この製品のドキュメントセットは、偏向のない言語を使用するように配慮されています。このドキュメントセットでの偏向のない言語とは、年齢、障害、性別、人種的アイデンティティ、民族的アイデンティティ、性的指向、社会経済的地位、およびインターセクショナリティに基づく差別を意味しない言語として定義されています。製品ソフトウェアのユーザインターフェイスにハードコードされている言語、RFP のドキュメントに基づいて使用されている言語、または参照されているサードパーティ製品で使用されている言語によりドキュメントに例外が存在する場合があります。シスコのインクルーシブ ランゲージの取り組みの詳細は、こちらをご覧ください。
シスコは世界中のユーザにそれぞれの言語でサポート コンテンツを提供するために、機械と人による翻訳を組み合わせて、本ドキュメントを翻訳しています。ただし、最高度の機械翻訳であっても、専門家による翻訳のような正確性は確保されません。シスコは、これら翻訳の正確性について法的責任を負いません。原典である英語版(リンクからアクセス可能)もあわせて参照することを推奨します。
このドキュメントでは、SD-WANダイナミックオンデマンドトンネルに関連する問題を設定またはチェックする際に使用できるトラブルシューティングコマンドについて説明します。
このドキュメントは、次の設定リファレンス、ソフトウェア、およびハードウェアのバージョンに基づいています。
このドキュメントの情報は、特定のラボ環境にあるデバイスに基づいて作成されました。このドキュメントで使用するすべてのデバイスは、クリアな(デフォルト)設定で作業を開始しています。本稼働中のネットワークでは、各コマンドによって起こる可能性がある影響を十分確認してください。
注:ダイナミックオンデマンドトンネルの設定については、このドキュメントを参照してください。
Cisco SD-WANは、任意の2つのCisco SD-WANスポークデバイス間のダイナミックオンデマンドトンネルをサポートします。これらのトンネルは、2つのデバイス間にトラフィックが存在する場合にのみ設定され、帯域幅の使用率とデバイスのパフォーマンスが最適化されます。
通常の運用シナリオでは、オンデマンドトンネルのトリガー条件は次のとおりです。
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 2:13:14:35 6
Spoke 1#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes inactive -
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 C,I,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 I,U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 I,U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 I,U,IA installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 U,IA installed 10.10.10.2 private2 ipsec - None None -
Spoke 2#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.2 10.100.100.1 12366 ipsec 7 1000 0:11:10:01 1
Spoke 2#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
1 10.10.10.1 yes inactive -
Spoke 1#ping vrf 10 10.2.2.2 re 20
Type escape sequence to abort.
Sending 20, 100-byte ICMP Echos to 10.2.2.2, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (20/20), round-trip min/avg/max = 1/3/31 ms
Spoke 1#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes active 56
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 0:11:14:51 1
10.10.10.2 2 up default default 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:00:53 1----> BFD session established due of interest traffic and on-demand configuration
10.10.10.2 2 up blue blue 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:00:52 1
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 C,I,R installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 C,I,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 C,I,R installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 C,R installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 C,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 C,R installed 10.10.10.2 private2 ipsec - None None -
Spoke 2#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
1 10.10.10.1 yes active 53
Spoke 2#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.2 10.100.100.1 12366 ipsec 7 1000 0:11:14:56 1
10.10.10.1 2 up default default 10.10.10.2 10.11.11.1 12366 ipsec 7 1000 0:00:00:53 1----> BFD session established due of interest traffic and on-demand configuration
10.10.10.1 2 up blue blue 10.10.10.2 10.11.11.1 12366 ipsec 7 1000 0:00:00:52
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 0:11:19:11 1
Spoke 1#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes inactive -
Spoke 2#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.2 10.100.100.1 12366 ipsec 7 1000 0:11:19:11 1
Spoke 2#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
1 10.10.10.1 yes inactive -
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 U,IA installed 10.10.10.2 private1ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 U,IA installed 10.10.10.2 private2ipsec - None None -
192.168.0.2 71 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 U,IA installed 10.10.10.2 private1ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 U,IA installed 10.10.10.2 private2ipsec - None None -
Hub#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR. SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.2 2 up blue blue 10.10.10.100 10.12.12.2 12366 ipsec 7 1000 1:23:58:15 2
10.10.10.1 1 up default default 10.10.10.100 10.11.11.1 12366 ipsec 7 1000 1:23:59:12 6
Spoke 1#show sdwan system on-demand
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-CFG(min)
-------------------------------------------------------------------------
1 10.10.10.1 yes active 10
Spoke 2#show sdwan system on-demand
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-CFG(min)
-------------------------------------------------------------------------
2 10.10.10.2 yes active 10
hub#show sdwan run | inc TE
!
