Octet

What is recursive routing on a GRE tunnel, and how do you prevent it?

Show the answer

Say this first

It happens when the router learns the route to the tunnel destination through the tunnel itself, usually because a routing protocol running over the tunnel advertises the WAN subnets. To send a GRE packet the router routes the outer header, finds the tunnel again, and would encapsulate forever. IOS detects it, logs %TUN-5-RECURSIVEROUTING and takes the tunnel down; the routing protocol drops, the route disappears, the tunnel comes back, and it flaps. The fix: never advertise the underlay into the overlay, pin the tunnel destination with a static host route, or put the underlay in a front-door VRF.

Go deeper

Why metrics do not save you

The tunnel destination 203.0.113.2 is normally reached by a static default route. If OSPF over the tunnel advertises 203.0.113.0/30, that /30 beats the /0 by longest prefix match, whatever the administrative distance or cost.

Prevention

  • Advertise only LAN and tunnel subnets: precise network statements or ip ospf 1 area 0 per interface, never network 0.0.0.0 255.255.255.255 area 0.
  • Add a /32 static route to the tunnel destination via the ISP next hop. A /32 always wins.
  • Use a front-door VRF so the outer lookup happens in a separate table:
    Cisco IOS
    vrf definition INTERNET
 address-family ipv4
 exit-address-family
interface GigabitEthernet0/0/0
 vrf forwarding INTERNET
 ip address 198.51.100.1 255.255.255.252
ip route vrf INTERNET 0.0.0.0 0.0.0.0 198.51.100.2
interface Tunnel0
 tunnel source GigabitEthernet0/0/0
 tunnel destination 203.0.113.2
 tunnel vrf INTERNET

A quieter variant

Learning a default route over the tunnel that replaces the default the tunnel destination depended on causes the same loop.

Traps

  • Trying to fix it by raising the OSPF cost on the tunnel. Longest prefix match is checked before any metric.
How did you do?Book 3.4 Routing