.10.2 due of interest traffic
Spoke 1#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 no - -
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 1:23:58:15 3
10.10.10.2 2 up default default 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:18:53 4
10.10.10.2 2 up blue blue 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:18:52 3
Spoke 1#show sdwan omp route vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 73 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 74 1003 C,I,R installed 10.10.10.2 default ipsec - None None -
192.168.0.1 76 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 77 1003 C,I,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 79 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 80 1003 C,I,R installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 89 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 90 1003 C,R installed 10.10.10.2 default ipsec - None None -
192.168.0.2 92 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 93 1003 C,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 95 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 96 1003 C,R installed 10.10.10.2 private2 ipsec - None None -
viptela-policy:policy control-policy ondemand sequence 1 match route site-list Spokes prefix-list _AnyIpv4PrefixList ! action accept set tloc-action backup tloc-list hub ! ! ! default-action accept ! lists site-list Spokes site-id 1-2 ! tloc-list hub tloc 10.10.10.100 color blue encap ipsec tloc 10.10.10.100 color default encap ipsec tloc 10.10.10.100 color private1 encap ipsec tloc 10.10.10.100 color private2 encap ipsec ! prefix-list _AnyIpv4PrefixList ip-prefix 0.0.0.0/0 le 32 ! ! ! apply-policy site-list Spokes control-policy ondemand out ! !
Spoke 1#show sdwan run | inc on-demand
on-demand enable
on-demand idle-timeout 10
Spoke 2#show sdwan run | inc on-demand
Spoke 2#
Hub#show sdwan run | inc TE
service TE vrf global
Spoke 2#config-trans
Spoke 2(config)# system
Spoke 2(config-vrf-global)# on-demand enable
Spoke 2(config-vrf-global)# on-demand idle-timeout 10
Spoke 2(config-vrf-global)# commit
Spoke 1#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes inactive -
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 C,I,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 I,U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 I,U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 I,U,IA installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 U,IA installed 10.10.10.2 private2 ipsec - None None -
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 C,I,R installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 C,I,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 C,I,R installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 C,R installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 C,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 C,R installed 10.10.10.2 private2 ipsec - None None -
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 2:04:34:11 2
10.10.10.2 2 up default default 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:02:10 2----> BFD session established due of on-demand tunnel configuration.
10.10.10.2 2 up blue blue 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:02:08 2
Spoke 1#show sdwan system on-demand remote-system system-ip 10.10.10.2
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes active 41 ------>on-demand tunnel established to Spoke 2 10.10.10.2 due of interest traffic
Spoke 1#show sdwan omp route vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 108 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.1 113 1003 U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 141 1003 U,IA installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 112 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.2 117 1003 U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 144 1003 U,IA installed 10.10.10.2 private2 ipsec - None None -
Spoke 1#show sdwan run | inc on-demand
on-demand enable
on-demand idle-timeout 10
Spoke 2#show sdwan run | inc on-demand
on-demand enable
on-demand idle-timeout 10
Hub#show sdwan run | inc TE
service TE vrf global
viptela-policy:policy control-policy ondemand sequence 1 match route site-list Spokes prefix-list _AnyIpv4PrefixList ! action accept set tloc-action backup tloc-list hub ! ! ! default-action accept ! lists site-list Spokes site-id 1 ! tloc-list hub tloc 10.10.10.100 color blue encap ipsec tloc 10.10.10.100 color default encap ipsec tloc 10.10.10.100 color private1 encap ipsec tloc 10.10.10.100 color private2 encap ipsec ! prefix-list _AnyIpv4PrefixList ip-prefix 0.0.0.0/0 le 32 ! ! ! apply-policy site-list Spokes control-policy ondemand out !
Spokes site list from policy before
lists
site-list Spokes
site-id 1
!
Spokes site list from policy after
lists
site-list Spokes
site-id 1-2
!
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 C,I,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 I,U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 I,U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 I,U,IA installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 U,IA installed 10.10.10.2 private2 ipsec - None None -
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 2:07:01:43 6
10.10.10.2 2 up default default 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:00:56 2----> BFD session established due of on-demand tunnel configuration.
10.10.10.2 2 up blue blue 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:00:56 2
Spoke 1#show sdwan system on-demand remote-system system-ip 10.10.10.2
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes active 56 ------>on-demand tunnel established to Spoke 2 10.10.10.2 due of interest traffic
修訂 | 發佈日期 | 意見 |
---|---|---|
1.0 |
05-Oct-2023 |
初始版本 |