hub#config-trans
hub(config)# sdwan
hub(config-vrf-global)# service TE vrf global
hub(config-vrf-global)# commit
Before interest traffic
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 C,I,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 I,U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 I,U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 I,U,IA installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 U,IA installed 10.10.10.2 private2 ipsec - None None -
While interest traffic
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 C,I,R installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 C,I,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 C,I,R installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 C,R installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 C,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 C,R installed 10.10.10.2 private2 ipsec - None None -
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 1:23:58:15 2
10.10.10.2 2 up default default 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:01:50 2----> BFD session established due of on-demand tunnel configuration.
10.10.10.2 2 up blue blue 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:01:52 2
Spoke 1#show sdwan system on-demand remote-system system-ip 10.10.10.2
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes active 41 ------>on-demand tunnel established to spoke 2 10.10.10.2 due of interest traffic
Spoke 1#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 no - -
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 1:23:58:15 3
10.10.10.2 2 up default default 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:18:53 4
10.10.10.2 2 up blue blue 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:18:52 3
Spoke 1#show sdwan omp route vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 73 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 74 1003 C,I,R installed 10.10.10.2 default ipsec - None None -
192.168.0.1 76 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 77 1003 C,I,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 79 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 80 1003 C,I,R installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 89 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 90 1003 C,R installed 10.10.10.2 default ipsec - None None -
192.168.0.2 92 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 93 1003 C,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 95 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 96 1003 C,R installed 10.10.10.2 private2 ipsec - None None -
viptela-policy:policy control-policy ondemand sequence 1 match route site-list Spokes prefix-list _AnyIpv4PrefixList ! action accept set tloc-action backup tloc-list hub ! ! ! default-action accept ! lists site-list Spokes site-id 1-2 ! tloc-list hub tloc 10.10.10.100 color blue encap ipsec tloc 10.10.10.100 color default encap ipsec tloc 10.10.10.100 color private1 encap ipsec tloc 10.10.10.100 color private2 encap ipsec ! prefix-list _AnyIpv4PrefixList ip-prefix 0.0.0.0/0 le 32 ! ! ! apply-policy site-list Spokes control-policy ondemand out ! !
Spoke 1#show sdwan run | inc on-demand
on-demand enable
on-demand idle-timeout 10
Spoke 2#show sdwan run | inc on-demand
Spoke 2#
Hub#show sdwan run | inc TE
service TE vrf global
Spoke 2#config-trans
Spoke 2(config)# system
Spoke 2(config-vrf-global)# on-demand enable
Spoke 2(config-vrf-global)# on-demand idle-timeout 10
Spoke 2(config-vrf-global)# commit
Spoke 1#show sdwan system on-demand remote-system
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes inactive -
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 C,I,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 I,U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 I,U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 I,U,IA installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 U,IA installed 10.10.10.2 private2 ipsec - None None -
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 C,I,R installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 C,I,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 C,I,R installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 C,R installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 C,R installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 C,R installed 10.10.10.2 private2 ipsec - None None -
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 2:04:34:11 2
10.10.10.2 2 up default default 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:02:10 2----> BFD session established due of on-demand tunnel configuration.
