0

I have an interesting configuration and would like some help getting it to work.

On a hardware network monitoring probe, i have 2 physical interfaces. mgmt is the management interface and mon1 is a monitoring interface. In normal operations, the mon1 interface is configured in promiscuous mode and we mirror network traffic to the probe and it generates IPFIX for the traffic it sees.

Im now tring to configure an ERSPAN GRE tunnel to terminate on the probe and cant seem to keep the traffic coming inbound on the monitor interface (mon1). The GRE tunnel seems to prefer the management interface(mgmt).

The IPs in the example are:

Network Probe:
  mgmt -> 10.30.15.16
  mon1 -> 10.30.15.41 (For the GRE tunnel)
  tun0 -> 10.30.15.41 (Also for the GRE tunnel)

Switch:
  External IP -> 10.1.1.4
  Tunnel IP -> 10.30.15.40

I guess it could be a timing issue where the switch marks 10.30.15.41 down with the MAC from mgmt before the tunnel can be set up...

It could be a routing issue but im not sure how to solve that. Here are the currently configured routes:

[root@hardwareheavy ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.30.1.1       0.0.0.0         UG    100    0        0 mgmt
0.0.0.0         10.30.1.1       0.0.0.0         UG    103    0        0 mon1
10.30.0.0       0.0.0.0         255.255.0.0     U     100    0        0 mgmt
10.30.0.0       0.0.0.0         255.255.0.0     U     103    0        0 mon1
10.30.15.40     0.0.0.0         255.255.255.255 UH    0      0        0 tun0

[root@hardwareheavy ~]# cat /etc/sysconfig/network-scripts/route-mon1
10.1.1.4 via 10.30.1.1 dev mon1 table mon1
10.30.15.41 via 10.30.1.1 dev mon1 table mon1
default via 10.30.1.1 dev mon1 table mon1

[root@hardwareheavy ~]# cat /etc/sysconfig/network-scripts/rule-mon3
to 10.1.1.4 src 10.30.15.41 table mon3
to 10.30.15.40 src 10.30.15.41 table mon3
from 10.1.1.4 src 10.30.15.41 table mon3
from 10.30.15.40 src 10.30.15.41 table mon3

The GRE tunnel is created after i configure the ifcfg file for tun0(the tunnel termination interface)

[root@hardwareheavy ~]# cat /etc/sysconfig/network-scripts/ifcfg-tun0
DEVICE=tun0
NAME=tun0
ONBOOT=yes
BOOTPROTO=none
TYPE=GRE
MTU=9000
GATEWAYDEV=mon2
PEER_OUTER_IPADDR=10.1.1.4
PEER_INNER_IPADDR=10.30.15.40
MY_INNER_IPADDR=10.30.15.41

Kernel Settings i changed:

net.ipv4.ip_forward = 0
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.default.arp_ignore = 1
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.default.arp_announce = 2

I am no expert so let me know if there is anything else you need to see to help get past this issue. Any help is greatly appreciated.

And before you say it, No I can not change the OS and Yes, it needs to be a ERSPAN/GRE tunnel. Maybe I'm going about this all wrong and there is a better way to configure an ERSPAN in centos...

1 Answer 1

0

I found the answer to this. I needed to send an arping out every few seconds to keep the switch up-to-date on the MAC of the interface associated with the tunnel.

while sleep 5 ; do arping -I $args{interface} -D $args{peerOutside} -c2 -q ; done

Hope this helps someone down the line...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .