Wireless Access

 View Only
Back to discussions
Expand all | Collapse all

Requesting help with Layer 3 GRE tunneling

This thread has been viewed 45 times

  • 1.  Requesting help with Layer 3 GRE tunneling

    Posted Jul 06, 2021 03:25 AM
    Edited by kell490 Jul 13, 2021 06:42 PM
      |   view attached
    Hello,
      We have had a spoke and hub style Layer 2 GRE tunnel setup for our guest wireless network for years, but I would like to make the tunnels layer 3 move the DHCP server down to the local controllers currently DHCP is from the firewall one big layer 2 network. 

    I setup a lab configuration for testing the layer 3 GRE tunnels, but I'm unable to get traffic to route properly though the GRE tunnel to the internet. I have static routes to direct traffic to the tunnel IP on both ends as the guide states. When I do a ping from test-2 controller where I have an AP and a few clients connected. I'm not able to ping my internet gateway, or any internet IP using source vlan 200. I have tested the firewall by configuring a WLAN on the internet controller (test-1) that is directly connected to the firewall I was able to get on the internet using vlan 900 I have trunked from that internet controller to the firewall VLAN 900. I know the internet is working I'm not able to get traffic to go though the tunnel.  Both controllers are licensed with  AP, PEF, RF-protect.  AOS software is 8.5.0.13  I can post the entire configs if needed, and I have included a Visio Drawing PDF file. 

    Attachment(s)

    pdf
    Aruba-lab-L3-GRE.pdf   119 KB 1 version


  • 2.  RE: Requesting help with Layer 3 GRE tunneling

    Posted Jul 06, 2021 12:56 PM
    Edited by kell490 Jul 13, 2021 06:42 PM
    deleted


  • 3.  RE: Requesting help with Layer 3 GRE tunneling

    Posted Jul 06, 2021 04:39 PM
      |   view attached
    Honestly, you would need an l2 gre tunnel.  Have you seen the attached document?

    What routes what depends on what is the default gateway of the guest clients.  There can be a l2 gre tunnel from controller to controller, but the guest VLAN could have the default gateway of a third device that actually does the routing.

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
    ------------------------------

    Attachment(s)

    pdf
    L2_GRE_for_Guest_Access_in_ArubaOS8 (1).pdf   1.51 MB 1 version
    Original Message


  • 4.  RE: Requesting help with Layer 3 GRE tunneling

    Posted Jul 06, 2021 06:59 PM
    Edited by kell490 Jul 13, 2021 06:41 PM
    Deleted


  • 5.  RE: Requesting help with Layer 3 GRE tunneling
    Best Answer

    Posted Jul 13, 2021 06:39 PM
    Edited by kell490 Jul 13, 2021 09:40 PM
    I was able to get it working the guide is wrong shows the tunnel ip as 1.1.1.1/32 and 1.1.1.2/32 on each end of the tunnel it needs to be 1.1.1.1/30 and 1.1.1.2/30. Also not good idea to use 1.1.1.1 because there is a public DNS IP I thought it was working reality it wasn't after doing a trace route.  This is what worked if someone else is trying to figure this out be here.   

    Controller 2 > VLAN 200 Wireless 1.200.1.254/24  > Tunnel Source IP is the Controller 2 IP> Inside tunnel IP (192.168.1.1/30 - 192.168.1.2/30) < DEST Controller 1 IP > VLAN 900 IP 10.255.63.253/24 > PA firewall Trunked Dot.1q L3 Sub-interface Vlan 900 IP 10.255.63.254.

    Oddly I had issues getting it to work with just a access port L3 interface even though arp tables on the PA firewall and arp table in the Directly connected Controller 1 had both IP and MAC's in each table would not ping from the controller to the firewall. Configured as a Trunk port worked. I even setup a laptop to the IP and gateway of the controllers configured trusted access port still the controller would not ping it works from a WLAN. The strange thing was on the other controller I was able to ping both ways same configuration.  We like Trunk ports anyway in production it worked without issue using the Trunk and .1Q sub-interface IP. 

    Controller 2 routes 
    Default gateway 192.168.1.1
    IP route 10.255.63.0/24 next hop 192.168.1.1

    Controller 1 routes
    Default gateway 10.255.63.254
    IP route 10.200.1.0/24 next hop 192.168.1.2 

    PA firewall  which is has a nat going to the internet
    Trust sided routing 
    IP Route 10.200.1.0/24 next hop 10.255.63.253 

    I have a DHCP server running from the controller vlan 200 DNS 8.8.8.8. 
    We had never used L3 tunnels before because of the controllers limited DHCP server now that Aruba supports up to 4000 IP's with a 7200 controller that should be more then enough for each controller set we don't have more then 2000 clients on each controller cluster.  Also if you don't have those Default gateways setup correctly I was able to ping 8.8.8.8 when I used a browser it would try to use the controllers captive portal like an interface was not Trusted. I need to do further testing when I turn this up on our production network make sure no one is able to manage our controllers either using SSH, or WebUI from our open SSID guest wireless. 

    ------------------------------
    Kelly L
    ------------------------------

    Original Message


Related Content