10.10.10.2 2 up blue blue 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:02:08 2
Spoke 1#show sdwan system on-demand remote-system system-ip 10.10.10.2
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes active 41 ------>on-demand tunnel established to Spoke 2 10.10.10.2 due of interest traffic
Spoke 1#show sdwan omp route vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 108 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.1 113 1003 U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 141 1003 U,IA installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 112 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.2 117 1003 U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 144 1003 U,IA installed 10.10.10.2 private2 ipsec - None None -
Spoke 1#show sdwan run | inc on-demand
on-demand enable
on-demand idle-timeout 10
Spoke 2#show sdwan run | inc on-demand
on-demand enable
on-demand idle-timeout 10
Hub#show sdwan run | inc TE
service TE vrf global
viptela-policy:policy control-policy ondemand sequence 1 match route site-list Spokes prefix-list _AnyIpv4PrefixList ! action accept set tloc-action backup tloc-list hub ! ! ! default-action accept ! lists site-list Spokes site-id 1 ! tloc-list hub tloc 10.10.10.100 color blue encap ipsec tloc 10.10.10.100 color default encap ipsec tloc 10.10.10.100 color private1 encap ipsec tloc 10.10.10.100 color private2 encap ipsec ! prefix-list _AnyIpv4PrefixList ip-prefix 0.0.0.0/0 le 32 ! ! ! apply-policy site-list Spokes control-policy ondemand out !
Spokes site list from policy before
lists
site-list Spokes
site-id 1
!
Spokes site list from policy after
lists
site-list Spokes
site-id 1-2
!
Spoke 1#show sdwan omp routes vpn 10 10.2.2.2/32
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
BR-R -> border-router reoriginated
TGW-R -> transport-gateway reoriginated
AFFINITY
PATH ATTRIBUTE GROUP
TENANT VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE NUMBER REGION ID REGION PATH
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0 10 10.2.2.2/32 192.168.0.1 61 1005 C,I,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 62 1003 I,U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.1 64 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 65 1003 I,U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.1 67 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.1 68 1003 I,U,IA installed 10.10.10.2 private2 ipsec - None None -
192.168.0.2 71 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 72 1003 U,IA installed 10.10.10.2 default ipsec - None None -
192.168.0.2 74 1005 C,R installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 75 1003 U,IA installed 10.10.10.2 private1 ipsec - None None -
192.168.0.2 77 1005 Inv,U installed 10.10.10.100 blue ipsec - None None -
192.168.0.2 78 1003 U,IA installed 10.10.10.2 private2 ipsec - None None -
Spoke 1#show sdwan bfd sessions
SOURCE TLOC REMOTE TLOC DST PUBLIC DST PUBLIC DETECT TX
SYSTEM IP SITE ID STATE COLOR COLOR SOURCE IP IP PORT ENCAP MULTIPLIER INTERVAL(msec) UPTIME TRANSITIONS
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
10.10.10.100 100 up blue blue 10.10.10.1 10.100.100.1 12366 ipsec 7 1000 2:07:01:43 6
10.10.10.2 2 up default default 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:00:56 2----> BFD session established due of on-demand tunnel configuration.
10.10.10.2 2 up blue blue 10.10.10.1 10.12.12.2 12366 ipsec 7 1000 0:00:00:56 2
Spoke 1#show sdwan system on-demand remote-system system-ip 10.10.10.2
SITE-ID SYSTEM-IP ON-DEMAND STATUS IDLE-TIMEOUT-EXPIRY(sec)
---------------------------------------------------------------------------
2 10.10.10.2 yes active 56 ------>on-demand tunnel established to Spoke 2 10.10.10.2 due of interest traffic
改定 | 発行日 | コメント |
---|---|---|
1.0 |
05-Oct-2023 |
初版 |